NIST 800-171 - Physical Access Logs (3.10.4)

Overview:

Maintain audit logs of physical access.

Action Items:

3.10.4[a]
Determine if: audit logs of physical access are maintained.

POTENTIAL ASSESSMENT METHODS AND OBJECTS

1
Examine: Physical and environmental protection policy; procedures addressing physical access control; system security plan; physical access control logs or records; inventory records of physical access control devices; system entry and exit points; records of key and lock combination changes; storage locations for physical access control devices; physical access control devices; list of security safeguards controlling access to designated publicly accessible areas within facility; other relevant documents or records].

2
Interview: Personnel with physical access control responsibilities; personnel with information security responsibilities].

3
Test: Organizational processes for physical access control; mechanisms supporting or implementing physical access control; physical access control devices].

Related Documents (document name and content will vary by organization):

1) Physical and environmental protection policy
2) procedures addressing physical access control
3) system security plan
4) physical access control logs or records
5) inventory records of physical access control devices
6) system entry and exit points
7) records of key and lock combination changes
8) storage locations for physical access control devices
9) physical access control devices
10) list of security safeguards controlling access to designated publicly accessible areas within facility
11) other relevant documents or records

Additional Guidance:

Organizations have flexibility in the types of audit logs employed. Audit logs can be procedural (e.g., a written log of individuals accessing the facility and when such access occurred), automated (e.g., capturing ID provided by a PIV card), or some combination thereof. Physical access points can include facility access points, interior access points to systems or system components requiring supplemental access controls, or both. Components of systems (e.g., workstations, notebook computers, terminals) may be located in areas designated as publicly accessible with organizations safeguarding access to such devices.