Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

pe-3(3)

physical access control  | continuous guards / alarms / monitoring

assessment objective:

Determine if the organization employs one or more of the following to monitor every physical access point to the facility where the information system resides 24 hours per day, 7 days per week:

pe-3(3)[1]

guards; and/or

pe-3(3)[2]

alarms.

potential assessment methods and objects:

Examine: [select from: Physical and environmental protection policy; procedures addressing physical access control; physical access control logs or records; physical access control devices; facility surveillance records; facility layout documentation; information system entry and exit points; other relevant documents or records].

Interview: [select from: Organizational personnel with physical access control responsibilities; organizational personnel with information security responsibilities].

Test: [select from: Organizational processes for physical access control to the facility where the information system resides; automated mechanisms supporting and/or implementing physical access control for the facility where the information system resides].