Insights · Field note · Infrastructure and resilience
Physical access control as part of the control set
Every logical control assumes the attacker cannot simply walk to the server. Physical access is assessed, evidenced and reviewed like any other control.
Physical access control governs who can reach equipment, media and the spaces that hold them: facility and room access, visitor handling, escort rules, access records, review of who holds credentials, and the disposal of media and hardware. It is part of the security control set because every framework includes it and every logical control depends on it. The common failures are the same as in identity: credentials never revoked, shared badges, visitors unescorted, logs never reviewed, and contractors with standing access nobody owns. The review treats physical access with the same discipline as privileged access, because it is privileged access.
In detail
What the evidence shows.
Who can get in
An inventory of everyone with physical credentials to secure areas: staff, contractors, vendors, facility operators, cleaners. Each with an owner and a reason. Reviewed on a schedule with removals recorded. Credentials for leavers revoked the same day. Shared credentials eliminated.
How entry is recorded
Access control logs retained, protected and reviewed for anomalies: entry at unusual hours, repeated denials, credentials used at two sites at once. Visitor logs with identity, host, time in and out, and escort. Camera coverage of entry points with retention defined.
Media and hardware
Drives, tapes and devices leaving the facility are tracked, sanitized or destroyed with certificates. Hardware swaps under remote hands return the old component to a governed disposal process, not to a technician’s van. NIST SP 800-171 and SP 800-53 both require media protection and sanitization.
Evidence
Credential inventory and reviews, access logs and their review records, visitor logs, disposal certificates. These are what SOC 2, ISO/IEC 27001 and CMMC assessors sample for physical protection. See secure maintenance workflows, remote hands and smart hands and privileged access management.
Sources
Primary references.
- NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations (physical and environmental protection and configuration management families)
- NIST SP 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (physical protection and configuration management requirements)
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days