NIST SP 800-53 Rev 5 binds US federal systems, and reaches other organizations through contracts and flow down clauses. For everyone else it is a reference catalog: a detailed, public description of what a control can look like. PE-3, Physical Access Control, is the control most people picture when they hear physical security. It is also one of the longest in the family, with eight enhancements.
The base requirement has several parts. Enforce physical access authorizations at defined entry and exit points by verifying individual authorizations before granting access, and by controlling ingress and egress with defined systems or devices. Keep physical access audit logs. Control access to publicly accessible areas. Escort visitors and control their activity. Secure keys, combinations, and other physical access devices. Inventory those devices on a schedule. Change combinations and keys when they are lost, compromised, or when a holder is transferred or terminated.
What it means in practice
Think of every door that leads to a place holding your systems: a server room, a wiring closet, a data hall, a locked office with workstations that touch sensitive data.
For each door, you need an answer to four questions. Who is allowed through? How is that checked? What record is kept of use? What happens when a person leaves or a key goes missing?
Public areas get their own treatment. A lobby can be open, but the guidance expects barriers or guards that stop people moving from the public area into the non public one.
Organizations choose the parameters. How often you inventory keys and how long you keep logs are yours to set, and an assessor will compare what you did with what you wrote.
Evidence to collect
- The list of facilities and secured areas in scope, with entry points.
- The current authorization list for each area, with approver and date.
- Badge or key log exports covering a recent period.
- The key and badge device inventory and the date of the last check.
- Records of lock or code changes after a departure or a loss.
- A visitor escort procedure and a few completed visitor records.
- For colocation or cloud, the provider attestation or report that covers its facility controls, plus your own list of who can request access.
Common gaps
- Access lists that nobody has reviewed since the room was set up.
- Departed staff whose badges still open the door.
- A shared door code that is never rotated.
- Logs that exist in the badge system but are never exported or kept for the stated period.
- Spare keys in a drawer that appears in no inventory.
- Assuming the colo provider covers everything, with no record of who on your side holds access.
How to implement it
Start with a table: area, owner, who is authorized, mechanism, log location. Tie it to your joiner, mover, and leaver process so access changes the same day a person's role does.
Review the authorization list on a fixed cycle and keep the review as a signed record. Export badge logs on a schedule so evidence exists before the auditor asks.
Add controls by risk. The enhancements are options, not a checklist for every site: PE-3.1 System Access, PE-3.2 Facility and Systems, PE-3.3 Continuous Guards, PE-3.4 Lockable Casings, PE-3.5 Tamper Protection, PE-3.6 Facility Penetration Testing, PE-3.7 Physical Barriers, and PE-3.8 Access Control Vestibules. A small team with one locked room might adopt lockable casings. A data hall might use vestibules and guards.
Treat key and combination handling as its own process. Numbered keys, a signed checkout sheet, and a change record after every departure cover most of the audit questions.
Quick check
What is the difference between PE-2 and PE-3?
PE-2 decides who is authorized and keeps the list. PE-3 enforces that list at the door and keeps the logs.
