DE.CM-02: The physical environment is monitored to find potentially adverse events

Previous Version:

Description

[csf.tools Note: Subcategories do not have detailed descriptions. However NIST has provided the following implementation examples.]

Implementation Examples

Ex1: Monitor logs from physical access control systems (e.g., badge readers) to find unusual access patterns (e.g., deviations from the norm) and failed access attempts

Ex2: Review and monitor physical access records (e.g., from visitor registration, sign-in sheets)

Ex3: Monitor physical access controls (e.g., locks, latches, hinge pins, alarms) for signs of tampering

Ex4: Monitor the physical environment using alarm systems, cameras, and security guards

1st: 1st Party Risk

Related Controls

NIST Special Publication 800-53 Revision 5.2.0

CA-7: Continuous Monitoring

Develop a system-level continuous monitoring strategy and implement continuous monitoring in accordance with the organization-level continuous monitoring strategy that includes: Establishing the following system-level metrics to be monitored: [Assignment: organization-defined system-level metrics]; Establishing [Assignment: organization-defined frequencies] for monitoring and [Assignment: organization-defined frequencies] for assessment of control effectiveness; Ongoing control assessments in accordance with the continuous…

PE-3: Physical Access Control

Enforce physical access authorizations at [Assignment: organization-defined entry and exit points] by: Verifying individual access authorizations before granting access to the facility; and Controlling ingress and egress to the facility using [Assignment (one or more): [Assignment: organization-defined systems or devices] , guards]; Maintain physical access audit logs for [Assignment: organization-defined entry or exit points]; Control…

PE-6: Monitoring Physical Access

Monitor physical access to the facility where the system resides to detect and respond to physical security incidents; Review physical access logs [Assignment: organization-defined frequency] and upon occurrence of [Assignment: organization-defined events] ; and Coordinate results of reviews and investigations with the organizational incident response capability.

PE-20: Asset Monitoring and Tracking

Employ [Assignment: organization-defined asset location technologies] to track and monitor the location and movement of [Assignment: organization-defined assets] within [Assignment: organization-defined controlled areas].

NIST SP 800-171 Revision 3.0

03.10.02: Monitoring Physical Access

Monitor physical access to the facility where the system resides to detect and respond to physical security incidents. Review physical access logs [Assignment: organization-defined frequency] and upon occurrence of [Assignment: organization-defined events or potential indicators of events].

03.10.07: Physical Access Control

Enforce physical access authorizations at entry and exit points to the facility where the system resides by: Verifying individual physical access authorizations before granting access to the facility and Controlling ingress and egress with physical access control systems, devices, or guards. Maintain physical access audit logs for entry or exit points. Escort visitors, and control…

03.12.03: Continuous Monitoring

Develop and implement a system-level continuous monitoring strategy that includes ongoing monitoring and security assessments.

Cloud Controls Matrix v4.0

DCS-09: Secure Area Authorization

Allow only authorized personnel access to secure areas, with all ingress and egress points restricted, documented, and monitored by physical access control mechanisms. Retain access control records on a periodic basis as deemed appropriate by the organization.

DCS-10: Surveillance System

Implement, maintain, and operate datacenter surveillance systems at the external perimeter and at all the ingress and egress points to detect unauthorized ingress and egress attempts.

DCS-14: Secure Utilities

Secure, monitor, maintain, and test utilities services for continual effectiveness at planned intervals.

LOG-03: Security Monitoring and Alerting

Identify and monitor security-related events within applications and the underlying infrastructure. Define and implement a system to generate alerts to responsible stakeholders based on such events and corresponding metrics.

LOG-05: Audit Logs Monitoring and Response

Monitor security audit logs to detect activity outside of typical or expected patterns. Establish and follow a defined process to review and take appropriate and timely actions on detected anomalies.