PE-6 Monitoring Physical Access

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Low, Moderate, High	Organization	4 (2 in a baseline)

Related controls: AU-2, AU-6, AU-9, AU-12, CA-7, CP-10, IR-4, IR-8

Control statement

• a. Monitor physical access to the facility where the system resides to detect and respond to physical security incidents;
• b. Review physical access logs [Assignment: organization-defined frequency] and upon occurrence of [Assignment: organization-defined events] ; and
• c. Coordinate results of reviews and investigations with the organizational incident response capability.

NIST discussion

Physical access monitoring includes publicly accessible areas within organizational facilities. Examples of physical access monitoring include the employment of guards, video surveillance equipment (i.e., cameras), and sensor devices. Reviewing physical access logs can help identify suspicious activity, anomalous events, or potential threats. The reviews can be supported by audit logging controls, such as AU-2 , if the access logs are part of an automated system. Organizational incident response capabilities include investigations of physical security incidents and responses to the incidents. Incidents include security violations or suspicious physical access activities. Suspicious physical access activities include accesses outside of normal work hours, repeated accesses to areas not normally accessed, accesses for unusual lengths of time, and out-of-sequence accesses.

Control enhancements

PE-6(1) Intrusion Alarms and Surveillance Equipment

Baselines: Moderate, High

Monitor physical access to the facility where the system resides using physical intrusion alarms and surveillance equipment.

Discussion and assessment objectives for PE-6(1)

Physical intrusion alarms can be employed to alert security personnel when unauthorized access to the facility is attempted. Alarm systems work in conjunction with physical barriers, physical access control systems, and security guards by triggering a response when these other forms of security have been compromised or breached. Physical intrusion alarms can include different types of sensor devices, such as motion sensors, contact sensors, and broken glass sensors. Surveillance equipment includes video cameras installed at strategic locations throughout the facility.

Determine if:

• PE-06(01)[01] physical access to the facility where the system resides is monitored using physical intrusion alarms;
• PE-06(01)[02] physical access to the facility where the system resides is monitored using physical surveillance equipment.

Examine: Physical and environmental protection policy; procedures addressing physical access monitoring; physical access logs or records; physical access monitoring records; physical access log reviews; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentation; other relevant documents or records.

Interview: Organizational personnel with physical access monitoring responsibilities; organizational personnel with incident response responsibilities; organizational personnel with information security and privacy responsibilities.

Test: Organizational processes for monitoring physical intrusion alarms and surveillance equipment; mechanisms supporting and/or implementing physical access monitoring; mechanisms supporting and/or implementing physical intrusion alarms and surveillance equipment.

PE-6(2) Automated Intrusion Recognition and Responses

Baselines: Not in a baseline

Recognize [Assignment: organization-defined classes or types of intrusions] and initiate [Assignment: organization-defined response actions] using [Assignment: organization-defined automated mechanisms].

Discussion and assessment objectives for PE-6(2)

Response actions can include notifying selected organizational personnel or law enforcement personnel. Automated mechanisms implemented to initiate response actions include system alert notifications, email and text messages, and activating door locking mechanisms. Physical access monitoring can be coordinated with intrusion detection systems and system monitoring capabilities to provide integrated threat coverage for the organization.

Determine if:

• PE-06(02)[01] [Assignment: organization-defined classes or types of intrusions] are recognized;
• PE-06(02)[02] [Assignment: organization-defined response actions] are initiated using [Assignment: organization-defined automated mechanisms].

Examine: Physical and environmental protection policy; procedures addressing physical access monitoring; system design documentation; system configuration settings and associated documentation; system audit records; list of response actions to be initiated when specific classes/types of intrusions are recognized; system security plan; privacy plan; other relevant documents or records.

Interview: Organizational personnel with physical access monitoring responsibilities; organizational personnel with information security and privacy responsibilities.

Test: Organizational processes for monitoring physical access; automated mechanisms supporting and/or implementing physical access monitoring; automated mechanisms supporting and/or implementing recognition of classes/types of intrusions and initiation of a response.

PE-6(3) Video Surveillance

Baselines: Not in a baseline

• (a) Employ video surveillance of [Assignment: organization-defined operational areas];
• (b) Review video recordings [Assignment: organization-defined frequency] ; and
• (c) Retain video recordings for [Assignment: organization-defined time period].

Discussion and assessment objectives for PE-6(3)

Video surveillance focuses on recording activity in specified areas for the purposes of subsequent review, if circumstances so warrant. Video recordings are typically reviewed to detect anomalous events or incidents. Monitoring the surveillance video is not required, although organizations may choose to do so. There may be legal considerations when performing and retaining video surveillance, especially if such surveillance is in a public location.

Determine if:

• PE-06(03)(a) video surveillance of [Assignment: organization-defined operational areas] is employed;
• PE-06(03)(b) video recordings are reviewed [Assignment: organization-defined frequency];
• PE-06(03)(c) video recordings are retained for [Assignment: organization-defined time period].

Examine: Physical and environmental protection policy; procedures addressing physical access monitoring; video surveillance equipment used to monitor operational areas; video recordings of operational areas where video surveillance is employed; video surveillance equipment logs or records; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentation; other relevant documents or records.

Interview: Organizational personnel with physical access monitoring responsibilities; organizational personnel with information security and privacy responsibilities.

Test: Organizational processes for monitoring physical access; mechanisms supporting and/or implementing physical access monitoring; mechanisms supporting and/or implementing video surveillance.

PE-6(4) Monitoring Physical Access to Systems

Baselines: High

Monitor physical access to the system in addition to the physical access monitoring of the facility at [Assignment: organization-defined physical spaces].

Discussion and assessment objectives for PE-6(4)

Monitoring physical access to systems provides additional monitoring for those areas within facilities where there is a concentration of system components, including server rooms, media storage areas, and communications centers. Physical access monitoring can be coordinated with intrusion detection systems and system monitoring capabilities to provide comprehensive and integrated threat coverage for the organization.

Determine if physical access to the system is monitored in addition to the physical access monitoring of the facility at [Assignment: organization-defined physical spaces].

Examine: Physical and environmental protection policy; procedures addressing physical access monitoring; physical access control logs or records; physical access control devices; access authorizations; access credentials; list of areas within the facility containing concentrations of system components or system components requiring additional physical access monitoring; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentation; other relevant documents or records.

Interview: Organizational personnel with physical access monitoring responsibilities; organizational personnel with information security and privacy responsibilities.

Test: Organizational processes for monitoring physical access to the system; mechanisms supporting and/or implementing physical access monitoring for facility areas containing system components.

Assessment objectives (SP 800-53A)

Objectives and methods for PE-6

Determine if:

• PE-06a. physical access to the facility where the system resides is monitored to detect and respond to physical security incidents;
• PE-06b.
  • PE-06b.[01] physical access logs are reviewed [Assignment: organization-defined frequency];
  • PE-06b.[02] physical access logs are reviewed upon occurrence of [Assignment: organization-defined events];
• PE-06c.
  • PE-06c.[01] results of reviews are coordinated with organizational incident response capabilities;
  • PE-06c.[02] results of investigations are coordinated with organizational incident response capabilities.

Examine: Physical and environmental protection policy; procedures addressing physical access monitoring; physical access logs or records; physical access monitoring records; physical access log reviews; system security plan; other relevant documents or records.

Interview: Organizational personnel with physical access monitoring responsibilities; organizational personnel with incident response responsibilities; organizational personnel with information security responsibilities.

Test: Organizational processes for monitoring physical access; mechanisms supporting and/or implementing physical access monitoring; mechanisms supporting and/or implementing the review of physical access logs.

Policy statement

• The Facilities manager shall monitor physical access to the facility where the system resides, including publicly accessible areas, to detect and respond to physical security incidents. (PE-6a)
• The Facilities manager shall review physical access logs Fill in: the frequency at which to review physical access logs Typical: at least monthly and upon occurrence of Fill in: events or potential indication of events requiring physical access logs to be reviewed Typical: a physical security incident or alarm, a lost or stolen badge or key, reported tailgating, access attempts outside normal working hours, and a request from the incident response team, looking for accesses outside normal working hours, repeated accesses to areas not normally accessed, accesses of unusual length and out-of-sequence accesses. (PE-6b)
• Each review shall be recorded with its date, the reviewer, the period covered and the anomalies found. (PE-6b)
• The Facilities manager shall coordinate the results of reviews and investigations with the Incident response team, and report suspected physical security incidents under the incident response plan (IR-6). (PE-6c)

PE-6(1) Intrusion alarms and surveillance equipment

• The Facilities manager shall monitor physical access to the facility where the system resides using physical intrusion alarms and surveillance equipment. (PE-6(1))
• Intrusion alarms shall cover the facility’s entry points and each area that contains system components when it is unoccupied, and shall alert guards, a monitoring service or designated staff who respond. (PE-6(1))
• Surveillance cameras shall cover the entry points to the facility and to each area that contains system components, and recordings shall be kept for the period the records schedule sets, with access limited to authorized staff. (PE-6(1))
• The Facilities manager shall test the alarms and check the cameras at least annually, and repair faults promptly. (PE-6(1))

PE-6(4) Monitoring physical access to systems

• The Facilities manager shall monitor physical access to the system, in addition to the physical access monitoring of the facility, at Fill in: physical spaces containing one or more components of the system Typical: data centers, server rooms, wiring closets and media storage areas that contain components of the system. (PE-6(4))
• Physical access events for those spaces shall be sent to the Security operations team and correlated with system monitoring. (PE-6(4))

From the Physical and Environmental Protection Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

PE-6 asks you to watch physical access, not just control it: monitor the facility to detect and respond to physical security incidents (a), review the physical access logs on a schedule and when something happens (b), and coordinate the results with the incident response capability (c). NIST’s PE-6 discussion says monitoring includes publicly accessible areas, and gives guards, video surveillance and sensors as examples. It lists suspicious physical access activity: accesses outside normal work hours, repeated accesses to areas not normally accessed, accesses for unusual lengths of time, and out-of-sequence accesses. Where the access logs are part of an automated system, audit logging controls such as AU-2 support the reviews.

Common implementations. Guards or reception staff watch the entrances and camera feeds during business hours, and an alarm monitoring service covers the rest. The physical access control system’s reports flag after-hours entries, denied attempts, doors forced or held open, and badges used at doors their holders rarely use; the facilities manager reviews them each month and records the review. Many organizations also send the access control system’s events to the security operations team’s log platform, where they can be correlated with logons and VPN sessions (AU-6). A suspected physical security incident, such as a forced door, a stolen laptop or an unknown person in a server room, is reported and handled under the incident response plan (IR-6).

Organization-defined parameters. Typical values, from the Physical and Environmental Protection policy, which your organization may set differently:

Parameter	Typical value
Log review frequency (b)	At least monthly
Events that trigger a log review (b)	A physical security incident or alarm, a lost or stolen badge or key, reported tailgating, access attempts outside normal working hours, and a request from the incident response team

The policy has each review look for the four kinds of suspicious activity in NIST’s discussion and be recorded with its date, the reviewer, the period covered and the anomalies found, and has the facilities manager coordinate results with the incident response team.

Evidence assessors ask for.

• How the facility is monitored: guard posts and hours, cameras, alarms and who receives them
• The records of the last few log reviews, with the anomalies found and what was done
• A sample of event-driven reviews, such as the review after a lost badge was reported
• Incident reports for physical security events, and how they reached the incident response team
• For PE-6(1), the alarm and camera coverage, the monitoring arrangement and the last test

Inheritance. For a system hosted in a cloud service or colocation data center, the provider monitors its facility, and the system security plan records PE-6 and PE-6(1) as inherited for it. The organization still monitors its own offices and equipment rooms, usually as a common control run by the facilities manager, and the coordination with incident response (c) often stays with the organization even where the provider monitors.

Common findings.

• Access logs collected but never reviewed, or reviews with no record.
• Reviews that look only at denied attempts and miss after-hours entries by authorized badges.
• Physical security incidents handled by facilities or building management and never reported to the incident response team.
• Cameras that do not record, point at the wrong door, or overwrite their footage before anyone could review it.
• Alarms that go to a mailbox or panel no one watches after hours.

Enhancements in the Moderate baseline. PE-6(1) intrusion alarms and surveillance equipment. High adds PE-6(4) monitoring physical access to systems. PE-6(2) automated intrusion recognition and responses and PE-6(3) video surveillance are in no baseline.

• PE-6(1) monitors physical access using intrusion alarms and surveillance equipment. It has no parameters. NIST’s discussion says intrusion alarms alert security personnel when unauthorized access is attempted, working with barriers, access control systems and guards by triggering a response when they are breached; sensors include motion, contact and glass-break sensors, and surveillance equipment includes cameras at strategic locations. The policy has alarms cover the facility’s entry points and each area that contains system components when it is unoccupied, alerting guards, a monitoring service or designated staff who respond; cameras cover the entry points to the facility and to those areas, with recordings kept for the period the records schedule sets and access limited to authorized staff; and the alarms and cameras tested at least annually. Recordings show identifiable people, so treat them as personally identifiable information.
• PE-6(4) (High) adds monitoring of physical access to the system itself, in addition to the facility, at the spaces you name. NIST’s discussion says it adds monitoring where system components are concentrated, such as server rooms, media storage areas and communications centers, and that it can be coordinated with intrusion detection and system monitoring. Typical value: data centers, server rooms, wiring closets and media storage areas that contain components of the system, the same spaces as PE-3(1). The policy sends physical access events for those spaces to the security operations team for correlation with system monitoring.

Artifacts

• Physical and Environmental Protection Decision Worksheet
• Physical and Environmental Protection Policy