Navigate

CCI-002915

CCI-002915 Definition

Defines the entry and exit points to the facility where the system resides.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed defines and documents the entry/exit points to the facility where the information system resides. DoD has determined the entry/exit points are not appropriate to define at the Enterprise level.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented entry/exit points and inspects the facility to ensure that all entry/exit points are documented. DoD has determined the entry/exit points are not appropriate to define at the Enterprise level.

Compelling Evidence

1.) Building/floor plan showing all entry/exit points or a document that describes in detail the entry /exit points.

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-002915.

Control	Description
PE-3	The organization: a: Enforces physical access authorizations at [organization-defined entry/exit points to the facility where the information system resides] by; 1: Verifying individual access authorizations before granting access to the facility; and 2: Controlling ingress/egress to the facility using [one or more of {{ insert: param, pe-3_prm_3 }} /guards]; b: Maintains physical access audit logs for [organization-defined entry/exit points]; c: Provides [organization-defined security safeguards] to control access to areas within the facility officially designated as publicly accessible; d: Escorts visitors and monitors visitor activity [organization-defined circumstances requiring visitor escorts and monitoring]; e: Secures keys, combinations, and other physical access devices; f: Inventories [organization-defined physical access devices] every [organization-defined frequency]; and g: Changes combinations and keys [organization-defined frequency] and/or when keys are lost, combinations are compromised, or individuals are transferred or terminated.

Control

Description

PE-3

The organization:

a: Enforces physical access authorizations at [organization-defined entry/exit points to the facility where the information system resides] by;
- 1: Verifying individual access authorizations before granting access to the facility; and
- 2: Controlling ingress/egress to the facility using [one or more of {{ insert: param, pe-3_prm_3 }} /guards];

b: Maintains physical access audit logs for [organization-defined entry/exit points];

c: Provides [organization-defined security safeguards] to control access to areas within the facility officially designated as publicly accessible;

d: Escorts visitors and monitors visitor activity [organization-defined circumstances requiring visitor escorts and monitoring];

e: Secures keys, combinations, and other physical access devices;

f: Inventories [organization-defined physical access devices] every [organization-defined frequency]; and

g: Changes combinations and keys [organization-defined frequency] and/or when keys are lost, combinations are compromised, or individuals are transferred or terminated.