What it asks for. This control expects secure areas to be protected by appropriate entry controls and access points. The aim is to make sure only authorised people get physical access to the organisation's information and associated assets. It covers both permanent staff and visitors, as well as deliveries.
In practice. Good practice means controlling who can enter secure areas through badges, locks or reception, logging entries, escorting visitors and reviewing access rights regularly. Delivery and loading areas are separated from sensitive areas. Auditors look for access lists, entry logs, visitor procedures and evidence that rights are removed when people leave.
Common gaps. Common gaps are tailgating, access cards not revoked for leavers and contractors with long-term unescorted access. Visitor logs are often incomplete and nobody reviews who holds access to the most sensitive areas. Codes for keypads are also rarely changed.