{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"cyber_security","domain":["Physical & Environmental Security","Access Control & Identity Management"],"inherent_rating":"high","taxonomy":["iso-27005-vulnerability","nist-800-30-threat-event"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aphys-inadequate-facility-access","description":"Buildings and sensitive areas lacking perimeter security, key-card/lock/mantrap controls, or supervision of visitors and cleaning/outside staff allow unauthorized physical access to equipment and media — including tailgating past physical checks.","details":{"category":"cyber_security","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"phys-inadequate-facility-access","taxonomies":["iso-27005-vulnerability","nist-800-30-threat-event"],"treatment":"mitigate"},"id":"risk:phys-inadequate-facility-access","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aphys-inadequate-facility-access","sourceIds":["hipaa","iso-27001","nist-800-53","nist-csf-2","soc1","soc2"],"sourceUrl":null,"title":"Inadequate physical protection and access controls","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1947576f7898c588cd74ad7b09c7ddef68c76529f12d25c8ccb61bb1489c4e11","properties":{"rationale":"Perimeters, entry controls, credential issuance/review, and visitor escort are the direct defense against unauthorized physical access, including tailgating.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-phys-01-354431a7.json","sourceId":"uc:UC-PHYS-01","targetDetailPath":"/data/v1/records/risk-phys-inadequate-facility-access-a83f3330.json","targetId":"risk:phys-inadequate-facility-access","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:87a4372501910e18e05b608c3a88f895fe36673eb8558e2b013400365214b906","properties":{"rationale":"Session lock on unattended workstations reduces the impact of unauthorized physical access to equipment, e.g. after tailgating.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-access-12-8ef9e477.json","sourceId":"uc:UC-ACCESS-12","targetDetailPath":"/data/v1/records/risk-phys-inadequate-facility-access-a83f3330.json","targetId":"risk:phys-inadequate-facility-access","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:897843185d2d78e8517e151151b9b8afc945cd5abe90f11f8a076f64364ee8a4","properties":{"rationale":"Authorizing, badging, logging, monitoring, and revoking physical access is the direct control preventing unauthorized entry to facilities and secure areas.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-access-19-08a17359.json","sourceId":"uc:UC-ACCESS-19","targetDetailPath":"/data/v1/records/risk-phys-inadequate-facility-access-a83f3330.json","targetId":"risk:phys-inadequate-facility-access","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:97e749193c32f88d9c3436e7e09b91cce858662d4568927faddb7caa963c3765","properties":{"rationale":"Siting to reduce opportunities for unauthorized access lowers physical exposure of facilities to intruders.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-phys-04-91db5045.json","sourceId":"uc:UC-PHYS-04","targetDetailPath":"/data/v1/records/risk-phys-inadequate-facility-access-a83f3330.json","targetId":"risk:phys-inadequate-facility-access","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d82debc7a8da07c939deb220925efb3df0002cb2272ec832a42bd31419517705","properties":{"rationale":"Isolating delivery/loading areas from sensitive spaces and controlling asset entry closes the loading-dock unauthorized-access vector.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-phys-10-9339a7b3.json","sourceId":"uc:UC-PHYS-10","targetDetailPath":"/data/v1/records/risk-phys-inadequate-facility-access-a83f3330.json","targetId":"risk:phys-inadequate-facility-access","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e6c56b94d3bae4857f8bf89a9707c959c822ea9c1df51534780aa56213d6fc30","properties":{"rationale":"Extending physical protection requirements to alternate sites limits unauthorized access to equipment and information there.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-phys-11-d74b621d.json","sourceId":"uc:UC-PHYS-11","targetDetailPath":"/data/v1/records/risk-phys-inadequate-facility-access-a83f3330.json","targetId":"risk:phys-inadequate-facility-access","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f5268251a7914939d04cd350a1941672d9acc6fac69cde3eb50ca6daa70df422","properties":{"rationale":"Surveillance, intrusion detection, and access-log review directly detect unauthorized entry and tailgating, enabling response.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-phys-02-05f35d07.json","sourceId":"uc:UC-PHYS-02","targetDetailPath":"/data/v1/records/risk-phys-inadequate-facility-access-a83f3330.json","targetId":"risk:phys-inadequate-facility-access","type":"mitigates"}],"schemaVersion":1}