A badge leaves the building in a former employee's pocket and still opens the door six months later. That one fact is why NIST SP 800-53 Rev 5 control PE-2 Physical Access Authorizations exists.
800-53 binds US federal systems and, through contracts, some suppliers. For other companies it is a reference, and physical access evidence is a standard request in customer reviews and audits.
What the control asks
Four parts. Develop, approve and maintain a list of people with authorized access to the facility where the system resides. Issue authorization credentials for facility access. Review the access list on a frequency you set. Remove people from the list when access is no longer needed.
The guidance says authorizations apply to employees and visitors, and that people holding permanent credentials are not considered visitors. Credentials include ID badges, identification cards and smart cards. You decide how strong the credential must be, consistent with applicable law and directives.
What it means in practice
There is a list. It is approved by someone. It matches who really holds a badge or key. It gets reviewed on a set schedule. When someone leaves or changes roles, the list changes and the credential is deactivated or collected.
The guidance also notes that physical access authorizations may not be needed for areas designated as publicly accessible. A lobby is not a server room. Define zones and apply the list to the sensitive ones.
Evidence to collect
- The current authorized access list for each secured area, with approver and date.
- Badge or key issuance records.
- Review records showing who reviewed the list, when, and what changed.
- Offboarding tickets that include badge deactivation, with timestamps.
- An export from the badge system compared with HR records.
- The definition of zones and which are publicly accessible.
Common gaps
The badge system has more active cards than the company has people. Contractors keep access after the project ends. Reviews happen but nobody records the result. The list says role based access and the badge system says everyone.
Another gap is that offboarding covers laptops and accounts but forgets the physical credential.
How to implement it
Set up zones: public, general office, restricted such as a wiring closet or storage room. Assign each zone an owner who approves membership. Export badge holders monthly or quarterly and compare to the HR roster. Remove differences.
Tie badge deactivation to the offboarding checklist so it is done on the last day. Record each review in a ticket with a list of removals.
The review step is the same activity as an access review for software accounts. The demo shows the shape of it: list who has access, ask the owner to confirm, record the decision, remove the rest.
Click through it at your own pace, or open it full screen.
Look at the enhancements for stronger setups. PE-2.1 Access by Position or Role grants access by role instead of by individual. PE-2.2 Two Forms of Identification requires two forms from an accepted list before issuing credentials. PE-2.3 Restrict Unescorted Access limits unescorted access to people who meet criteria you set, such as clearances or training.
PE-2 works with PE-3 Physical Access Control, which governs how entry is enforced. Mappings to other frameworks vary by source, so check the one your auditor cites.
Quick check
Are permanent employees with badges treated as visitors?
No. The guidance says people with permanent physical access credentials are not considered visitors.
Does every room need an access list?
Not necessarily. The guidance says authorizations may be unnecessary for areas designated as publicly accessible. Define zones and list the sensitive ones.
What is the fastest way to find stale badges?
Compare the badge system export with the HR roster and the contractor list. Anyone active in one and not in the other needs a decision.
