CCI-002917

Maintain physical access audit logs for organization-defined entry/exit points to the facility where the system resides.

Implementation Guidance

The organization being inspected/assessed maintains physical access audit logs for entry/exit points defined in PE-3, CCI 2918.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the physical access audit logs and compares the logged entry with known access to those entry points to ensure the organization being inspected/assessed maintains physical access audit logs for entry/exit points defined in PE-3, CCI 2918. Instances of access that will be compared with the audit logs include, at a minimum, access as part of the inspection/assessment. Comparison of other entry/exit events required elsewhere in system documentation that would have occurred before the inspection/assessment such as daily checks and scheduled maintenance are strongly encouraged and help to establish a history of compliance/non-compliance.

Compelling Evidence

1.) List of personnel with authorized access to the facility 2.) Copy of visitor logs/sign in sheet 3.) Access logs for each entry/exit point 4.) Daily check logs

The controls below (if any) were marked by NIST as being related to CCI-002917.