THREATNOIR
Subscribe
NIST SP 800-53 Rev. 5 · PE-2

Physical Access Authorizations

US National Institute of Standards and Technology (NIST) · cited in 5 of our lessons

Explanation

What it asks for. The organisation must maintain an approved list of individuals with authorised access to facilities where systems reside, issue authorisation credentials, review the access list at a defined frequency and remove people when access is no longer needed.

In practice. Doing this well means a request and approval process for building and secure area access, linked to HR so access changes when roles change, with periodic reviews of who can enter sensitive areas such as data centres. Auditors look for access lists, approval records and review sign-offs. Credentials such as badges should be recorded and recovered when access ends.

Common gaps. Physical access lists are often reviewed far less rigorously than logical access. Contractors and cleaning staff frequently hold broader access than necessary. Lost badges are not always reported and disabled.

Open SP 800-53 at NIST
The official text
a. Develop, approve, and maintain a list of individuals with authorized access to the facility where the system resides; b. Issue authorization credentials for facility access; c. Review the access list detailing authorized facility access by individuals [Assignment: organization-defined frequency] ; and d. Remove individuals from the facility access list when access is no longer required. Discussion: Physical access authorizations apply to employees and visitors. Individuals with permanent physical access authorization credentials are not considered visitors. Authorization credentials include ID badges, identification cards, and smart cards. Organizations determine the strength of authorization credentials needed consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Physical access authorizations may not be necessary to access certain areas within facilities that are designated as publicly accessible.

From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.

Lessons that cite it

Real incidents where this item mattered.