Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.
Think about what parts of your physical space (e.g., office, plant, factory), what equipment, including the network, need to be protected from physical contact. For those parts of your company to which you want only specific employees to have physical access, monitor or limit who is able to enter those spaces with badges, key cards, etc. Example You work for a small company as the project manager for a Department of Defense (DoD) project. The project requires special equipment that should be used only by project team members. You work with your boss to put locks on the doors to your area. This restricts access to the room to only those employees who work on the DoD project.
Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.
This requirement applies to employees, individuals with permanent physical access authorization credentials, and visitors. Authorized individuals have credentials that include badges, identification cards, and smart cards. Organizations determine the strength of authorization credentials needed consistent with applicable laws, directives, policies, regulations, standards, procedures, and guidelines. This requirement applies only to areas within facilities that have not been designated as publicly accessible. Limiting physical access to equipment may include placing equipment in locked rooms or other secured areas and allowing access to authorized individuals only; and placing equipment in locations that can be monitored by organizational personnel. Computing devices, external disk drives, networking devices, monitors, printers, copiers, scanners, facsimile machines, and audio devices are examples of equipment.
NIST SP 800-53 Rev 4 PE-2
NIST SP 800-171 Rev 1 3.10.1
FAR Clause 52.204-21 b.1.viii
NIST CSF v1.1 PR.AC-2
CERT RMM v1.2 KIM:SG4.SP2
PE.1.131.[a] authorized individuals allowed physical access are identified;
PE.1.131.[b] physical access to organizational systems is limited to authorized individuals;
PE.1.131.[c] physical access to equipment is limited to authorized individuals; and
PE.1.131.[d] physical access to operating environments is limited to authorized individuals.