Physical access control

Physical access control governs who may enter a site, building, room or cabinet, and so who can physically reach systems, devices and media. Facilities are one of the asset types the ISC2 exam outline lists under objective 5.1, “Control physical and logical access to assets”. NIST SP 800-53 Rev. 5 control PE-3 sets out the core duties: verify each person’s authorisation at defined entry and exit points, control ingress and egress with devices or guards, keep physical access audit logs, escort visitors, and change keys and combinations when they are lost or holders leave. Mechanisms include locks, badge or smart card readers, biometrics, guards, fences and access control vestibules, which PE-3(8) describes as interlocking doors designed to stop tailgating and piggybacking.

It is the counterpart of logical access control, and both commonly follow the same sequence of identify, authenticate, authorise and record. A person at the console or holding a disk may bypass network defences, so it is one layer of defense in depth. It is narrower than the physical category of control types, which also covers controls such as lighting.

Exam relevance: a scenario is likely to describe tailgating, a shared door code, or a badge that still works after its holder has left. Candidates are expected to apply the account lifecycle: authorisation, logging and prompt revocation.