PE-3—Physical Access Control

Enforce physical access authorizations at ⚙organization-defined entry and exit points to the facility where the system resides by:

Maintain physical access audit logs for ⚙organization-defined entry or exit points;

Control access to areas within the facility designated as publicly accessible by implementing the following controls: ⚙organization-defined physical access controls;

Escort visitors and control visitor activity ⚙organization-defined circumstances requiring visitor escorts and control of visitor activity;

Secure keys, combinations, and other physical access devices;

Inventory ⚙organization-defined physical access devices every ⚙organization-defined frequency; and

Change combinations and keys ⚙organization-defined frequency and/or when keys are lost, combinations are compromised, or when individuals possessing the keys or combinations are transferred or terminated.