{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"physical","domain":"Physical & Environmental Security","type":"preventive"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-ACCESS-19","description":"Physical access to facilities, data centers, and protected assets is authorized, badged, logged, monitored, and revoked on separation, commensurate with risk. Environmental protections including power conditioning and backup, fire detection and suppression, and temperature and humidity control safeguard systems, and physical access and environmental events are reviewed.","details":{"control_category":"physical","control_type":"preventive","domain":"Physical & Environmental Security","guidance":[],"members":[{"control_id":"PR.AA-06","coverage":"full","framework":"nist-csf-2","relationship":"superset_of"},{"control_id":"SOC1-10","coverage":"full","framework":"soc1","relationship":"superset_of"}],"statement":"Physical access to facilities, data centers, and protected assets is authorized, badged, logged, monitored, and revoked on separation, commensurate with risk. Environmental protections including power conditioning and backup, fire detection and suppression, and temperature and humidity control safeguard systems, and physical access and environmental events are reviewed.","title":"Restrict physical access and maintain environmental safeguards","unified_id":"UC-ACCESS-19"},"id":"uc:UC-ACCESS-19","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-ACCESS-19","sourceIds":["nist-csf-2","soc1"],"sourceUrl":null,"title":"UC-ACCESS-19 — Restrict physical access and maintain environmental safeguards","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:11fe9a986e34244ae40027d08cce29410f0ad1ec4a74cb082300df6f05ac6c05","properties":{"rationale":"Access authorization plus review of physical/environmental events deters and detects an adversary physically reaching and sabotaging infrastructure.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-access-19-08a17359.json","sourceId":"uc:UC-ACCESS-19","targetDetailPath":"/data/v1/records/risk-phys-cyber-physical-facility-attack-e372d06e.json","targetId":"risk:phys-cyber-physical-facility-attack","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:24dbef39811ef84a0d7b79c4ed3838fea8da8703c5491b283f38b3e0abe95c48","properties":{},"sourceDetailPath":"/data/v1/records/wf-c35-f84d44e2.json","sourceId":"wf:C35","targetDetailPath":"/data/v1/records/uc-uc-access-19-08a17359.json","targetId":"uc:UC-ACCESS-19","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2e332acd8dfc0cf722c3204bd5af0b9933bb21e527bed00c863af41ac7dddabf","properties":{"control_id":"PR.AA-06","coverage":"full","delta":null,"framework":"nist-csf-2","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2.0"},"sourceDetailPath":"/data/v1/records/uc-uc-access-19-08a17359.json","sourceId":"uc:UC-ACCESS-19","targetDetailPath":"/data/v1/records/ctrl-nist-csf-2-pr-aa-06-d4455983.json","targetId":"ctrl:nist-csf-2:PR.AA-06","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3cb85a07ecd989ddfb977e2e28f315672ff6498a55a05836692b3add9de727a7","properties":{"rationale":"Temperature/humidity control and power conditioning directly prevent equipment degradation from thermal and voltage variation.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-access-19-08a17359.json","sourceId":"uc:UC-ACCESS-19","targetDetailPath":"/data/v1/records/risk-phys-environmental-degradation-137ba6a3.json","targetId":"risk:phys-environmental-degradation","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:5a89cf0f679caeba093b024d4116046089f748f6c912e73e2e281611062987af","properties":{"rationale":"Operating fire detection and suppression directly mitigates the fire hazard to systems that is the core gap this risk names.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-access-19-08a17359.json","sourceId":"uc:UC-ACCESS-19","targetDetailPath":"/data/v1/records/risk-phys-fire-water-suppression-gap-ac966b92.json","targetId":"risk:phys-fire-water-suppression-gap","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:82c5c2a6412b6bd1788c545deba7ea85028834f492e55e2af8ed87fe97ac2c8e","properties":{"rationale":"Power conditioning and backup directly sustain systems through power disruption, reducing loss-of-power impact.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-access-19-08a17359.json","sourceId":"uc:UC-ACCESS-19","targetDetailPath":"/data/v1/records/risk-tech-loss-essential-services-b7feae05.json","targetId":"risk:tech-loss-essential-services","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:897843185d2d78e8517e151151b9b8afc945cd5abe90f11f8a076f64364ee8a4","properties":{"rationale":"Authorizing, badging, logging, monitoring, and revoking physical access is the direct control preventing unauthorized entry to facilities and secure areas.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-access-19-08a17359.json","sourceId":"uc:UC-ACCESS-19","targetDetailPath":"/data/v1/records/risk-phys-inadequate-facility-access-a83f3330.json","targetId":"risk:phys-inadequate-facility-access","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:916a5f73c86982a998a42038eb41a19435b88179395ca277226a86d2ec11a2dc","properties":{"rationale":"Restricting and revoking physical access keeps unauthorized persons away from equipment and media, directly preventing on-site theft.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-access-19-08a17359.json","sourceId":"uc:UC-ACCESS-19","targetDetailPath":"/data/v1/records/risk-phys-theft-of-equipment-media-c64433e7.json","targetId":"risk:phys-theft-of-equipment-media","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9fafebea5d96d38e3c33da4473eb44cf8bf2363d2107e59ef6d2ceba71c5aa68","properties":{},"sourceDetailPath":"/data/v1/records/wf-c7-acbef2ee.json","sourceId":"wf:C7","targetDetailPath":"/data/v1/records/uc-uc-access-19-08a17359.json","targetId":"uc:UC-ACCESS-19","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a2e1805733a26b7d9aa4907769037519f52061354e3a99da55492a7950b96b53","properties":{"control_id":"SOC1-10","coverage":"full","delta":null,"framework":"soc1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"SSAE 18 (current AICPA SOC suite)"},"sourceDetailPath":"/data/v1/records/uc-uc-access-19-08a17359.json","sourceId":"uc:UC-ACCESS-19","targetDetailPath":"/data/v1/records/ctrl-soc1-soc1-10-43ef0cd6.json","targetId":"ctrl:soc1:SOC1-10","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f7480406e7cd8dc855147f139fc7a97158da55492224de181fc91ce9a8fe4dc9","properties":{},"sourceDetailPath":"/data/v1/records/wf-c9-75fb1752.json","sourceId":"wf:C9","targetDetailPath":"/data/v1/records/uc-uc-access-19-08a17359.json","targetId":"uc:UC-ACCESS-19","type":"tests"}],"schemaVersion":1}