Requirement
The entity restricts physical access to facilities and protected information assets (for example, data center facilities, backup media storage, and other sensitive locations) to authorized personnel to meet the entity’s objectives.
Points of Focus
Creates or Modifies Physical Access
Requirement: Processes are in place to create or modify physical access by employees, contractors, vendors, and business partner personnel to facilities such as data centers, office spaces, and work areas, based on appropriate authorization.
Removes Physical Access
Requirement: Processes are in place to remove physical access to facilities and protected information assets when an employee, contractor, vendor, or business partner no longer requires access.
Recovers Physical Devices
Requirement: Processes are in place to recover entity devices (for example, badges, laptops, and mobile devices) when an employee, contractor, vendor, or business partner no longer requires access.
Reviews Physical Access
Requirement: Processes are in place to periodically review physical access to help ensure consistency with job responsibilities.
Explanation
Buildings, server rooms, and media storage need the same discipline as user accounts: only authorized people get in, and access ends when it is no longer needed. Auditors look at how badges and keys are issued, revoked, and periodically reviewed, and how devices are recovered from departing staff.
