Navigate

AT-3(2)

AT-3(2): Physical Security Controls

The organization provides [one of ] with initial and [one of ] training in the employment and operation of physical security controls.

Supplemental

Physical security controls include, for example, physical access control devices, physical intrusion alarms, monitoring/surveillance equipment, and security guards (deployment and operating procedures). Organizations identify personnel with specific roles and responsibilities associated with physical security controls requiring specialized training.

CIA Levels
Confidentiality	low
Integrity	low
Availability	low

Overlays
None

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to AT-3(2).

Control	Description
PE-2	The organization: a: Develops, approves, and maintains a list of individuals with authorized access to the facility where the information system resides; b: Issues authorization credentials for facility access; c: Reviews the access list detailing authorized facility access by individuals [one of ]; and d: Removes individuals from the facility access list when access is no longer required.
PE-3	The organization: a: Enforces physical access authorizations at [one of ] by; 1: Verifying individual access authorizations before granting access to the facility; and 2: Controlling ingress/egress to the facility using [one or more of " {{ insert: param, pe-3_prm_3 }} "/"guards"]; b: Maintains physical access audit logs for [one of ]; c: Provides [one of ] to control access to areas within the facility officially designated as publicly accessible; d: Escorts visitors and monitors visitor activity [one of ]; e: Secures keys, combinations, and other physical access devices; f: Inventories [one of ] every [one of ]; and g: Changes combinations and keys [one of ] and/or when keys are lost, combinations are compromised, or individuals are transferred or terminated.
PE-4	The organization controls physical access to [one of ] within organizational facilities using [one of ].
PE-5	The organization controls physical access to information system output devices to prevent unauthorized individuals from obtaining the output.

Enhancements

The controls below (if any) add on to the requirements of AT-3(2).

Control	Description
No controls

Related CCIs

The CCIs below are tied to AT-3(2).

CCI	Definition
CCI-001566	Provide organization-defined personnel or roles with initial training in the employment and operation of physical security controls.
CCI-001567	Provide organization-defined personnel or roles with refresher training, thereafter, in the employment and operation of physical security controls in accordance with the organization-defined frequency.
CCI-001568	Defines a frequency for providing employees with refresher training in the employment and operation of physical security controls.
CCI-002051	Defines the personnel or roles to whom initial and refresher training in the employment and operation of physical security controls is to be provided.