---

id: "PE-02" title: "Physical Access Authorizations" family: "PE" family_name: "Physical and Environmental Protection" sort_id: "pe-02" priority: "P2" implementation_level: "organization" enhancements: - pe-2.1 - pe-2.2 - pe-2.3

---

Develop, approve, and maintain a list of individuals with authorized access to the facility where the system resides;

Issue authorization credentials for facility access;

Review the access list detailing authorized facility access by individuals {{ insert: param, pe-02_odp }} ; and

Remove individuals from the facility access list when access is no longer required.

Guidance

Physical access authorizations apply to employees and visitors. Individuals with permanent physical access authorization credentials are not considered visitors. Authorization credentials include ID badges, identification cards, and smart cards. Organizations determine the strength of authorization credentials needed consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Physical access authorizations may not be necessary to access certain areas within facilities that are designated as publicly accessible.

Assessment Objective: a list of individuals with authorized access to the facility where the system resides has been developed;

Assessment Objective: the list of individuals with authorized access to the facility where the system resides has been approved;

Assessment Objective: the list of individuals with authorized access to the facility where the system resides has been maintained;

Assessment Objective: authorization credentials are issued for facility access;

Assessment Objective: the access list detailing authorized facility access by individuals is reviewed {{ insert: param, pe-02_odp }};

Assessment Objective: individuals are removed from the facility access list when access is no longer required.

Physical and environmental protection policy

procedures addressing physical access authorizations

authorized personnel access list

authorization credentials

physical access list reviews

physical access termination records and associated documentation

system security plan

other relevant documents or records

Organizational personnel with physical access authorization responsibilities

organizational personnel with physical access to system facility

organizational personnel with information security responsibilities

Organizational processes for physical access authorizations

mechanisms supporting and/or implementing physical access authorizations