risk
Inadequate physical protection and access controls
Buildings and sensitive areas lacking perimeter security, key-card/lock/mantrap controls, or supervision of visitors and cleaning/outside staff allow unauthorized physical access to equipment and media — including tailgating past physical checks.
Record JSON · Open in map · Data retrieval guide
Catalog revision: 24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028. A connection does not establish full coverage.
Attributes
- category
- cyber_security
- domain
- Physical & Environmental Security
- Access Control & Identity Management
- taxonomy
- iso-27005-vulnerability
- nist-800-30-threat-event
- inherent_rating
- high
Details
- risk_id
- phys-inadequate-facility-access
- category
- cyber_security
- likelihood
- medium
- impact
- high
- inherent_rating
- high
- treatment
- mitigate
- taxonomies
- iso-27005-vulnerability
- nist-800-30-threat-event
Source
No record-specific source URL is provided.
Connections
- UC-PHYS-01 — Restrict physical access to facilities and secure areas mitigates Inadequate physical protection and access controls
- strength
- primary
- rationale
- Perimeters, entry controls, credential issuance/review, and visitor escort are the direct defense against unauthorized physical access, including tailgating.
- UC-ACCESS-12 — Lock, limit, and terminate user sessions mitigates Inadequate physical protection and access controls
- strength
- related
- rationale
- Session lock on unattended workstations reduces the impact of unauthorized physical access to equipment, e.g. after tailgating.
- UC-ACCESS-19 — Restrict physical access and maintain environmental safeguards mitigates Inadequate physical protection and access controls
- strength
- primary
- rationale
- Authorizing, badging, logging, monitoring, and revoking physical access is the direct control preventing unauthorized entry to facilities and secure areas.
- UC-PHYS-04 — Site facilities and equipment to minimize hazards and exposure mitigates Inadequate physical protection and access controls
- strength
- related
- rationale
- Siting to reduce opportunities for unauthorized access lowers physical exposure of facilities to intruders.
- UC-PHYS-10 — Control and track asset delivery, removal, and movement mitigates Inadequate physical protection and access controls
- strength
- related
- rationale
- Isolating delivery/loading areas from sensitive spaces and controlling asset entry closes the loading-dock unauthorized-access vector.
- UC-PHYS-11 — Secure alternate work sites mitigates Inadequate physical protection and access controls
- strength
- related
- rationale
- Extending physical protection requirements to alternate sites limits unauthorized access to equipment and information there.
- UC-PHYS-02 — Monitor physical access and retain visitor and entry records mitigates Inadequate physical protection and access controls
- strength
- primary
- rationale
- Surveillance, intrusion detection, and access-log review directly detect unauthorized entry and tailgating, enabling response.