Physical Security
Control physical access to facilities and equipment, and protect them from environmental threats.
Physical Security is defined by the NIST CSF 2.0 outcomes PR.AA-06 (Physical access to assets is managed, monitored, and enforced commensurate with risk); DE.CM-02 (The physical environment is monitored to find potentially adverse events); PR.IR-02 (The organization's technology assets are protected from environmental threats). Crosswalk Mapped through a published crosswalk in ISO 27001, PCI DSS, CMMC, 800-53, HIPAA and NIS2. Editorial Mapped editorially in SOC 2 and DORA. No mapping in our data No mapping in our data for CIS v8.1, GDPR, Essential Eight, CPS 234 and Cyber Essentials.
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | PR.AA-06DE.CM-02PR.IR-02 | Physical access to assets is managed, monitored, and enforced commensurate with risk; The physical environment is monitored to find potentially adverse events; The organization's technology assets are protected from environmental threats | Topic definition | PR.AA-06 DE.CM-02 PR.IR-02 |
| ISO 27001 | A.7.1A.7.2A.7.3A.7.4A.7.5A.7.8A.7.11A.7.6A.7.12 | Physical security perimeters; Physical entry; Securing offices, rooms and facilities… | Crosswalk | A.7.1: via PR.AA-06; NIST 800-53 map: PE-3 A.7.2: via PR.AA-06; NIST 800-53 map: PE-2, PE-3 A.7.3: via PR.AA-06; NIST 800-53 map: PE-3 A.7.4: via PR.AA-06; DE.CM-02; NIST 800-53 map: PE-3, PE-6 A.7.5: via PR.IR-02; NIST 800-53 map: PE-13, PE-14 A.7.8: via PR.IR-02; NIST 800-53 map: PE-13, PE-14 A.7.11: via PR.IR-02; NIST 800-53 map: PE-14 A.7.6: via PR.IR-02 A.7.12: via PR.AA-06; PR.IR-02 |
| CIS v8.1 | — | No requirement | No mapping in our data | No CIS v8.1 requirement is mapped to this topic in our data. |
| SOC 2 | CC6.4 | Physical access restrictions | Editorial | CC6.4: AICPA's TSC mappings are not openly licensed; ControlMapping editorial mapping (criterion summaries are ours, not AICPA text). |
| PCI DSS | 9.2.19.2.39.3.19.2.1.19.3.1.19.3.2 | Facility entry controls restrict CDE access; Physical access to network hardware restricted; Personnel physical access authorised and managed… | Crosswalk | 9.2.1: Facility entry controls restrict physical access to the cardholder data environment; NIST's PCI references for these subcategories omit it. 9.2.3: via PR.AA-06 9.3.1: Procedures to authorize and manage physical access of personnel; omitted from NIST's PCI references for these subcategories. 9.2.1.1: Physical access to sensitive areas is monitored with video cameras or access-control mechanisms, and the records kept. 9.3.1.1: via PR.AA-06; DE.CM-02 9.3.2: Procedures to authorise and manage visitor access to the cardholder data environment. |
| CMMC | PE.L2-3.10.1PE.L2-3.10.2PE.L2-3.10.3PE.L2-3.10.4PE.L2-3.10.5PE.L2-3.10.6 | Limit Physical Access; Monitor Facility; Escort Visitors… | Crosswalk | PE.L2-3.10.1: via 800-171r3 03.10.01 ↔ PR.AA-06 → PE-2; 800-171r2 Appendix D → PE-2, PE-6 PE.L2-3.10.2: via 800-171r3 03.10.02 ↔ PR.AA-06, DE.CM-02 → PE-6; 800-171r2 Appendix D → PE-2, PE-6 PE.L2-3.10.3: via 800-171r3 03.10.07 ↔ PR.AA-06, DE.CM-02 → PE-3; 800-171r2 Appendix D → PE-3 PE.L2-3.10.4: via 800-171r3 03.10.07 ↔ PR.AA-06, DE.CM-02 → PE-3; 800-171r2 Appendix D → PE-3 PE.L2-3.10.5: via 800-171r3 03.10.07 ↔ PR.AA-06, DE.CM-02 → PE-3; 800-171r2 Appendix D → PE-3 PE.L2-3.10.6: Enforce safeguarding measures for CUI at alternate work sites. |
| 800-53 | PE-2PE-3PE-6PE-8PE-13PE-14 | Physical Access Authorizations; Physical Access Control; Monitoring Physical Access… | Crosswalk | PE-2: via PR.AA-06 PE-3: via PR.AA-06; DE.CM-02 PE-6: via PR.AA-06; DE.CM-02 PE-8: via PR.AA-06 PE-13: via PR.IR-02 PE-14: via PR.IR-02 |
| HIPAA | §164.310(a)§164.310(a)(2)(ii)§164.310(a)(2)(iii)§164.310(b)§164.310(c) | Facility Access Controls; Facility Security Plan; Access Control and Validation Procedures… | Crosswalk | §164.310(a): via NIST HIPAA map: PE-2, PE-3 §164.310(a)(2)(ii): Facility security plan (safeguard the facility and equipment from unauthorized access, tampering and theft); NIST maps it to PE-1/PL-2-level planning controls rather than this topic's physical access controls. §164.310(a)(2)(iii): via NIST HIPAA map: PE-2, PE-3, PE-6, PE-8 §164.310(b): via NIST HIPAA map: PE-3 §164.310(c): via NIST HIPAA map: PE-2, PE-3 |
| GDPR | — | No requirement | No mapping in our data | No GDPR requirement is mapped to this topic in our data. |
| NIS2 | 13.113.213.3 | Supporting utilities; Protection against physical and environmental threats; Perimeter and physical access control | Crosswalk | 13.1: via DE.CM-02; ENISA ISO map: A.7.11 13.2: via PR.IR-02; ENISA ISO map: A.7.3, A.7.5 13.3: via PR.AA-06; DE.CM-02; ENISA ISO map: A.7.1, A.7.2, A.7.4 |
| Essential Eight | — | No requirement | No mapping in our data | No Essential Eight requirement is mapped to this topic in our data. |
| DORA | Art.6(2)Art.9(4)(c) | ICT risk management framework; Protection and prevention | Editorial | Art.6(2): The framework protects physical components and infrastructure, such as premises, data centres and sensitive areas. Art.9(4)(c): Limit physical access to information and ICT assets. |
| CPS 234 | — | No requirement | No mapping in our data | No CPS 234 requirement is mapped to this topic in our data. |
| Cyber Essentials | — | No requirement | No mapping in our data | No Cyber Essentials requirement is mapped to this topic in our data. |
Topic definition CSF 2.0 outcomes that define this topic · Crosswalk at least one pick backed by a published crosswalk · Editorial ControlMapping's judgement, with the reason · not mapped, only shares this topic's CSF outcomes · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Methodology.
Wrong or missing mapping? Report it
About Physical Security
Physical security protects the buildings, rooms and equipment that information systems depend on. It covers secure perimeters and entry controls, visitor management, monitoring of physical access, protection against fire, flood, power loss and other environmental threats, and the secure handling of equipment and media. Even cloud-first organizations retain physical obligations for offices, endpoints and any on-premises infrastructure, and auditors routinely test badge access, visitor logs and equipment disposal alongside logical controls.