Navigate

AT-3(2)

AT-3(2): Physical Security Controls

Provide [personnel or roles to be provided with initial and refresher training in the employment and operation of physical security controls is/are defined;] with initial and [the frequency at which to provide refresher training in the employment and operation of physical security controls is defined;] training in the employment and operation of physical security controls.

Supplemental

Physical security controls include physical access control devices, physical intrusion and detection alarms, operating procedures for facility security guards, and monitoring or surveillance equipment.

CIA Levels
Confidentiality	low
Integrity	low
Availability	low

Overlays
DAF Baseline

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to AT-3(2).

Control	Description
PE-2	a: Develop, approve, and maintain a list of individuals with authorized access to the facility where the system resides; b: Issue authorization credentials for facility access; c: Review the access list detailing authorized facility access by individuals [frequency at which to review the access list detailing authorized facility access by individuals is defined;] ; and d: Remove individuals from the facility access list when access is no longer required.
PE-3	a: Enforce physical access authorizations at [entry and exit points to the facility in which the system resides are defined;] by: 1: Verifying individual access authorizations before granting access to the facility; and 2: Controlling ingress and egress to the facility using [one or more of "{{ insert: param, pe-03_odp.03 }} "/"guards"]; b: Maintain physical access audit logs for [entry or exit points for which physical access logs are maintained are defined;]; c: Control access to areas within the facility designated as publicly accessible by implementing the following controls: [physical access controls to control access to areas within the facility designated as publicly accessible are defined;]; d: Escort visitors and control visitor activity [circumstances requiring visitor escorts and control of visitor activity are defined;]; e: Secure keys, combinations, and other physical access devices; f: Inventory [physical access devices to be inventoried are defined;] every [frequency at which to inventory physical access devices is defined;] ; and g: Change combinations and keys [one of ] and/or when keys are lost, combinations are compromised, or when individuals possessing the keys or combinations are transferred or terminated.
PE-4	Control physical access to [system distribution and transmission lines requiring physical access controls are defined;] within organizational facilities using [security controls to be implemented to control physical access to system distribution and transmission lines within the organizational facility are defined;].

Enhancements

The controls below (if any) add on to the requirements of AT-3(2).

Control	Description
No controls

Related CCIs

The CCIs below are tied to AT-3(2).

CCI	Definition
CCI-001566	Provide organization-defined personnel or roles with initial training in the employment and operation of physical security controls.
CCI-001567	Provide organization-defined personnel or roles with refresher training, thereafter, in the employment and operation of physical security controls in accordance with the organization-defined frequency.
CCI-001568	Defines a frequency for providing employees with refresher training in the employment and operation of physical security controls.
CCI-002051	Defines the personnel or roles to whom initial and refresher training in the employment and operation of physical security controls is to be provided.