Navigate

CCI-000921

CCI-000921 Definition

The organization controls ingress/egress to the facility where the information system resides using one or more organization-defined physical access control systems/devices or guards.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed will control ingress/egress to the facility using the physical access control devices and/or guards defined in PE-3, CCI 2916.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the list of physical access control devices and/or guards in use defined in PE-3, CCI 2916 and conducts random inspections of entry points. The purpose is to determine whether the organization is using those physical access devices and/or guards to control entry of personnel into the facility hosting the information system.

Compelling Evidence

1.) Description of physical access control devices and/or guards used to control entry/exit 2.) Facility access log 3.) Entry/exit pen test results

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-000921.

Control	Description
PE-3	The organization: a: Enforces physical access authorizations at [organization-defined entry/exit points to the facility where the information system resides] by; 1: Verifying individual access authorizations before granting access to the facility; and 2: Controlling ingress/egress to the facility using [one or more of {{ insert: param, pe-3_prm_3 }} /guards]; b: Maintains physical access audit logs for [organization-defined entry/exit points]; c: Provides [organization-defined security safeguards] to control access to areas within the facility officially designated as publicly accessible; d: Escorts visitors and monitors visitor activity [organization-defined circumstances requiring visitor escorts and monitoring]; e: Secures keys, combinations, and other physical access devices; f: Inventories [organization-defined physical access devices] every [organization-defined frequency]; and g: Changes combinations and keys [organization-defined frequency] and/or when keys are lost, combinations are compromised, or individuals are transferred or terminated.

Control

Description

PE-3

The organization:

a: Enforces physical access authorizations at [organization-defined entry/exit points to the facility where the information system resides] by;
- 1: Verifying individual access authorizations before granting access to the facility; and
- 2: Controlling ingress/egress to the facility using [one or more of {{ insert: param, pe-3_prm_3 }} /guards];

b: Maintains physical access audit logs for [organization-defined entry/exit points];

c: Provides [organization-defined security safeguards] to control access to areas within the facility officially designated as publicly accessible;

d: Escorts visitors and monitors visitor activity [organization-defined circumstances requiring visitor escorts and monitoring];

e: Secures keys, combinations, and other physical access devices;

f: Inventories [organization-defined physical access devices] every [organization-defined frequency]; and

g: Changes combinations and keys [organization-defined frequency] and/or when keys are lost, combinations are compromised, or individuals are transferred or terminated.