03.10.07 — Physical Access Control

Official NIST requirement content

Security requirement

a.Enforce physical access authorizations at entry and exit points to the facility where the system resides by:
1. 1.Verifying individual physical access authorizations before granting access to the facility and
2. 2.Controlling ingress and egress with physical access control systems, devices, or guards.
b.Maintain physical access audit logs for entry or exit points.
c.Escort visitors, and control visitor activity.
d.Secure keys, combinations, and other physical access devices.
e.Control physical access to output devices to prevent unauthorized individuals from obtaining access to CUI.

Official NIST discussion

Discussion

This requirement addresses physical locations containing systems or system components that process, store, or transmit CUI. Organizations determine the types of guards needed, including professional security staff or administrative staff. Physical access devices include keys, locks, combinations, biometric readers, and card readers. Physical access control systems comply with applicable laws, Executive Orders, directives, policies, regulations, standards, and guidelines. Organizations have flexibility in the types of audit logs employed. Audit logs can be procedural, automated, or some combination thereof. Physical access points can include exterior access points, interior access points to systems that require supplemental access controls, or both. Physical access control applies to employees and visitors. Individuals with permanent physical access authorizations are not considered visitors. Controlling physical access to output devices includes placing output devices in locked rooms or other secured areas with keypad or card reader access controls and only allowing access to authorized individuals, placing output devices in locations that can be monitored by personnel, installing monitor or screen filters, and using headphones. Examples of output devices include monitors, printers, scanners, facsimile machines, audio devices, and copiers.

Bare Metal Cyber interpretation

Implementation perspective

Treat Physical Access Control as a CUI protection outcome that must be reflected in the system boundary, documented implementation, operational behavior, and assessment evidence. Pay particular attention to physical access, facility protection, visitor accountability, and protection of system components that handle CUI.

Confirm the requirement is in scope for the CUI system components, services, users, and external connections being assessed.
Resolve every organization-defined parameter through an approved governance and tailoring process.
Map each clause of the requirement to an accountable owner, implementation mechanism, and evidence source.
Verify that inherited and shared implementations are supported by current provider evidence and responsibility boundaries.
Collect evidence during normal operation and review changes, exceptions, and deficiencies on a risk-based cadence.

Questions to ask

Which CUI assets, data flows, users, and services are protected by this requirement?
Which portions are implemented locally, inherited, shared, or not applicable, and what evidence supports that determination?
Do the system security plan, deployed configuration, operating process, and assessment evidence tell the same story?
What change, incident, or threshold should trigger reassessment?

Evidence and validation

badge and visitor logs
physical access reviews
facility diagrams and sensor records
environmental and power test results

Common failure patterns

logical controls undermined by physical access
tailgating or visitor exceptions normalized
critical infrastructure omitted from access reviews
environmental alarms disconnected from response

Official NIST SP 800-171A content

Assessment objectives and methods

Assessment objectives (7)

a.1.
physical access authorizations are enforced at entry and exit points to the facility where the system resides by verifying individual physical access authorizations before granting access.
a.2.
physical access authorizations are enforced at entry and exit points to the facility where the system resides by controlling ingress and egress with physical access control systems, devices, or guards.
b.
physical access audit logs for entry or exit points are maintained.
c.
visitors are escorted.
c.
visitor activity is controlled.
e.
physical access to output devices is controlled to prevent unauthorized individuals from obtaining access to CUI.
d.
keys, combinations, and other physical access devices are secured.

Examine

physical protection policy and procedures
procedures for physical access control
physical access control logs or records
inventory records of physical access control devices
system entry and exit points
records of key and lock combination changes
storage locations for physical access control devices
physical access control devices
list of security safeguards controlling access to designated publicly accessible areas within facility
system security plan
other relevant documents or records

Interview

personnel with physical access control responsibilities
personnel with information security responsibilities

Test

processes for physical access control
mechanisms for supporting or implementing physical access control
physical access control devices

Official source-control relationships

Source NIST SP 800-53 controls

These controls are referenced by the official SP 800-171 Rev. 3 OSCAL record. Open the corresponding control pages for complete control text, enhancements, D3FEND mappings, and related learning.

Source controlPE-3Open SP 800-53 control →Source controlPE-5Open SP 800-53 control →

Source record

Authoritative sources

Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. The official publications, the responsible federal agency, and the governing contract or agreement determine applicability, tailoring, assessment depth, and required implementation.