Physical Access List template: The list of individuals authorized to enter a facility and each controlled area within it, with the credential issued, the approval, each review and each removal, plus the facility's areas and its inventory of keys, combinations and badges, as SP 800-53 PE-2 and PE-3 require.
The list of individuals authorized to enter a facility and each controlled area within it, with the credential issued, the approval, each review and each removal, plus the facility’s areas and its inventory of keys, combinations and badges, as SP 800-53 PE-2 and PE-3 require.
Add a person only on a request from their supervisor, approved by the Facilities manager and, for areas that contain system components, also by the System owner (PE-2a).
Issue a credential, such as a badge or access card, and record it against the person’s entry (PE-2b).
Grant only the areas the person’s duties require; areas that contain system components are authorized separately from the building (PE-3(1)).
Review the list Fill in: frequency at which to review the access list detailing authorized facility access by individuals Typical: at least quarterly for areas that contain system components, such as data centers, server rooms, wiring closets and media storage areas, and at least annually for the rest of the facility, with each supervisor or area owner confirming that their people still need the access, and record the review in section 4 (PE-2c).
When a person leaves, disable the credential within the time the Personnel Security Policy sets for disabling system access, record the date the credential was returned, and remove the person from the list (PE-2d, PS-4). The onboarding, transfer and termination checklist starts each change.
When a person transfers, remove the areas the new position does not need (PE-2d, PS-5).
Keep removed entries, marked as removed, for Fill in: retention period from the organization’s records retention schedule.
Field
What to record
Person
Name, and employer for a contractor
Role or position
Job title or role that needs the access
Areas authorized
The facility, and each controlled area within it, from section 2
Credential
Badge or card number, or key number; the type (permanent, temporary)
Requested by
The supervisor who requested the access, and the date
Approved by
The facilities manager, and the system owner for areas that contain system components, with dates (PE-2a)
Issued
The date the credential was issued (PE-2b)
Expires
The end date for a temporary authorization or a contract
Last confirmed
The date of the last review that confirmed the access (PE-2c)
Removed
The date access was removed, the reason (termination, transfer, no longer needed), and the date the credential was returned or disabled (PE-2d)
List each area that has its own access control. Areas designated as publicly accessible need no authorization, but record the controls between them and the non-public areas (PE-3c).
Area
Type (public, general, restricted)
Contains system components
Entry control (badge reader, key, combination, guard)
Inventory Fill in: physical access devices to be inventoried Typical: keys, lock combinations, and badges and access cards, including unissued, temporary and visitor badgesFill in: frequency at which to inventory physical access devices Typical: at least annually (PE-3f). Keep unissued devices locked away, and limit knowledge of each combination to the people authorized to use it (PE-3e). Change combinations Fill in: frequency at which to change combinations Typical: at least annually and keys Fill in: frequency at which to change keys Typical: at least every five years, and sooner when an inventory cannot account for an issued key, and change both when a key is lost, a combination is compromised, or someone holding it is transferred or terminated (PE-3g).
FIPS 201-3 (January 2022), section 6.3.1, states that the selection of PIV authentication assurance levels for physical access “SHALL be made in accordance with the applicable policies for a facility’s security level”, and NIST SP 800-116 Rev. 1 (June 2018), section 4.3 and Table 4-3, recommends at least one authentication factor for Controlled areas, two for Limited areas and three for Exclusion areas. FIPS 201-3 section 2.9.4 requires a PIV Card to be terminated when a federal employee separates from federal service or a contractor no longer needs access to federal buildings or systems. As of October 2026.
In section 2, the “Type” column shall record each area of a federally controlled facility as Controlled, Limited or Exclusion, with the number of authentication factors its entry control requires, consistent with the facility’s Facility Security Level determination. (PE-3a)
For each person who holds a PIV Card, the “Credential” field shall identify the PIV Card registered in the physical access control system, and the “Removed” field shall record when that registration was removed after the card was terminated. (PE-2d)
Fill in: date, reason and credential returned or disabled, or blank
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.