Physical Access Control PE-3
Physical and Environmental Protection · Low baseline ✗ Not implemented
Status — program-wide
What references this control
No risks name this control in their Framework field yet.
No policies reference it yet.
Link a risk or policy to this control
Attaching adds PE-3 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.
Source: NIST SP 800-53 Rev.5, Physical and Environmental Protection family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.
Control guide — plain-English, per NIST SP 800-53
PE-3 (Physical Access Control) is the actual enforcement at the door: you verify who is allowed in at each entry point, control the way in and out with a lock, reader, or guard, keep a log of physical entries, escort visitors, and safeguard the keys and codes themselves. It is a Low-baseline control that puts PE-2's list into practice.
What good looks like
- Control every entry point with a lock, badge reader, or guard — verify the person before they get in.
- Keep a physical access log of who entered and when, at least for sensitive spaces.
- Escort visitors and keep an eye on what they do while inside.
- Safeguard keys, codes, and badges — store them securely and know who holds each one.
- Inventory the keys and devices on a schedule, and change codes or locks when one is lost or a person leaves.
Framework mapping
- NIST CSF 2.0 — PR.AA-06 — Physical access to assets is managed, monitored, and enforced commensurate with risk
How to move it toward Implemented
- Fit the room or rack with a real lock (keyed or keypad) and make sure only people on the authorized list can open it.
- Start a physical access log — a dated notebook or file — where entries to the space are recorded.
- Do a key and code inventory: list every key, badge, and door code, note who holds it, and change any code that has been shared too widely or lost.
- Attach the key-and-code inventory and a sample of the access log as hardening evidence on the asset, naming
PE-3in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.