Monitoring Physical Access PE-6

Physical and Environmental Protection · Low baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds PE-6 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, Physical and Environmental Protection family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

PE-6 (Monitoring Physical Access) is about watching who physically reaches the system so you can spot and respond to break-ins or tampering. You keep records of physical access, review them on a schedule and after anything unusual, and tie what you find back to your incident response. It is a Low-baseline control.

What good looks like

Monitor the space the server sits in — a camera, a door sensor, or a badge reader that records entries.
Review the physical access records on a set schedule, and again right after anything odd happens.
Investigate anomalies — an entry at a strange hour, or a door left open — rather than ignoring them.
Connect what you find to your incident-response process so a physical event gets handled like any other.
Cross-check physical entries against system activity to see whether a login lines up with someone being in the room.

Framework mapping

NIST CSF 2.0 — DE.CM-02 — The physical environment is monitored to find potentially adverse events

How to move it toward Implemented

Set up something that records physical access to the room — even a cheap camera or a door sensor that logs open and close events counts.
Cross-check those records against the server's own login history (last and lastlog, or journalctl) so a physical entry can be matched to on-machine activity.
Run a monthly review of the physical access records, write down what you checked and anything you followed up on, and save it as a dated file.
Attach the dated monthly physical-access review as hardening evidence on the asset, naming PE-6 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.