Navigate

CCI-004243

CCI-004243 Definition

Control egress to the facility where the information system resides using one or more organization-defined physical access control systems or devices or guards.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if physical access authorizations are enforced at [PE-03_ODP[01]; entry and exit points to the facility in which the system resides are defined] by controlling ingress and egress to the facility using [PE-03_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {[PE-03_ODP[03]; physical access control systems or devices used to control ingress and egress to the facility are defined (if selected)]; guards}].

Validation Procedures

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing physical access control; physical access control logs or records; inventory records of physical access control devices; system entry and exit points; records of key and lock combination changes; storage locations for physical access control devices; physical access control devices; list of security safeguards controlling access to designated publicly accessible areas within facility; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with physical access control responsibilities; organizational personnel with information security responsibilities]. Test: [SELECT FROM: Organizational processes for physical access control; mechanisms supporting and/or implementing physical access control; physical access control devices].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-004243.

Control	Description
PE-3	a: Enforce physical access authorizations at [entry and exit points to the facility in which the system resides are defined;] by: 1: Verifying individual access authorizations before granting access to the facility; and 2: Controlling ingress and egress to the facility using [one or more of "{{ insert: param, pe-03_odp.03 }} "/"guards"]; b: Maintain physical access audit logs for [entry or exit points for which physical access logs are maintained are defined;]; c: Control access to areas within the facility designated as publicly accessible by implementing the following controls: [physical access controls to control access to areas within the facility designated as publicly accessible are defined;]; d: Escort visitors and control visitor activity [circumstances requiring visitor escorts and control of visitor activity are defined;]; e: Secure keys, combinations, and other physical access devices; f: Inventory [physical access devices to be inventoried are defined;] every [frequency at which to inventory physical access devices is defined;] ; and g: Change combinations and keys [one of ] and/or when keys are lost, combinations are compromised, or when individuals possessing the keys or combinations are transferred or terminated.

Control

Description

PE-3

a: Enforce physical access authorizations at [entry and exit points to the facility in which the system resides are defined;] by:
- 1: Verifying individual access authorizations before granting access to the facility; and
- 2: Controlling ingress and egress to the facility using [one or more of "{{ insert: param, pe-03_odp.03 }} "/"guards"];

b: Maintain physical access audit logs for [entry or exit points for which physical access logs are maintained are defined;];

c: Control access to areas within the facility designated as publicly accessible by implementing the following controls: [physical access controls to control access to areas within the facility designated as publicly accessible are defined;];

d: Escort visitors and control visitor activity [circumstances requiring visitor escorts and control of visitor activity are defined;];

e: Secure keys, combinations, and other physical access devices;

f: Inventory [physical access devices to be inventoried are defined;] every [frequency at which to inventory physical access devices is defined;] ; and

g: Change combinations and keys [one of ] and/or when keys are lost, combinations are compromised, or when individuals possessing the keys or combinations are transferred or terminated.