NIST SP 800-53 Rev 5 binds US federal systems, and reaches other organizations through contracts and flow down clauses. For everyone else it is a reference catalog: a detailed, public description of what a control can look like. PE-6, Monitoring Physical Access, has three parts. Monitor physical access to the facility where the system resides to detect and respond to physical security incidents. Review physical access logs at a defined frequency and when defined events occur. Coordinate review results and investigations with the incident response capability.
The guidance says monitoring includes publicly accessible areas, and lists guards, video surveillance, and sensor devices as examples. It notes that log reviews can be supported by audit logging controls such as AU-2 when the logs sit in an automated system.
What it means in practice
Locks and badges stop most people. Monitoring tells you about the ones that got through, or the ones who should not have been there in the first place.
The control has a time dimension that people miss. Capturing logs is not enough. Someone has to read them, on a schedule you set, and also when something unusual happens, such as an alarm, a lost badge, or a break in.
The third part joins physical events to your incident process. A propped door at the server room is a physical incident, and it should land in the same ticket queue and review as a security alert.
Evidence to collect
- The monitoring design: cameras, alarms, guards, sensors, and what each covers.
- Signed or ticketed log review records for several periods.
- A few examples of unusual events, with how each was investigated and closed.
- The defined review frequency and the list of triggering events.
- Camera or alarm retention settings.
- An incident record that shows a physical event handled through the normal incident process.
Common gaps
- Logs are collected but no review record exists.
- Review happens only after something goes wrong.
- Camera footage overwrites before anyone could use it.
- Alarms ring to a person who is no longer on the team.
- Physical events never reach the incident team.
- Colocation access logs are never requested from the provider.
How to implement it
Define what you monitor and how often you review. Weekly is common for small environments, but the number is yours to set and justify. Automate the export of badge and alarm logs into the same place you keep other audit data. Create a short review template: period, who reviewed, anomalies found, actions taken.
Write down triggering events such as lost badges, after hours entry, forced door alarms, and failed badge attempts above a threshold. Connect each to an incident ticket type.
The record lists four enhancements: PE-6.1 Intrusion Alarms and Surveillance Equipment, PE-6.2 Automated Intrusion Recognition and Responses, PE-6.3 Video Surveillance, and PE-6.4 Monitoring Physical Access to Systems. Choose by risk. A room with high value equipment may justify PE-6.4, which adds monitoring at the systems themselves.
If your provider runs the facility, ask for the access monitoring portion of their audit report and keep a record of when you reviewed it.
Try it yourself
The demo below shows how monitoring signals can feed one review loop instead of living in separate tools.
Click through it at your own pace, or open it full screen.
Quick check
Is a camera alone enough for PE-6?
No. The control also asks for log reviews and coordination with incident response. A camera with no review record meets only the first part.
Who should review the logs?
Someone independent of the people being logged, where possible, with a written frequency and a record of each review.
