CCI-002940

Review physical access logs upon occurrence of organization-defined events or potential indications of events.

Implementation Guidance

The organization being inspected/assessed documents and implements a process to review physical access logs upon occurrence of events or potential indications of events defined in PE-6, CCI 2941. The organization must maintain records of reviews.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented process as well as the records of reviews to ensure the organization being inspected/assessed reviews physical access logs upon occurrence of events or potential indications of events defined in PE-6, CCI 2941.

Compelling Evidence

1.) Facility access control policy and procedures, including a section on monitoring and response to physical access security incidents 2.) AAR for any physical access security incidents (to include records reviewed during the incident).

The controls below (if any) were marked by NIST as being related to CCI-002940.