PR.AC-P2: Physical access to data and devices is managed
CSF v1.1 References:
Threats Addressed:
Description
[csf.tools Note: Subcategories do not have detailed descriptions.]
Related Controls
NIST Special Publication 800-53 Revision 5
PE-1: Policy and Procedures
Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: [Assignment (one or more): organization-level, mission/business process-level, system-level] physical and environmental protection policy that: Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and Procedures to facilitate…
PE-2: Physical Access Authorizations
Develop, approve, and maintain a list of individuals with authorized access to the facility where the system resides; Issue authorization credentials for facility access; Review the access list detailing authorized facility access by individuals [Assignment: organization-defined frequency]; and Remove individuals from the facility access list when access is no longer required.
PE-3: Physical Access Control
Enforce physical access authorizations at [Assignment: organization-defined entry and exit points to the facility where the system resides] by: Verifying individual access authorizations before granting access to the facility; and Controlling ingress and egress to the facility using [Assignment (one or more): [Assignment: organization-defined physical access control systems or devices] , guards]; Maintain physical access…
PE-4: Access Control for Transmission
Control physical access to [Assignment: organization-defined system distribution and transmission lines] within organizational facilities using [Assignment: organization-defined security controls].
PE-5: Access Control for Output Devices
Control physical access to output from [Assignment: organization-defined output devices] to prevent unauthorized individuals from obtaining the output.
PE-6: Monitoring Physical Access
Monitor physical access to the facility where the system resides to detect and respond to physical security incidents; Review physical access logs [Assignment: organization-defined frequency] and upon occurrence of [Assignment: organization-defined events or potential indications of events]; and Coordinate results of reviews and investigations with the organizational incident response capability.
PE-8: Visitor Access Records
Maintain visitor access records to the facility where the system resides for [Assignment: organization-defined time period]; Review visitor access records [Assignment: organization-defined frequency]; and Report anomalies in visitor access records to [Assignment: organization-defined personnel].
PE-9: Power Equipment and Cabling
Protect power equipment and power cabling for the system from damage and destruction.
Cloud Controls Matrix v3.0.1
BCR-06: Equipment Location
To reduce the risks from environmental threats, hazards, and opportunities for unauthorized access, equipment shall be kept away from locations subject to high probability environmental risks and supplemented by redundant equipment located at a reasonable distance.
DCS-02: Controlled Access Points
Physical security perimeters (e.g., fences, walls, barriers, guards, gates, electronic surveillance, physical authentication mechanisms, reception desks, and security patrols) shall be implemented to safeguard sensitive data and information systems.
DCS-06: Policy
Policies and procedures shall be established, and supporting business processes implemented, for maintaining a safe and secure working environment in offices, rooms, facilities, and secure areas storing sensitive information.
DCS-07: Secure Area Authorization
Ingress and egress to secure areas shall be constrained and monitored by physical access control mechanisms to ensure that only authorized personnel are allowed access.
DCS-08: Unauthorized Persons Entry
Ingress and egress points such as service areas and other points where unauthorized personnel may enter the premises shall be monitored, controlled and, if possible, isolated from data storage and processing facilities to prevent unauthorized data corruption, compromise, and loss.
DCS-09: User Access
Physical access to information assets and functions by users and support personnel shall be restricted.
MOS-11: Encryption
The mobile device policy shall require the use of encryption either for the entire device or for data identified as sensitive on all mobile devices, and shall be enforced through technology controls.
MOS-14: Lockout Screen
BYOD and/or company-owned devices are configured to require an automatic lockout screen, and the requirement shall be enforced through technical controls.
MOS-18: Remote Wipe
All mobile devices permitted for use through the company BYOD program or a company-assigned mobile device shall allow for remote wipe by the company’s corporate IT or shall have all company-provided data wiped by the company’s corporate IT.
NIST Special Publication 800-53 Revision 4
PE-1: Physical And Environmental Protection Policy And Procedures
The organization: Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]: A physical and environmental protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and Procedures to facilitate the implementation of the physical and environmental protection policy and associated physical and environmental protection controls; and Reviews and…
PE-2: Physical Access Authorizations
The organization: Develops, approves, and maintains a list of individuals with authorized access to the facility where the information system resides; Issues authorization credentials for facility access; Reviews the access list detailing authorized facility access by individuals [Assignment: organization-defined frequency]; and Removes individuals from the facility access list when access is no longer required.
PE-3: Physical Access Control
The organization: Enforces physical access authorizations at [Assignment: organization-defined entry/exit points to the facility where the information system resides] by; Verifying individual access authorizations before granting access to the facility; and Controlling ingress/egress to the facility using [Selection (one or more): [Assignment: organization-defined physical access control systems/devices]; guards]; Maintains physical access audit logs for [Assignment:…
PE-4: Access Control For Transmission Medium
The organization controls physical access to [Assignment: organization-defined information system distribution and transmission lines] within organizational facilities using [Assignment: organization-defined security safeguards].
PE-5: Access Control For Output Devices
The organization controls physical access to information system output devices to prevent unauthorized individuals from obtaining the output.
PE-6: Monitoring Physical Access
The organization: Monitors physical access to the facility where the information system resides to detect and respond to physical security incidents; Reviews physical access logs [Assignment: organization-defined frequency] and upon occurrence of [Assignment: organization-defined events or potential indications of events]; and Coordinates results of reviews and investigations with the organizational incident response capability.
PE-8: Visitor Access Records
The organization: Maintains visitor access records to the facility where the information system resides for [Assignment: organization-defined time period]; and Reviews visitor access records [Assignment: organization-defined frequency].
PE-9: Power Equipment And Cabling
The organization protects power equipment and power cabling for the information system from damage and destruction.