Navigate

CCI-000919

CCI-000919 Definition

The organization enforces physical access authorizations at organization-defined entry/exit points to the facility where the information system resides.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed will implement physical access authorizations at entry/exit points defined in PE-3, CCI 2915 and secure those physical access points (i.e. doors and/or windows) that are not intended for normal access.

Validation Procedures

The organization conducting the inspection/assessment performs a physical inspection of facility entry/exit points defined in PE-3, CCI 2915 to ensure that either physical access authorization controls are in place for those access points considered normal access points or are properly secured. Physical access points that are not documented or are not secured would be a failure of this control.

Compelling Evidence

1.) Building/floor plan showing all entry/exit points, or a document that describes in detail the entry /exit points, door construct/access controls (badge swipe etc.), locking mechanisms.

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-000919.

Control	Description
PE-3	The organization: a: Enforces physical access authorizations at [organization-defined entry/exit points to the facility where the information system resides] by; 1: Verifying individual access authorizations before granting access to the facility; and 2: Controlling ingress/egress to the facility using [one or more of {{ insert: param, pe-3_prm_3 }} /guards]; b: Maintains physical access audit logs for [organization-defined entry/exit points]; c: Provides [organization-defined security safeguards] to control access to areas within the facility officially designated as publicly accessible; d: Escorts visitors and monitors visitor activity [organization-defined circumstances requiring visitor escorts and monitoring]; e: Secures keys, combinations, and other physical access devices; f: Inventories [organization-defined physical access devices] every [organization-defined frequency]; and g: Changes combinations and keys [organization-defined frequency] and/or when keys are lost, combinations are compromised, or individuals are transferred or terminated.

Control

Description

PE-3

The organization:

a: Enforces physical access authorizations at [organization-defined entry/exit points to the facility where the information system resides] by;
- 1: Verifying individual access authorizations before granting access to the facility; and
- 2: Controlling ingress/egress to the facility using [one or more of {{ insert: param, pe-3_prm_3 }} /guards];

b: Maintains physical access audit logs for [organization-defined entry/exit points];

c: Provides [organization-defined security safeguards] to control access to areas within the facility officially designated as publicly accessible;

d: Escorts visitors and monitors visitor activity [organization-defined circumstances requiring visitor escorts and monitoring];

e: Secures keys, combinations, and other physical access devices;

f: Inventories [organization-defined physical access devices] every [organization-defined frequency]; and

g: Changes combinations and keys [organization-defined frequency] and/or when keys are lost, combinations are compromised, or individuals are transferred or terminated.