# Physical Access List

**Template version:** 1.0.0 · **Edition:** Ready to adopt · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/forms/physical-access-list/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

| Facility | Address or site identifier | Systems with components here | List owner | Last reviewed |
| --- | --- | --- | --- | --- |
| [Fill in: facility name] | [Fill in: address or identifier] | [Fill in: system names] | [Facilities manager] | [Fill in: date] |

## 1. How to use this list

- Add a person only on a request from their supervisor, approved by the [Facilities manager] and, for areas that contain system components, also by the [System owner] (PE-2a).
- Issue a credential, such as a badge or access card, and record it against the person's entry (PE-2b).
- Grant only the areas the person's duties require; areas that contain system components are authorized separately from the building (PE-3(1)).
- Review the list [Fill in: frequency at which to review the access list detailing authorized facility access by individuals. Typical: at least quarterly for areas that contain system components, such as data centers, server rooms, wiring closets and media storage areas, and at least annually for the rest of the facility], with each supervisor or area owner confirming that their people still need the access, and record the review in section 4 (PE-2c).
- When a person leaves, disable the credential within the time the Personnel Security Policy sets for disabling system access, record the date the credential was returned, and remove the person from the list (PE-2d, PS-4). The [onboarding, transfer and termination checklist](https://kston83.github.io/nist-guide/templates/forms/onboarding-transfer-and-termination-checklist/) starts each change.
- When a person transfers, remove the areas the new position does not need (PE-2d, PS-5).
- Keep removed entries, marked as removed, for [Fill in: retention period from the organization's records retention schedule].

| Field | What to record |
| --- | --- |
| Person | Name, and employer for a contractor |
| Role or position | Job title or role that needs the access |
| Areas authorized | The facility, and each controlled area within it, from section 2 |
| Credential | Badge or card number, or key number; the type (permanent, temporary) |
| Requested by | The supervisor who requested the access, and the date |
| Approved by | The facilities manager, and the system owner for areas that contain system components, with dates (PE-2a) |
| Issued | The date the credential was issued (PE-2b) |
| Expires | The end date for a temporary authorization or a contract |
| Last confirmed | The date of the last review that confirmed the access (PE-2c) |
| Removed | The date access was removed, the reason (termination, transfer, no longer needed), and the date the credential was returned or disabled (PE-2d) |

## 2. Areas

List each area that has its own access control. Areas designated as publicly accessible need no authorization, but record the controls between them and the non-public areas (PE-3c).

| Area | Type (public, general, restricted) | Contains system components | Entry control (badge reader, key, combination, guard) | Access logged | Area owner who confirms access |
| --- | --- | --- | --- | --- | --- |
| [Fill in: area, for example the server room] | [Fill in: type] | [Fill in: yes or no, and which systems] | [Fill in: control] | [Fill in: yes or no] | [Fill in: name and title] |

## 3. Physical access devices

Inventory [Fill in: physical access devices to be inventoried. Typical: keys, lock combinations, and badges and access cards, including unissued, temporary and visitor badges] [Fill in: frequency at which to inventory physical access devices. Typical: at least annually] (PE-3f). Keep unissued devices locked away, and limit knowledge of each combination to the people authorized to use it (PE-3e). Change combinations [Fill in: frequency at which to change combinations. Typical: at least annually] and keys [Fill in: frequency at which to change keys. Typical: at least every five years, and sooner when an inventory cannot account for an issued key], and change both when a key is lost, a combination is compromised, or someone holding it is transferred or terminated (PE-3g).

| Device | Identifier | Opens | Held by, or stored at | Issued | Last inventoried | Last changed (combination or key) | Notes |
| --- | --- | --- | --- | --- | --- | --- | --- |
| [Fill in: key, combination or badge stock] | [Fill in: number] | [Fill in: area or lock] | [Fill in: person or location] | [Fill in: date] | [Fill in: date] | [Fill in: date and reason] | [Fill in: lost, returned, or none] |

### Federal systems

[FIPS 201-3](https://csrc.nist.gov/pubs/fips/201-3/final) (January 2022), section 6.3.1, states that the selection of PIV authentication assurance levels for physical access "SHALL be made in accordance with the applicable policies for a facility's security level", and [NIST SP 800-116 Rev. 1](https://csrc.nist.gov/pubs/sp/800/116/r1/final) (June 2018), section 4.3 and Table 4-3, recommends at least one authentication factor for Controlled areas, two for Limited areas and three for Exclusion areas. FIPS 201-3 section 2.9.4 requires a PIV Card to be terminated when a federal employee separates from federal service or a contractor no longer needs access to federal buildings or systems. As of October 2026.

- In section 2, the "Type" column shall record each area of a federally controlled facility as Controlled, Limited or Exclusion, with the number of authentication factors its entry control requires, consistent with the facility's Facility Security Level determination. (PE-3a)
- For each person who holds a PIV Card, the "Credential" field shall identify the PIV Card registered in the physical access control system, and the "Removed" field shall record when that registration was removed after the card was terminated. (PE-2d)

## 4. Reviews

| Review date | Reviewed by | Areas covered | Entries confirmed | Entries removed or changed | Devices not accounted for, and action | Next review |
| --- | --- | --- | --- | --- | --- | --- |
| [Fill in: date] | [Fill in: name and title] | [Fill in: areas] | [Fill in: number] | [Fill in: number, with reasons] | [Fill in: items, or "none"] | [Fill in: date] |

## Register

| Person | Role or position | Areas authorized | Credential | Requested by | Approved by | Issued | Expires | Last confirmed | Removed |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| [Fill in: name and employer] | [Fill in: role] | [Fill in: facility and areas] | [Fill in: badge, card or key number, and type] | [Fill in: supervisor and date] | [Fill in: names and dates] | [Fill in: date] | [Fill in: date, or none] | [Fill in: date] | [Fill in: date, reason and credential returned or disabled, or blank] |