Skip to content

Physical Access Control

What is Physical Access Control?

Security measures that restrict physical entry to facilities, rooms, or areas to authorized individuals using barriers, locks, and authentication systems.

Information Security

Each of these is named in at least one of the same controls as physical access control. The number is how many controls name both.

What the standards actually require on physical access control

Requirements naming physical access control across 6 standards, quoted from the control text.

Employ access control vestibules at [Assignment: organization-defined locations within the facility].

NIST800-PE-3(8) · PE-3(8) Physical Access Control | Access Control Vestibules →
NERC CIP5 controls

Use at least one physical access control to allow unescorted physical access into each applicable Physical Security Perimeter only to individuals with authorized unescorted physical access.

nerc-cip::CIP-006 R1.2 · CIP-006-6 R1.2: At least one physical access control into each PSP →

Physical access controls such as fences, locks and signage are implemented, at least in an ad hoc way, to protect IT, OT and information assets; how keys and badges are managed affects how well they work.

australian-energy-sector-cyber-security-framework-aescsf::ACCESS-3a · ACCESS-3a: Physical access controls in place →
FedRAMP High2 controls

Enforce physical access at entry/exit points; verify authorizations; control ingress/egress; maintain audit logs.

PE-3 · Physical Access Control →

Enforce physical access authorizations to the system in addition to the physical access controls for the facility at [Assignment: organization-defined physical spaces containing one or more components of the system].

nist-sp-800-53-revision-5-1-high::PE-3(1) · PE-3(1) Physical Access Control | System Access →

Restrict physical access to OT areas, control rooms, network closets, and field cabinets using authenticated entry controls and visitor management.

OT-PHYS-1 · Physical Access Control to OT Assets →

Questions people ask about physical access control

What is Physical Access Control?
Security measures that restrict physical entry to facilities, rooms, or areas to authorized individuals using barriers, locks, and authentication systems.
Why is Physical Access Control important for compliance?
Physical Access Control is a key concept in Information Security. Understanding physical access control helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 1,016 frameworks with 316K cross-framework control mappings.
Which compliance frameworks address Physical Access Control?
Physical Access Control appears in the requirement text of NIST SP 800-53 Rev 5, NERC CIP, Australian Energy Sector Cyber Security Framework (AESCSF), FedRAMP High, NIST SP 800-53 Rev 5 HIGH. Across these standards we have identified 20 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Physical Access Control?
Explore our compliance framework pages to see how physical access control applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 1,016 frameworks.

See how Physical Access Control applies across compliance frameworks

Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.

Written and maintained by Gerard Blokdyk, The Art of Service.