Navigate

AT-3 (2)

AT-3 (2): Physical Security Controls

The organization provides [Assignment: organization-defined personnel or roles] with initial and [Assignment: organization-defined frequency] training in the employment and operation of physical security controls.

Supplemental

Physical security controls include, for example, physical access control devices, physical intrusion alarms, monitoring/surveillance equipment, and security guards (deployment and operating procedures). Organizations identify personnel with specific roles and responsibilities associated with physical security controls requiring specialized training.

CIA Levels
Confidentiality	low
Integrity	low
Availability	low

Overlays
None

Related Controls

The controls below (if any) were marked by NIST as being related to AT-3 (2).

Control	Description
PE-2	The organization: PE-2a.: Develops, approves, and maintains a list of individuals with authorized access to the facility where the information system resides; PE-2b.: Issues authorization credentials for facility access; PE-2c.: Reviews the access list detailing authorized facility access by individuals [Assignment: organization-defined frequency]; and PE-2d.: Removes individuals from the facility access list when access is no longer required.
PE-3	The organization: PE-3a.: Enforces physical access authorizations at [Assignment: organization-defined entry/exit points to the facility where the information system resides] by; PE-3a.1.: Verifying individual access authorizations before granting access to the facility; and PE-3a.2.: Controlling ingress/egress to the facility using [Selection (one or more): [Assignment: organization-defined physical access control systems/devices]; guards]; PE-3b.: Maintains physical access audit logs for [Assignment: organization-defined entry/exit points]; PE-3c.: Provides [Assignment: organization-defined security safeguards] to control access to areas within the facility officially designated as publicly accessible; PE-3d.: Escorts visitors and monitors visitor activity [Assignment: organization-defined circumstances requiring visitor escorts and monitoring]; PE-3e.: Secures keys, combinations, and other physical access devices; PE-3f.: Inventories [Assignment: organization-defined physical access devices] every [Assignment: organization-defined frequency]; and PE-3g.: Changes combinations and keys [Assignment: organization-defined frequency] and/or when keys are lost, combinations are compromised, or individuals are transferred or terminated.
PE-4	The organization controls physical access to [Assignment: organization-defined information system distribution and transmission lines] within organizational facilities using [Assignment: organization-defined security safeguards].
PE-5	The organization controls physical access to information system output devices to prevent unauthorized individuals from obtaining the output.

Enhancements

The controls below (if any) add on to the requirements of AT-3 (2).

Control	Description
No controls

Related CCIs

The CCIs below are tied to AT-3 (2).

CCI	Definition
CCI-001566	The organization provides organization-defined personnel or roles with initial training in the employment and operation of physical security controls.
CCI-001567	The organization provides organization-defined personnel or roles with refresher training in the employment and operation of physical security controls in accordance with the organization-defined frequency.
CCI-001568	The organization defines a frequency for providing employees with refresher training in the employment and operation of physical security controls.
CCI-002051	The organization defines the personnel or roles to whom initial and refresher training in the employment and operation of physical security controls is to be provided.