Navigate

AT-3(2)

AT-3(2): Physical Security Controls

The organization provides [organization-defined personnel or roles] with initial and [organization-defined frequency] training in the employment and operation of physical security controls.

Supplemental

Physical security controls include, for example, physical access control devices, physical intrusion alarms, monitoring/surveillance equipment, and security guards (deployment and operating procedures). Organizations identify personnel with specific roles and responsibilities associated with physical security controls requiring specialized training.

CIA Levels
Confidentiality	high
Integrity	high
Availability	high

Overlays
None

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to AT-3(2).

Control	Description
PE-2	The organization: a: Develops, approves, and maintains a list of individuals with authorized access to the facility where the information system resides; b: Issues authorization credentials for facility access; c: Reviews the access list detailing authorized facility access by individuals [organization-defined frequency]; and d: Removes individuals from the facility access list when access is no longer required.
PE-3	The organization: a: Enforces physical access authorizations at [organization-defined entry/exit points to the facility where the information system resides] by; 1: Verifying individual access authorizations before granting access to the facility; and 2: Controlling ingress/egress to the facility using [one or more of {{ insert: param, pe-3_prm_3 }} /guards]; b: Maintains physical access audit logs for [organization-defined entry/exit points]; c: Provides [organization-defined security safeguards] to control access to areas within the facility officially designated as publicly accessible; d: Escorts visitors and monitors visitor activity [organization-defined circumstances requiring visitor escorts and monitoring]; e: Secures keys, combinations, and other physical access devices; f: Inventories [organization-defined physical access devices] every [organization-defined frequency]; and g: Changes combinations and keys [organization-defined frequency] and/or when keys are lost, combinations are compromised, or individuals are transferred or terminated.
PE-4	The organization controls physical access to [organization-defined information system distribution and transmission lines] within organizational facilities using [organization-defined security safeguards].
PE-5	The organization controls physical access to information system output devices to prevent unauthorized individuals from obtaining the output.

Enhancements

The controls below (if any) add on to the requirements of AT-3(2).

Control	Description
No controls

Related CCIs

The CCIs below are tied to AT-3(2).

CCI	Definition
CCI-001566	Provide organization-defined personnel or roles with initial training in the employment and operation of physical security controls.
CCI-001567	Provide organization-defined personnel or roles with refresher training, thereafter, in the employment and operation of physical security controls in accordance with the organization-defined frequency.
CCI-001568	Defines a frequency for providing employees with refresher training in the employment and operation of physical security controls.
CCI-002051	Defines the personnel or roles to whom initial and refresher training in the employment and operation of physical security controls is to be provided.