Does your organization monitor physical access control logs for unusual patterns and failed access attempts?
Explanation
Monitoring physical access logs helps identify potential security breaches, such as unauthorized access attempts, access outside normal working hours, or suspicious patterns like multiple failed badge swipes. These logs can reveal when terminated employees attempt to use old credentials or when someone tries to access restricted areas without proper authorization.
Evidence could include screenshots of your physical access monitoring system showing alerts for unusual activities, documentation of your log review process, or reports generated from your access control system highlighting anomalies and failed access attempts with timestamps and resolution notes.
Implementation Example
Monitor logs from physical access control systems (e.g., badge readers) to find unusual access patterns (e.g., deviations from the norm) and failed access attempts
ID: DE.CM-02.276
Context
- Function
- DE: DETECT
- Category
- DE.CM: Continuous Monitoring
- Sub-Category
- The physical environment is monitored to find potentially adverse events
Related questions
- Does your organization have a system in place to monitor DNS, BGP, and other critical network services for suspicious or malicious activities?
- Does your organization implement network monitoring controls to detect and alert on unauthorized endpoint connections to both wired and wireless networks?
- Does your organization have a process to regularly monitor facilities for unauthorized or rogue wireless networks?
- Does your organization regularly compare actual network traffic flows against established baselines to detect and investigate deviations?
- Does your organization continuously monitor network communications to detect changes in security postures as part of a zero trust architecture?
- Does your organization regularly review and monitor physical access records to track visitor and personnel entry to facilities?