PE-6 MONITORING PHYSICAL ACCESS Applicability: All Information Systems Control: The organization: Monitors physical access to the information system to detect and respond to physical security incidents; Reviews physical access logs at least semi-annually; and Coordinates results of reviews and investigations with the organization’s incident response capability. Supplemental Guidance: Investigation of and response to detected physical security incidents, including apparent security violations or suspicious physical access activities, are part of the organization’s incident response capability. Control Enhancements: The organization monitors real-time physical intrusion alarms and surveillance equipment. The organization employs automated mechanisms to recognize potential intrusions and initiate designated response actions. References: None. Priority and Baseline Allocation: P1 LOW PE-6 MOD PE-6 (1) HIGH PE-6 (1) (2) PE-7 VISITOR CONTROL Applicability: All Information Systems Control: The organization controls physical access to the information system by authenticating visitors before authorizing access to the facility where the information system resides other than areas designated as publicly accessible. Supplemental Guidance: Individuals (to include organizational employees, contract personnel, and others) with permanent authorization credentials for the facility are not considered visitors. Control Enhancements: The organization escorts visitors and monitors visitor activity, when required. References: None. Priority and Baseline Allocation:
PE-12 EMERGENCY LIGHTING Applicability: All Information Systems Control: The organization employs and maintains automatic emergency lighting for the information system that activates in the event of a power outage or disruption and that covers emergency exits and evacuation routes within the facility. Supplemental Guidance: This control, to include any enhancements specified, may be satisfied by similar requirements fulfilled by another organizational entity than the information security program. Organizations avoid duplicating actions already covered. Control Enhancements: None Mandated. References: None. Priority and Baseline Allocation: P1 LOW PE-12 MOD PE-12 HIGH PE-12 PE-13 FIRE PROTECTION Applicability: All Information Systems Control: The organization employs and maintains fire suppression and detection devices/systems for the information system that are supported by an independent energy source. Supplemental Guidance: Fire suppression and detection devices/systems include, for example, sprinkler systems, handheld fire extinguishers, fixed fire hoses, and smoke detectors. This control, to include any enhancements specified, may be satisfied by similar requirements fulfilled by another organizational entity other than the information security program. Organizations avoid duplicating actions already covered. Control Enhancements: The organization employs fire detection devices/systems for the information system that activate automatically and notify the organization and emergency responders in the event of a fire. The organization employs fire suppression devices/systems for the information system that provide automatic notification of any activation to the organization and emergency responders. The organization employs an automatic fire suppression capability for the information system when the facility is not staffed on a continuous basis. References: None. Priority and Baseline Allocation: