Visitor Access Records

frameworkNIST SP 800-53 Rev 5.2 sectionPE Physical and Environmental Protection csf 2.0PR.AA-06 topicsPhysical Security frameworks6 2 5

Official texta. Maintain visitor access records to the facility where the system resides for [Assignment: organization-defined time period];
b. Review visitor access records [Assignment: organization-defined frequency]; and
c. Report anomalies in visitor access records to [Assignment: organization-defined personnel].NIST SP 800-53 Rev 5.2 control statement (public domain)

gap from 800-53 → gap to 800-53 →

Wrong or missing mapping? Report it

Equivalents of PE-8 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.CM-02 PR.AA-06 PR.IR-02	The physical environment is monitored to find potentially adverse events; Physical access to assets is managed, monitored, and enforced commensurate with risk…	Crosswalk	Same topic: Physical Security
ISO 27001	A.7.1 A.7.2 A.7.3 A.7.4 A.7.5 A.7.6 A.7.8 A.7.11 A.7.12	Physical security perimeters; Physical entry…	Crosswalk	Same topic: Physical Security
CIS v8.1	—	No requirement	No mapping in our data	No mapping in our data (most CIS links are editorial: CIS's published crosswalk covers 49 of 153 safeguards).
SOC 2	CC6.4	Physical access restrictions	Editorial	Same topic: Physical Security (editorial pick)
PCI DSS	9.2.3 9.3.1.1 9.2.1 9.2.1.1 9.3.1 9.3.2	Physical access to network hardware restricted; Sensitive-area access authorised and revoked promptly…	Crosswalk	Same topic: Physical Security 2 loosely related (not mappings) 9.2.4 Consoles in sensitive areas locked when unattended Loosely related Only shares CSF PR.AA-06: related, not a mapping 9.5.1.2 POI devices inspected for tampering Loosely related Only shares CSF PR.AA-06: related, not a mapping
CMMC	PE.L2-3.10.1 PE.L2-3.10.2 PE.L2-3.10.3 PE.L2-3.10.4 PE.L2-3.10.5 PE.L2-3.10.6	Limit Physical Access; Monitor Facility…	Crosswalk	Same topic: Physical Security
HIPAA	§164.310(a)§164.310(a)(2)(iii)§164.310(b)§164.310(c)§164.310(a)(2)(ii)	Facility Access Controls; Access Control and Validation Procedures…	Crosswalk	Same topic: Physical Security 3 loosely related (not mappings) §164.310(a)(2)(i) Contingency Operations Loosely related Only shares CSF PR.AA-06: related, not a mapping §164.310(d) Device and Media Controls Loosely related Only shares CSF PR.AA-06: related, not a mapping §164.310(d)(2)(iii) Accountability Loosely related Only shares CSF PR.AA-06: related, not a mapping
GDPR	—	No requirement	No mapping in our data	No mapping in our data (only GDPR's security articles are mapped, editorially).
NIS2	13.1 13.2 13.3	Supporting utilities; Protection against physical and environmental threats…	Crosswalk	Same topic: Physical Security 1 loosely related (not mappings) 11.5 Identification Loosely related Only shares CSF PR.AA-06: related, not a mapping
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.6(2)Art.9(4)(c)	ICT risk management framework; Protection and prevention	Editorial	Same topic: Physical Security (editorial pick)
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.