PR.AA-06 says physical access to assets is managed, monitored, and enforced commensurate with risk. Decide which physical spaces and devices matter, restrict who can reach them, and keep a record of who did. The depth depends on what you hold: a shared office with a network closet needs less than a facility with servers.
What good looks like
Locked entrances, an up to date list of who has keys or badges, visitor handling, and extra care around high risk areas. Remote teams are not exempt, because laptops and home offices are physical assets too.
NIST's examples: use guards, cameras, locked entrances, alarms, and other physical controls to monitor and restrict access to facilities. Employ additional controls for areas that hold high risk assets. Escort guests, vendors, and other third parties in areas with business critical assets.
How to implement it
- List physical locations and what is in them: offices, network rooms, storage of spare devices, and any colocation space.
- Control entry with badges or keys, and record who holds them. Collect them at offboarding.
- Sign in visitors, give them a badge, and escort them near critical assets.
- Add stronger controls where risk is higher, such as a locked rack, a camera, or an access log for the server room.
- For cloud hosted systems, collect your provider's physical security attestations instead of assessing their data centers yourself.
- For remote staff, require disk encryption, screen locks, and a lost device process.
Evidence to collect
- Badge or key holder list reviewed on a date
- Visitor logs
- Photos or descriptions of controls on high risk areas
- Cloud provider physical security attestations
- Lost device records
Common gaps
- Badges of departed staff stay active
- Visitors wander unescorted into the network closet
- Laptop encryption is assumed, not verified
- Physical access logs exist but nobody reads them
Quick check
We are fully remote. Does this apply?
Yes, in a lighter form. Focus on device protection, home office practices for sensitive work, and the physical controls of the providers hosting your systems.
Sources
- NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (February 2024), Appendix A, CSF Core: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
- NIST CSF 2.0 landing page: https://csrc.nist.gov/pubs/cswp/29/the-nist-cybersecurity-framework-csf-20/final
The CSF is voluntary guidance. There is no CSF certification, so nothing here makes a company "CSF certified". You describe your own practices against the outcomes.
