---

id: "PE-06" title: "Monitoring Physical Access" family: "PE" family_name: "Physical and Environmental Protection" sort_id: "pe-06" priority: "P2" implementation_level: "organization" enhancements: - pe-6.1 - pe-6.2 - pe-6.3 - pe-6.4

---

Monitor physical access to the facility where the system resides to detect and respond to physical security incidents;

Review physical access logs {{ insert: param, pe-06_odp.01 }} and upon occurrence of {{ insert: param, pe-06_odp.02 }} ; and

Coordinate results of reviews and investigations with the organizational incident response capability.

Guidance

Physical access monitoring includes publicly accessible areas within organizational facilities. Examples of physical access monitoring include the employment of guards, video surveillance equipment (i.e., cameras), and sensor devices. Reviewing physical access logs can help identify suspicious activity, anomalous events, or potential threats. The reviews can be supported by audit logging controls, such as AU-2 , if the access logs are part of an automated system. Organizational incident response capabilities include investigations of physical security incidents and responses to the incidents. Incidents include security violations or suspicious physical access activities. Suspicious physical access activities include accesses outside of normal work hours, repeated accesses to areas not normally accessed, accesses for unusual lengths of time, and out-of-sequence accesses.

Assessment Objective: physical access to the facility where the system resides is monitored to detect and respond to physical security incidents;

Assessment Objective: physical access logs are reviewed {{ insert: param, pe-06_odp.01 }};

Assessment Objective: physical access logs are reviewed upon occurrence of {{ insert: param, pe-06_odp.02 }};

Assessment Objective: results of reviews are coordinated with organizational incident response capabilities;

Assessment Objective: results of investigations are coordinated with organizational incident response capabilities.

Physical and environmental protection policy

procedures addressing physical access monitoring

physical access logs or records

physical access monitoring records

physical access log reviews

system security plan

other relevant documents or records

Organizational personnel with physical access monitoring responsibilities

organizational personnel with incident response responsibilities

organizational personnel with information security responsibilities

Organizational processes for monitoring physical access

mechanisms supporting and/or implementing physical access monitoring

mechanisms supporting and/or implementing the review of physical access logs