// REQUIREMENTS Identifier Requirement Level 1 03.10.01 Physical access authorizations Level 1 03.10.02 Monitoring physical access 03.10.06 Alternate work site 03.10.07 Physical access control Level 1 03.10.08 Access control for transmission
// INTENT The hardware holding protected data sits behind physical access control with a short key list.
// WHAT A FIRST ASSESSMENT FINDS The server closet is also the janitor's closet.
// THE WORK A lock with a short key list, a visitor log and escort rule, cameras on entries and main routes, and held-open alarms on the enclave door.
// HOW WE CAN INTERPRET IT Keys work, but I recommend access control because it produces a record. Card or biometric over a PIN, since a PIN can be known and a finger is harder to borrow. The simplest things make an auditor happy: employee ID on a navy lanyard, screened contractors on yellow, visitors on red, and a card design that shows division at a glance. Held-open alarms on the enclave door, which is a checkbox on most controllers. Cameras on the main routes, and know the difference between a camera that shows someone is there and one that identifies a face, which is why thermal doesn't identify and bispectral can. Anti-passback and tailgating controls scale with the risk, from a sign to a turnstile to a two-door vestibule. For credentials, I'd set the floor at 13.56 MHz Seos or iCLASS SE with custom keys (HID's Elite program or equivalent), not the standard keyset, in a corporate format such as HID Corporate 1000 or 2000. HID's February 2024 advisories (CVE-2024-23806) showed keys could be pulled from iCLASS SE configuration cards and encoders, so readers should be on current firmware with configuration-card changes locked out, legacy and 125 kHz technologies disabled at the reader to stop downgrade attacks, and OSDP Secure Channel between reader and controller. Card plus PIN on the doors that matter. Match all of it to what you make. A washer supplier on a defense program is a defense contractor, and doesn't need a scramble pad.
// TEMPLATES FOR THIS FAMILY Also on GitHub: controls/10-physical-protection.md , with the evidence to keep and the values you set.
Previous family Personnel securityNext family Risk assessment