Navigate

CCI-000924

CCI-000924 Definition

The organization inventories organization-defined physical access devices on an organization-defined frequency.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed conducts and documents an inventory of minimally keys or any other physical token used to gain access annually. Inventory documents must be retained for at least one year beyond the completion of the next inventory. DoD has defined the frequency as annually. DoD has defined the physical access devices as minimally keys or any other physical token used to gain access.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the records of inventory of minimally keys or any other physical token used to gain access to ensure the inventory is being conducted annually. DoD has defined the frequency as annually. DoD has defined the physical access devices as minimally keys or any other physical token used to gain access.

Compelling Evidence

1.) Inventory log

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-000924.

Control	Description
PE-3	The organization: PE-3a.: Enforces physical access authorizations at [Assignment: organization-defined entry/exit points to the facility where the information system resides] by; PE-3a.1.: Verifying individual access authorizations before granting access to the facility; and PE-3a.2.: Controlling ingress/egress to the facility using [Selection (one or more): [Assignment: organization-defined physical access control systems/devices]; guards]; PE-3b.: Maintains physical access audit logs for [Assignment: organization-defined entry/exit points]; PE-3c.: Provides [Assignment: organization-defined security safeguards] to control access to areas within the facility officially designated as publicly accessible; PE-3d.: Escorts visitors and monitors visitor activity [Assignment: organization-defined circumstances requiring visitor escorts and monitoring]; PE-3e.: Secures keys, combinations, and other physical access devices; PE-3f.: Inventories [Assignment: organization-defined physical access devices] every [Assignment: organization-defined frequency]; and PE-3g.: Changes combinations and keys [Assignment: organization-defined frequency] and/or when keys are lost, combinations are compromised, or individuals are transferred or terminated.

Control

Description

PE-3

The organization:

PE-3a.: Enforces physical access authorizations at [Assignment: organization-defined entry/exit points to the facility where the information system resides] by;
- PE-3a.1.: Verifying individual access authorizations before granting access to the facility; and
- PE-3a.2.: Controlling ingress/egress to the facility using [Selection (one or more): [Assignment: organization-defined physical access control systems/devices]; guards];

PE-3b.: Maintains physical access audit logs for [Assignment: organization-defined entry/exit points];

PE-3c.: Provides [Assignment: organization-defined security safeguards] to control access to areas within the facility officially designated as publicly accessible;

PE-3d.: Escorts visitors and monitors visitor activity [Assignment: organization-defined circumstances requiring visitor escorts and monitoring];

PE-3e.: Secures keys, combinations, and other physical access devices;

PE-3f.: Inventories [Assignment: organization-defined physical access devices] every [Assignment: organization-defined frequency]; and

PE-3g.: Changes combinations and keys [Assignment: organization-defined frequency] and/or when keys are lost, combinations are compromised, or individuals are transferred or terminated.