Navigate

PE-2

PE-2: Physical Access Authorizations

The organization:

PE-2a.: Develops, approves, and maintains a list of individuals with authorized access to the facility where the information system resides;

PE-2b.: Issues authorization credentials for facility access;

PE-2c.: Reviews the access list detailing authorized facility access by individuals [Assignment: organization-defined frequency]; and

PE-2d.: Removes individuals from the facility access list when access is no longer required.

Supplemental

This control applies to organizational employees and visitors. Individuals (e.g., employees, contractors, and others) with permanent physical access authorization credentials are not considered visitors. Authorization credentials include, for example, badges, identification cards, and smart cards. Organizations determine the strength of authorization credentials needed (including level of forge-proof badges, smart cards, or identification cards) consistent with federal standards, policies, and procedures. This control only applies to areas within facilities that have not been designated as publicly accessible.

CIA Levels
Confidentiality	low
Integrity	low
Availability	low

Overlays
Privacy (High), Privacy (Low), Privacy (Mod), Privacy (PHI)

Related Controls

The controls below (if any) were marked by NIST as being related to PE-2.

Control	Description
PE-3	The organization: PE-3a.: Enforces physical access authorizations at [Assignment: organization-defined entry/exit points to the facility where the information system resides] by; PE-3a.1.: Verifying individual access authorizations before granting access to the facility; and PE-3a.2.: Controlling ingress/egress to the facility using [Selection (one or more): [Assignment: organization-defined physical access control systems/devices]; guards]; PE-3b.: Maintains physical access audit logs for [Assignment: organization-defined entry/exit points]; PE-3c.: Provides [Assignment: organization-defined security safeguards] to control access to areas within the facility officially designated as publicly accessible; PE-3d.: Escorts visitors and monitors visitor activity [Assignment: organization-defined circumstances requiring visitor escorts and monitoring]; PE-3e.: Secures keys, combinations, and other physical access devices; PE-3f.: Inventories [Assignment: organization-defined physical access devices] every [Assignment: organization-defined frequency]; and PE-3g.: Changes combinations and keys [Assignment: organization-defined frequency] and/or when keys are lost, combinations are compromised, or individuals are transferred or terminated.
PE-4	The organization controls physical access to [Assignment: organization-defined information system distribution and transmission lines] within organizational facilities using [Assignment: organization-defined security safeguards].
PS-3	The organization: PS-3a.: Screens individuals prior to authorizing access to the information system; and PS-3b.: Rescreens individuals according to [Assignment: organization-defined conditions requiring rescreening and, where rescreening is so indicated, the frequency of such rescreening].

Enhancements

The controls below (if any) add on to the requirements of PE-2.

Control	Description
PE-2 (1)	The organization authorizes physical access to the facility where the information system resides based on position or role.
PE-2 (2)	The organization requires two forms of identification from [Assignment: organization-defined list of acceptable forms of identification] for visitor access to the facility where the information system resides.
PE-2 (3)	The organization restricts unescorted access to the facility where the information system resides to personnel with [Selection (one or more): security clearances for all information contained within the system; formal access authorizations for all information contained within the system; need for access to all information contained within the system; [Assignment: organization-defined credentials]].

Related CCIs

The CCIs below are tied to PE-2.

CCI	Definition
CCI-000912	The organization develops a list of individuals with authorized access to the facility where the information system resides.
CCI-000913	The organization issues authorization credentials for facility access.
CCI-000914	The organization reviews the access list detailing authorized facility access by individuals in accordance with organization-defined frequency.
CCI-000915	The organization defines the frequency with which to review the access list detailing authorized facility access by individuals.
CCI-001635	The organization removes individuals from the facility access list when access is no longer required.
CCI-002910	The organization approves a list of individuals with authorized access to the facility where the information system resides.
CCI-002911	The organization maintains a list of individuals with authorized access to the facility where the information system resides.