CC6.4
CC6.4
The entity restricts physical access to facilities and protected information assets (for example, data center facilities, backup media storage, and other sensitive locations) to authorized personnel to meet the entity’s objectives.
Category
Security
Subcategory
Logical and Physical Access Controls
Points of Focus
Creates or Modifies Physical Access
Processes are in place to create or modify physical access by employees, contractors, vendors, and business partner personnel to facilities such as data centers, office spaces, and work areas, based on appropriate authorization.
Removes Physical Access
Processes are in place to remove physical access to facilities and protected information assets when an employee, contractor, vendor, or business partner no longer requires access.
Recovers Physical Devices
Processes are in place to recover entity devices (for example, badges, laptops, and mobile devices) when an employee, contractor, vendor, or business partner no longer requires access.
Reviews Physical Access
Processes are in place to periodically review physical access to help ensure consistency with job responsibilities.
Evidence Requests
| Area of Focus | Artifact | Description |
|---|---|---|
| Physical Security | Environmental Monitoring | Documented evidence of environmental monitoring (e.g., water leaks, temperature, humidity, etc.) |
| Physical Security | Physical Security Operations | Documented evidence of the organization's physical security capabilities as it pertains to operating and monitoring Physical Access Control (PAC)mechanisms. |
| Human Resources | Authorized Personnel Access List | Documented evidence of an authorized personnel access list. |
| Physical Security | Defined Physical Security Roles | Documented evidence of defined physical access control-specific roles that limit physical access to rooms and/or facilities. |
| Physical Security | Physical Access Authorizations | Documented evidence of physical access authorization activities (e.g., list reviews, termination changes, etc.). |
| Physical Security | Physical Access Control Logs | Documented evidence of physical access control logs or records. |
| Physical Security | Physical Access Control Devices | Documented evidence of Physical Access Control (PAC) mechanisms. |
| Physical Security | Physical Access Control Device Inventories | Documented evidence of inventory records of physical access control devices. |
| Physical Security | Key & Combination Changes | Documented evidence of key and lock combination changes. |
Policies
- Physical and Environmental Security Policy - Establishes requirements for physical security of facilities and equipment
Example Organization Controls
- CC6.4.1 - Physical access to data center facilities is restricted to authorized personnel.
Example Control Objectives
- Physical access protection - Physical access to facilities and systems is restricted to authorized personnel.
Example Evidence
- GCP Data Center Compliance Attestation - Google Cloud compliance attestation covering physical access restrictions at data center facilities