[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fpe-2":3},{"item":4,"lessons":18,"controls":40,"related":65},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","pe-2","PE-2","Physical Access Authorizations",5,"US National Institute of Standards and Technology (NIST)","**What it asks for.** The organisation must maintain an approved list of individuals with authorised access to facilities where systems reside, issue authorisation credentials, review the access list at a defined frequency and remove people when access is no longer needed.\n\n**In practice.** Doing this well means a request and approval process for building and secure area access, linked to HR so access changes when roles change, with periodic reviews of who can enter sensitive areas such as data centres. Auditors look for access lists, approval records and review sign-offs. Credentials such as badges should be recorded and recovered when access ends.\n\n**Common gaps.** Physical access lists are often reviewed far less rigorously than logical access. Contractors and cleaning staff frequently hold broader access than necessary. Lost badges are not always reported and disabled.","a. Develop, approve, and maintain a list of individuals with authorized access to the facility where the system resides;\n  b. Issue authorization credentials for facility access;\n  c. Review the access list detailing authorized facility access by individuals [Assignment: organization-defined frequency] ; and\n  d. Remove individuals from the facility access list when access is no longer required.\nDiscussion: Physical access authorizations apply to employees and visitors. Individuals with permanent physical access authorization credentials are not considered visitors. Authorization credentials include ID badges, identification cards, and smart cards. Organizations determine the strength of authorization credentials needed consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Physical access authorizations may not be necessary to access certain areas within facilities that are designated as publicly accessible.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36],{"slug":21,"title":22,"published_at":23},"multi-vector-social-engineering-attacks-target-law-firms","Multi-Vector Social Engineering Attacks Target Law Firms","2026-06-08T22:20:48.064+00:00",{"slug":25,"title":26,"published_at":27},"social-engineering-and-physical-security-failures-enable-data-theft-campaign","Social Engineering and Physical Security Failures Enable Data Theft Campaign","2026-06-08T10:20:30.465+00:00",{"slug":29,"title":30,"published_at":31},"law-firms-targeted-by-hybrid-social-engineering-and-physical-access-attacks","Law Firms Targeted by Hybrid Social Engineering and Physical Access Attacks","2026-05-27T22:20:17.757+00:00",{"slug":33,"title":34,"published_at":35},"silent-ransom-group-uses-social-engineering-and-physical-access-for-data-theft","Silent Ransom Group Uses Social Engineering and Physical Access for Data Theft","2026-05-27T13:20:17.122+00:00",{"slug":37,"title":38,"published_at":39},"multi-vector-attacks-combine-social-engineering-with-physical-infiltration","Multi-Vector Attacks Combine Social Engineering with Physical Infiltration","2026-05-27T10:20:24.297+00:00",[41,45,50,55,60],{"slug":42,"name":43,"problem":44,"stories":9},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",{"slug":46,"name":47,"problem":48,"stories":49},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",4,{"slug":51,"name":52,"problem":53,"stories":54},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",3,{"slug":56,"name":57,"problem":58,"stories":59},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",2,{"slug":61,"name":62,"problem":63,"stories":64},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",1,[66,70,74,79,83,87,91,95],{"family":5,"item":67,"code":68,"title":69,"together":49},"ac-2","AC-2","Account Management",{"family":5,"item":71,"code":72,"title":73,"together":49},"at-2","AT-2","Literacy Training and Awareness",{"family":75,"item":76,"code":77,"title":78,"together":54},"cis","14","Control 14","Security Awareness and Skills Training",{"family":5,"item":80,"code":81,"title":82,"together":59},"ac-3","AC-3","Access Enforcement",{"family":5,"item":84,"code":85,"title":86,"together":59},"pe-3","PE-3","Physical Access Control",{"family":75,"item":88,"code":89,"title":90,"together":59},"6","Control 6","Access Control Management",{"family":5,"item":92,"code":93,"title":94,"together":64},"si-4","SI-4","System Monitoring",{"family":75,"item":96,"code":97,"title":69,"together":64},"5","Control 5"]