Draft v0.1.06 of 6 frameworks
Physical access and facility security
Physical entry to facilities and sensitive areas is restricted, authorized, logged and monitored.
Where it appears
- SOC 2
CC6.4Restricts physical access to facilities and protected information assets- PCI DSS 4.0
9.2Physical access controls manage entry into facilities and systems containing cardholder data9.3Physical access for personnel and visitors is authorized and managed- NIST CSF 2.0
PR.AA-06Physical access to assets is managed, monitored and enforced commensurate with risk- ISO 27001:2022
A.7.1Physical security perimetersA.7.2Physical entryA.7.4Physical security monitoring- HIPAA Security Rule
164.310(a)Facility access controls- NIST 800-53 r5
PE-2Physical access authorizationsPE-3Physical access controlPE-6Monitoring physical access
Evidence auditors usually ask for
A typical starting list. Your assessor's request list is the one that counts.
- Physical security policy
- Badge access lists for sensitive areas with periodic review
- Visitor logs and escort procedures
- Video surveillance coverage and retention evidence (PCI: at least 3 months)
- For cloud-hosted: inherited-control evidence from the provider's SOC report or AOC
Crosswalks that include this
SOC 2 to PCI DSS 4.0SOC 2 to NIST CSF 2.0SOC 2 to ISO 27001:2022SOC 2 to HIPAA Security RuleSOC 2 to NIST 800-53 r5PCI DSS 4.0 to SOC 2PCI DSS 4.0 to NIST CSF 2.0PCI DSS 4.0 to ISO 27001:2022PCI DSS 4.0 to HIPAA Security RulePCI DSS 4.0 to NIST 800-53 r5NIST CSF 2.0 to SOC 2NIST CSF 2.0 to PCI DSS 4.0