Navigate

CCI-000923

CCI-000923 Definition

Secure keys, combinations, and other physical access devices.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed will secure as appropriate (in safes or secure containers) items used for physical access control such as keys, combinations, portable locks, etc. Fixed access control devices such as card readers, installed locks, key pads, etc. should be protected from tampering.

Validation Procedures

The organization conducting the inspection/assessment conducts physical inspections and interviews physical security/safety personnel to validate the organization has taken the proper precautions, and established the proper procedures to ensure it has adequately secured its keys, combinations, and other physical devices.

Compelling Evidence

1.) Local policy and procedures for securing physical access devices. 2.) Evidence of protection of key lock box

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-000923.

Control	Description
PE-3	The organization: a: Enforces physical access authorizations at [organization-defined entry/exit points to the facility where the information system resides] by; 1: Verifying individual access authorizations before granting access to the facility; and 2: Controlling ingress/egress to the facility using [one or more of {{ insert: param, pe-3_prm_3 }} /guards]; b: Maintains physical access audit logs for [organization-defined entry/exit points]; c: Provides [organization-defined security safeguards] to control access to areas within the facility officially designated as publicly accessible; d: Escorts visitors and monitors visitor activity [organization-defined circumstances requiring visitor escorts and monitoring]; e: Secures keys, combinations, and other physical access devices; f: Inventories [organization-defined physical access devices] every [organization-defined frequency]; and g: Changes combinations and keys [organization-defined frequency] and/or when keys are lost, combinations are compromised, or individuals are transferred or terminated.

Control

Description

PE-3

The organization:

a: Enforces physical access authorizations at [organization-defined entry/exit points to the facility where the information system resides] by;
- 1: Verifying individual access authorizations before granting access to the facility; and
- 2: Controlling ingress/egress to the facility using [one or more of {{ insert: param, pe-3_prm_3 }} /guards];

b: Maintains physical access audit logs for [organization-defined entry/exit points];

c: Provides [organization-defined security safeguards] to control access to areas within the facility officially designated as publicly accessible;

d: Escorts visitors and monitors visitor activity [organization-defined circumstances requiring visitor escorts and monitoring];

e: Secures keys, combinations, and other physical access devices;

f: Inventories [organization-defined physical access devices] every [organization-defined frequency]; and

g: Changes combinations and keys [organization-defined frequency] and/or when keys are lost, combinations are compromised, or individuals are transferred or terminated.