Navigate

CCI-000926

CCI-000926 Definition

Change combinations and keys in accordance with organization-defined frequency and/or when keys are lost, combinations are compromised, or when individuals possessing the keys or combinations are transferred or terminated.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if: - combinations are changed [PE-03_ODP[09]; frequency at which to change combinations is defined], when combinations are compromised, or when individuals possessing the combinations are transferred or terminated. - keys are changed [PE-03_ODP[10]; frequency at which to change keys is defined], when keys are lost, or when individuals possessing the keys are transferred or terminated.

Validation Procedures

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing physical access control; physical access control logs or records; inventory records of physical access control devices; system entry and exit points; records of key and lock combination changes; storage locations for physical access control devices; physical access control devices; list of security safeguards controlling access to designated publicly accessible areas within facility; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with physical access control responsibilities; organizational personnel with information security responsibilities]. Test: [SELECT FROM: Organizational processes for physical access control; mechanisms supporting and/or implementing physical access control; physical access control devices].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-000926.

Control	Description
PE-3	a: Enforce physical access authorizations at [entry and exit points to the facility in which the system resides are defined;] by: 1: Verifying individual access authorizations before granting access to the facility; and 2: Controlling ingress and egress to the facility using [one or more of "{{ insert: param, pe-03_odp.03 }} "/"guards"]; b: Maintain physical access audit logs for [entry or exit points for which physical access logs are maintained are defined;]; c: Control access to areas within the facility designated as publicly accessible by implementing the following controls: [physical access controls to control access to areas within the facility designated as publicly accessible are defined;]; d: Escort visitors and control visitor activity [circumstances requiring visitor escorts and control of visitor activity are defined;]; e: Secure keys, combinations, and other physical access devices; f: Inventory [physical access devices to be inventoried are defined;] every [frequency at which to inventory physical access devices is defined;] ; and g: Change combinations and keys [one of ] and/or when keys are lost, combinations are compromised, or when individuals possessing the keys or combinations are transferred or terminated.

Control

Description

PE-3

a: Enforce physical access authorizations at [entry and exit points to the facility in which the system resides are defined;] by:
- 1: Verifying individual access authorizations before granting access to the facility; and
- 2: Controlling ingress and egress to the facility using [one or more of "{{ insert: param, pe-03_odp.03 }} "/"guards"];

b: Maintain physical access audit logs for [entry or exit points for which physical access logs are maintained are defined;];

c: Control access to areas within the facility designated as publicly accessible by implementing the following controls: [physical access controls to control access to areas within the facility designated as publicly accessible are defined;];

d: Escort visitors and control visitor activity [circumstances requiring visitor escorts and control of visitor activity are defined;];

e: Secure keys, combinations, and other physical access devices;

f: Inventory [physical access devices to be inventoried are defined;] every [frequency at which to inventory physical access devices is defined;] ; and

g: Change combinations and keys [one of ] and/or when keys are lost, combinations are compromised, or when individuals possessing the keys or combinations are transferred or terminated.