Physical access to facilities and systems is restricted
Logical access controls protect systems from remote compromise, but physical access bypasses all of them. Anyone who can walk up to a server, plug in a USB drive, or physically remove hardware has access that no firewall or MFA policy can stop. This criterion requires that data centers, server rooms, and any location where in-scope infrastructure is housed be protected with physical access controls that restrict entry to authorized personnel.
Implementation steps
- 1
Restrict physical access to data centers and server rooms
Ensure that any facility housing in-scope infrastructure requires badge access, key fob, or equivalent credential to enter. Visitor access should require escort and be logged. Co-location or cloud providers handle this for hosted infrastructure; obtain their compliance documentation (SOC 2, ISO 27001) as evidence.
aws google-cloud azure equinix - 2
Log and monitor physical access events
Access control systems should log every entry: who accessed, which area, at what time. Review these logs for anomalies periodically. Visitor and contractor access should be separately logged. For office environments, ensure server rooms and network closets are locked and access-logged.
notion google-sheets - 3
Document physical access policy and revocation process
Write a physical access policy that covers who is authorized to enter restricted areas, how access is granted and revoked, and how visitor access is handled. Ensure access is revoked promptly when employees leave or change roles. If using a cloud provider, document reliance on their physical controls and maintain their compliance reports.
confluence notion
Evidence required
Physical access control documentation
Evidence that physical access to infrastructure is restricted and monitored.
- - Cloud provider SOC 2 or ISO 27001 report covering physical security
- - Office badge access policy and system configuration
- - Physical access log sample showing entry records
Physical access policy
A documented policy covering physical access to restricted areas.
- - Information security policy with physical access section
- - Data center access policy
- - Visitor access procedure
Related controls
Logical access security measures restrict access to assets
Logical and Physical Access
Access credentials are issued with appropriate authorization
Logical and Physical Access
Role-based access is used and reviewed periodically
Logical and Physical Access
Access is removed or modified when no longer required
Logical and Physical Access