|

controlPE-3

Physical Access Control (PE-3)

Enforce physical access authorizations at [organization-defined] by: Maintain physical access audit logs for [organization-defined]; Control access to areas within the facility designated as publicly accessible by implementing the following controls: [organization-defined]; Escort visitors and control visitor activity [organization-defined]; Secure keys, combinations, and other physical access devices; Inventory [organization-defined] every [organization-defined] ; and Change combinations and ke

Security Baselines

LOWMODERATEHIGH

physical-securityenvironmentalfacilities

Why These Connect

Maps To6

These are equivalent or closely aligned requirements in other frameworks.

Baselined In3

This control is included in the linked security baseline (LOW, MODERATE, or HIGH).

Supports51

These related controls work together — a change to one may affect the others.

Enhances8

These enhancements add specific capabilities or refinements to the base control.

Related Controls(33)

AU-2Event Logging (AU-2)

AU-6Audit Record Review, Analysis, and Reporting (AU-6)

AU-9Protection of Audit Information (AU-9)

AU-13Monitoring for Information Disclosure (AU-13)CA-7Continuous Monitoring (CA-7)

CM-5Access Restrictions for Change (CM-5)

CP-6Alternate Storage Site (CP-6)

CP-7Alternate Processing Site (CP-7)

IA-4Identifier Management (IA-4)

MA-5Maintenance Personnel (MA-5)

MP-2Media Access (MP-2)

MP-4Media Storage (MP-4)

PE-2Physical Access Authorizations (PE-2)

AT-3Role-based Training (AT-3)

CP-10System Recovery and Reconstitution (CP-10)

IA-3Device Identification and Authentication (IA-3)

IA-8Identification and Authentication (Non-organizational Users) (IA-8)

PE-4Access Control for Transmission (PE-4)

PE-5Access Control for Output Devices (PE-5)

PE-8Visitor Access Records (PE-8)

PS-2Position Risk Designation (PS-2)

PS-3Personnel Screening (PS-3)

PS-6Access Agreements (PS-6)

PS-7External Personnel Security (PS-7)

RA-3Risk Assessment (RA-3)

SC-28Protection of Information at Rest (SC-28)

SI-4System Monitoring (SI-4)

SR-3Supply Chain Controls and Processes (SR-3)

PM-31Continuous Monitoring Strategy (PM-31)SA-16Developer-provided Training (SA-16)

SC-7Boundary Protection (SC-7)

SR-9Tamper Resistance and Detection (SR-9)

SR-11Component Authenticity (SR-11)

Cross-Framework Mappings(6)

PR.AA-06PR.AA-06Final

NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5

DE.CM-02DE.CM-02Final

NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5

ISO 27001ISO/IEC 27001:20224 mappingsFinal

NIST OLIR informative reference — SP 800-53 Rev 5 to ISO/IEC 27001:2022

HIPAAHIPAA Security Rule5 mappingsFinal

NIST OLIR informative reference — HIPAA Security Rule to SP 800-53 Rev 5

PR.AA-06PR.AA-06Final

NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5

DE.CM-02DE.CM-02Final

NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5

Organization-Defined Parameters(10)

Assignmentorganization-defined entry and exit points

SelectionSelection (one-or-more): {{ insert: param, pe-03_odp.03 }} / guards

Assignmentorganization-defined systems or devices

Assignmentorganization-defined entry or exit points

Assignmentorganization-defined physical access controls

Assignmentorganization-defined circumstances

Assignmentorganization-defined physical access devices

Assignmentorganization-defined frequency

Assignmentorganization-defined frequency

Assignmentorganization-defined frequency

Control Enhancements(8)

PE-3(1)System Access (PE-3(1))

PE-3(2)Facility and Systems (PE-3(2))

PE-3(3)Continuous Guards (PE-3(3))

PE-3(4)Lockable Casings (PE-3(4))

PE-3(5)Tamper Protection (PE-3(5))

PE-3(6)Facility Penetration Testing (PE-3(6))W

PE-3(7)Physical Barriers (PE-3(7))

PE-3(8)Access Control Vestibules (PE-3(8))

See Also

@SP 800-53 Overview ⚖Compare Baselines