SO-04—Provisioning Physical Access

1. Inspect the physical security system workflow to determine whether requests for physical access required management approval and required documented specification of: •Account type (e.g., visitor, vendor, or regular). •Access privileges granted. •Intended business purpose. •Visitor identification method, if applicable. •Temporary badge issued, if applicable. •Access start date. •Access duration. 2. Inspect physical access request documentation for a sample of new physical access requests to the Organization-owned data center and data rooms to determine whether access is approved.