What DE.CM-02 asks for and why auditors check it
DE.CM-02 asks an organization to monitor its physical environment for potentially adverse events. If a gap analysis or customer questionnaire asks how you monitor physical access, the answer is evidence that facilities, security and IT records reveal unusual entries, failed access attempts, visitor activity and signs of tampering, and that someone reviews them. DE.CM-02 is a Subcategory of the Continuous Monitoring (DE.CM) Category in the DETECT Function of CSF 2.0. It continues CSF 1.1 subcategory DE.CM-2 at the same identifier, so a 1.1 assessment already covering that item can be carried forward and checked against the 2.0 wording. The risk it addresses is simple: someone with physical access can bypass most logical controls by walking into a server room, copying media, disabling a sensor or planting a device, and an organization that does not notice this until after the fact has little chance of containing it.
The difficulty is ownership. The records that matter sit with facilities, physical security, reception and HR: badge reader logs, visitor sign-in sheets, alarm panel histories, camera retention settings and guard shift reports. IT rarely controls them and often cannot see them. A CISO who assigns DE.CM-02 to the security operations team will usually find that the data exists but is held in a separate access control system, retained for a shorter period than the cyber logs, or never reviewed by anyone. Before drafting any response, confirm who owns each source, who reviews it, how often, and where the review is recorded. Those four answers are what an assessor will ask for first.
Auditors and assessors check DE.CM-02 by asking for proof of monitoring, not a policy statement. Expect requests for an export of badge events covering a sample period, the list of visitor records with escort and purpose fields completed, the tamper check or alarm test log, and a record of what happened when an anomaly appeared. The NIST CSF 2.0 Reference Tool links DE.CM-02 to SP 800-53 controls in the CA-7 and PE family, and to ISO/IEC 27001:2022 Annex A control 7.4, so a single set of physical monitoring records can often serve several frameworks. Confirm those mappings against the current Reference Tool export before relying on them in a customer answer.
Which physical systems, sites and teams fall under DE.CM-02
DE.CM-02 applies wherever the organization relies on physical controls to keep systems and data safe, including sites it owns, rents or shares with others. The decisions below determine which logs, alarms and records must be monitored, and who must review them.
Data centers and server rooms
Server rooms and data halls hold the systems whose compromise would matter most, so they are usually the first scope decision. Confirm which access points exist, including cages, racks, cooling plant and the doors that lead to them. For each, check that badge or key logs are retained, that door-open and door-forced alarms reach a staffed function, and that someone reviews failed entries. Document who owns each log source.
Offices and shared floors
Offices matter for DE.CM-02 because unattended workstations, network closets and printers often sit outside the data center perimeter. Scope the badge system, visitor sign-in, camera coverage of entrances and any after-hours alarm arming. Note floors shared with other tenants, where the organization may not control the alarm or camera system and must rely on contractual reporting.
Branch and remote sites
Branch offices, retail locations and field sites often have the weakest physical monitoring because they have no local security staff. Inventory each site with network equipment, cabinets or devices that matter, and decide whether alarm events are forwarded centrally. Check whether tamper signals from locks, cabinets and alarm panels are visible to the team that reviews them, and who responds when a site is unreachable.
Colocation and hosting providers
When systems sit in a colocation facility, the provider controls most of the physical environment. The organization still needs to know which access records, camera footage and alarm events the provider will share, how quickly, and in what format. Ask for these terms in the contract, and confirm that the provider's monitoring covers the organization's cage or suite. Record the provider as an external party in the scope.
Owned versus outsourced systems
For each system, record whether the organization or a third party owns the badge platform, cameras, alarm panels and guard services. Owned systems put log retention and review under internal control. Outsourced systems require contracted access to raw logs, alert notifications and incident reports, plus a named owner who checks them. A single unassigned system is a common gap in assessor reviews.
Teams whose records count
Facilities, security, reception, and HR each hold records relevant to physical monitoring. Facilities manages locks, alarms and maintenance visits, security reviews badge and camera data, reception keeps visitor logs, and HR supplies joiner and leaver dates that drive badge revocation. Third-party guard and building operators produce patrol and incident records. Agree who reviews each record, how often, and where the evidence is kept.
How an assessor tests physical environment monitoring
This table walks through the steps an assessor typically takes to test DE.CM-02, with the evidence each step relies on and the findings that come up most often. Read each row as a test the organization should be able to pass with records it already keeps. The main takeaway is that a monitoring control counts only if someone reviews the output and acts on it.
| Test step | What the assessor checks | Evidence that passes | Common finding |
|---|---|---|---|
| Badge reader logs | Samples access events for sensitive areas and looks for unusual patterns, such as off-hours entry or repeated failed attempts | Exported badge logs for a sample period, with documented review and follow-up on flagged events | Logs exist but no one reviews them, so failed attempts go unexplained |
| Visitor records against access | Matches visitor sign-in records to the access granted and the escort or host assigned | Visitor log entries that align with badge issuance and access events for the same dates | Visitor logs are incomplete, or visitors hold badges that were never recorded |
| Tamper checks on locks and alarms | Confirms that locks, door sensors and alarm panels are inspected for tampering and that faults are recorded | Inspection records, alarm test logs and tickets for any tamper or fault events | Alarm faults are silenced or dismissed without a documented cause |
| Camera and guard coverage | Checks that cameras and guards cover sensitive areas, entry points and blind spots identified in the risk assessment | Coverage maps, camera retention settings and guard post or patrol records | Coverage maps are outdated, or cameras are offline with no alert |
| Alert review | Confirms that physical security alerts reach a named owner and are reviewed within the timeframe the organization set | Alert queue history, review sign-offs and incident tickets linked to physical events | Alerts route to a mailbox or dashboard that nobody checks |
| Cross-reference to SP 800-53 Rev. 5.2.0 | Compares the physical monitoring design with CA-7 (continuous monitoring), PE-3 (physical access control), PE-6 (monitoring physical access) and PE-20 (asset monitoring and tracking) | A mapping that ties each control to the organization's own procedures and evidence, which the reader can verify in the NIST CSF 2.0 Reference Tool | Mappings are cited without showing where the organization's own procedure satisfies each control |
| Cross-reference to ISO/IEC 27001:2022 Annex A 7.4 | Checks whether the physical security monitoring design also addresses this Annex A control on monitoring physical premises | Evidence the organization maps Annex A 7.4 to the same logs, reviews and records used for DE.CM-02 | Teams treat the ISO mapping as a separate program with duplicate, unlinked evidence |
| Review cadence and ownership | Confirms that someone is named to review logs and alerts, and that reviews happen on a recorded schedule | Named roles in a procedure, review calendars and sign-off records over the audit period | Reviews happen informally, so no evidence exists for the period tested |
How to implement physical monitoring in six steps
The sequence turns DE.CM-02 from a list of physical safeguards into a monitored, reviewed and evidenced routine that shows adverse physical events are being detected and acted on.
Inventory sensitive physical areas and their controls
The facilities or security lead lists every area that holds systems, cabling, media or regulated data, such as server rooms, network closets, backup storage and records rooms. For each area, record the entry points, the access control device (badge reader, keypad or key), any alarm sensors, cameras and the guard coverage. The step is done when every sensitive area has a row in the inventory with a named owner and no entry point is unaccounted for. This inventory also defines the scope an assessor will sample from.
Connect badge and alarm logs to a central record
The security engineering team forwards badge reader events, door and alarm states, and camera system alerts into one log store that the organization controls, ideally the same platform used for other security logging. Time sources must match across devices so events can be correlated with network and identity logs. Confirm with each device vendor which events are exported, how they are timestamped and whether logs can be retained for the period your policy sets. The step is complete when a test badge swipe and a test door alarm both appear in the central record within the expected window.
Define unusual patterns and failed-attempt thresholds
The security team and the area owners agree on what counts as unusual for each area: access outside business hours, repeated failed badge reads, badge use at several doors in a short period, access by a credential that has been deactivated, or door-held or forced-open alarms. Write each rule with a threshold, the alert destination and the response expected. These rules should be reviewed against the asset inventory so that high-risk areas get tighter rules. The step is done when the rule set is approved and each rule has a documented test that fires it.
Set visitor record and tamper check routines
Facilities staff define how visitors are signed in, escorted and signed out, and what details are captured for each visit. They also schedule physical checks of locks, door contacts, alarm sensors and camera housings, and record the result of each check, including who performed it and any tamper indicators found. Reception and facilities leads confirm the routine with the people who perform it, so the procedure reflects how work is actually done. The step is complete when a blank visitor log template, a tamper check checklist and the first completed check record exist and are stored in the evidence location.
Assign alert review ownership and escalation
The security operations lead names who reviews physical alerts during each shift or business day, who covers absences, and who is paged for high-severity events such as forced entry. The review owner records triage decisions, closes benign alerts with a reason, and opens an incident for suspicious activity through the organization's incident process. Ownership should be written into the monitoring procedure and tested with at least one simulated alert. The step is done when a simulated alert is triaged, escalated and closed by the named people, with the record kept.
Retain evidence of reviews and test the cycle
The compliance lead sets the retention rules for badge logs, visitor records, tamper check records, alert triage notes and escalation tickets, and confirms that the storage meets the organization's policy and any contractual or regulatory obligations. The team then samples a set of past reviews to confirm each one shows who reviewed, when, what was found and what was done. Ask the independent assessor which samples and periods they expect. The step is complete when a sampled review trail can be reconstructed end to end from the stored records without relying on memory.
How the monitoring pieces connect
DE.CM-02 is only met when a physical event becomes a record that someone is responsible for reading. The chain usually starts with a badge swipe at a reader, a door contact reporting open or closed, an alarm panel changing state, a camera feed, a guard round, or a visitor signing in at reception. Each of these produces data in a different system: an access control platform, an alarm monitoring service, a video management system, a guard tour application, or a paper or electronic visitor log. The first design decision is to decide which of these sources feed one place, typically a SIEM or a ticketing queue, and which stay local with a documented review routine. Map each source to its owner, its export method and the time it takes to reach the review point. Confirm with the vendors of your access control and video systems which events they can forward and in what format, because the answer determines whether the flow is automated or manual.
The NIST Implementation Examples for DE.CM-02 point at two outcomes: spotting unusual patterns, such as repeated failed badge attempts, access outside schedule or a door held open, and spotting tampering with locks and alarms. Neither is achieved by collecting logs alone. A useful design defines the conditions that raise an alert, sets who receives it, and records what was done with it. Visitor records and guard round logs deserve the same treatment, because a gap in the rounds or an unlogged visitor is itself a finding. Ask the physical security owner to write down which patterns they review, how often, and what closes a ticket, then test one scenario end to end, such as a door sensor tamper event, to confirm the alert reaches a person.
Retention and reviewability are where many programs fail an assessment. Records must survive long enough to show what happened in a past period, must be protected from alteration, and must be retrievable with their timestamps intact. Check the retention setting in each source and confirm that clock sources are synchronized across the access control, alarm and video systems so events can be correlated. Where logs are forwarded to a self-hosted platform, the same questions apply to that platform. For example, Nextcloud's admin_audit app writes additional event information to audit.log in the data directory unless a different path is set with logfile_audit, so that path and its access permissions belong on the physical-to-digital checklist if a Nextcloud instance is used to hold visitor or access documents. Keep evidence of each review, including who reviewed it and the outcome, because the reviewer's record is what an assessor will ask to see.
Which records prove DE.CM-02 to an assessor
An assessor testing DE.CM-02 looks for records that show the physical environment is watched and that someone reviews what the watching finds. The cards below cover the artifacts most often requested, from access logs and visitor records to camera settings and alert tickets. Each one only counts if it is dated, reviewed and tied to a named owner.
Badge reader log exports
Exports from the access control system covering doors to server rooms, data centers and sensitive areas, with the review period stated. The reviewer should sign and date each export and note any failed attempts or unusual patterns they examined, such as repeated denials at one door or access outside normal hours. Ask whether the export shows who reviewed it and what follow-up was opened. A log that nobody reviewed shows monitoring only on paper.
Visitor logs and escort records
Sign-in sheets or digital visitor records that capture name, organization, host, purpose, badge issued and time in and out. An assessor will compare these against badge data and CCTV timestamps to see whether a visitor was ever unaccompanied in a restricted area. Keep a periodic review of visitor entries with a sign-off, and record any visitor who entered without an escort or without a logged exit.
Tamper check records for locks and alarms
Dated checklists showing that locks, door contacts, alarm panels and sensors were physically inspected for tampering, forced entry or bypass. Record the inspector, the device identifiers checked and any seal or tamper indicator that changed. Alarm test results, such as a logged test activation and the alert it produced, add weight because they show the alarm reaches someone who responds.
Camera retention settings and footage access
A written retention configuration for each camera group, the storage location, and the access list for viewing or exporting footage. Keep a log of who pulled footage, when, and for which event, since an assessor may ask for a sample of that log. Confirm that retention periods in the configuration match the policy the organization has approved, and that footage access is limited to named roles.
Guard patrol logs
Patrol records with the route, the checkpoints scanned or visited, the time of each round and any anomalies reported. Where guards are contracted, the evidence should come from the provider's system or a signed report that the organization reviews, and the contract should require delivery of these records. Gaps in patrol times are the usual finding, so the review should note missed rounds and their follow-up.
Alert tickets showing triage
Tickets raised from physical alarms, door-forced events, badge anomalies or camera motion alerts, each showing acknowledgment, triage decision, escalation and closure. This card is the link between the other records and the outcome DE.CM-02 describes, because it proves an adverse event was noticed and handled. Check that every ticket has a timestamp, an owner and a closure reason, and that the sample an assessor selects can be traced back to the source log.
What meeting DE.CM-02 costs in money and effort
This table breaks down who is paid for each part of physical environment monitoring, whether the cost is one-time or recurring, and what pushes it up or down. No prices are published here because none were supplied, so use the table to structure a quote request and to decide which parts to keep in house. Read the recurring rows first, since they usually matter more over the life of the program.
| Cost component | Who is paid | One-time or recurring | What drives the cost |
|---|---|---|---|
| Badge readers, locks and alarm sensors | Hardware vendor or installer | One-time, with replacement and maintenance cycles | Number of doors and zones, and whether tamper sensors are included in the hardware |
| Camera hardware and video licenses | Camera vendor, installer or video management software vendor | Hardware one-time, licenses often recurring | Camera count, coverage of entry points, and whether the video platform is commercial or open source |
| Log centralization and integration | Implementation partner or internal engineers | One-time build, then recurring upkeep | Number of access control systems, format differences between vendors, and whether logs feed a central SIEM or audit store |
| Log retention storage | Internal infrastructure team or cloud provider | Recurring | Retention period set by policy, site count, and video or image storage volume |
| Security staff review time | Internal security or facilities staff | Recurring | Frequency of reviews, number of sites, and how many alerts require follow-up |
| Tamper check labor | Facilities staff, guard contractor or security team | Recurring | Number of locks, alarms and cameras checked, and how often checks are scheduled |
| Guard service fees, if outsourced | Contracted guard firm | Recurring, usually billed by coverage hours | Hours of coverage, number of sites, and response requirements in the contract |
| Auditor sampling and evidence requests | Independent auditor or assessor | Recurring with each assessment cycle | Number of sites in scope, sample sizes the assessor selects, and how well logs are already indexed |
Who owns DE.CM-02 and who can help
Your organization owns DE.CM-02. The outcome, that the physical environment is monitored for potentially adverse events, is a management responsibility, and no partner or auditor can accept that ownership on your behalf. Your team decides which access points, rooms and assets fall in scope, who reviews badge reader and visitor logs, how quickly alarms and tamper signals are triaged, and who signs off the records that show this happened.
- Scope and accountability: Name an accountable owner for physical monitoring, usually with facilities or site security, and record which sites, doors, cameras and alarm zones are covered.
- Routine review: Assign people to review badge reader logs for unusual patterns and failed attempts, and to reconcile visitor records against escorts and access grants.
- Alarm and tamper response: Define who acts on lock, alarm and camera faults, and keep the tickets that show each event was handled.
- Sign-off: Have a named reviewer approve periodic review records, so the evidence reflects a human decision and not only a system export.
- Vendor oversight: If a guard or alarm company operates part of the monitoring, keep the contract and its reporting under your control.
Before any engagement, confirm that your team can name the owner, the reviewers and the retention period for each record type.
An implementation partner helps build the systems and evidence that DE.CM-02 depends on. DeployOpen, for example, plans and implements self-hosted open-source platforms inside a client's own infrastructure and prepares the controls and evidence for compliance assessments. A partner does not issue audit reports, attestations or certifications, and it should not set the control design on your behalf without your sign-off.
- Log integration: Connect access, camera and alarm logs to a central, self-hosted store so that review workflows have a single record to work from.
- Review workflows: Build the review queues, escalation paths and ticket templates that your reviewers use, and document how each step is performed.
- Evidence packs: Assemble samples of review records, tamper check results and visitor logs in a form an assessor can trace back to source systems.
- Documentation: Write operating procedures and configuration records for the monitoring stack, including retention settings and access controls on the logs themselves.
- Handover: Train your staff to run the workflows and keep the evidence current after the engagement ends.
In a fixed-scope engagement, confirm in writing which of these items are delivered, who owns the resulting configuration, and what the partner will not do.
An independent auditor, assessor or certification body tests whether DE.CM-02 operates as described and issues any report or certificate. Its independence is the reason its conclusions carry weight, so it cannot design the controls it tests or prepare the evidence it samples as a function of its own opinion. The auditor's work depends on records that already exist when it arrives.
- Sample testing: The auditor selects periods, doors or events and checks that reviews were performed, signed and followed up.
- Traceability: It checks whether evidence can be traced from a review record back to the original log, with timestamps and a clear chain of custody.
- Design and operation: It evaluates whether monitoring is designed to catch the events the outcome describes, then tests whether it worked during the period.
- Limits on the partner: A partner who prepared the evidence can explain it, but the auditor must form its own view of the samples.
- Report ownership: Only the auditor issues the opinion or report, and the report belongs to your organization.
Before engaging an auditor, ask which framework and criteria it will apply, how it selects samples, and whether it has any relationship with the partner that could affect independence.
Where physical monitoring usually falls short
DE.CM-02 asks whether the physical environment is watched for adverse events, and assessors look for evidence that someone reviews what is recorded. The gaps below are the ones that most often separate a site with access hardware from a site that can show monitoring. Each card names a closure step that an organization can own and evidence.
Access logs collected but never reviewed
Badge reader and door controller logs are often retained but no one looks at them until an incident. DE.CM-02 expects monitoring for unusual patterns and failed attempts, so the gap is the missing review. Closure: define a recurring review of badge events, such as repeated failures, after-hours entries and access to server rooms, with a named reviewer and a record of each review and the follow-up taken.
Visitor records disconnected from access
Visitor logs kept on paper or in a front-desk spreadsheet rarely match the badges and doors that visitors actually used. Without that link, an assessor cannot confirm who was on site or where they went. Closure: issue time-limited visitor credentials tied to a named host, require escort in controlled areas, and reconcile the visitor log against badge events each week.
Tamper checks left undocumented
Facilities teams often inspect locks, alarm contacts and enclosures informally, so the checks happen but leave no trace. DE.CM-02 covers checking locks and alarms for tampering, and the evidence is the check itself. Closure: write a short inspection checklist for each secured area, assign its owner and frequency, and keep signed or timestamped records with photos of any defect and the repair ticket.
Camera gaps at entrances and server rooms
Camera coverage tends to reflect when a site was built, not where risk now sits, so entrances added later or rear doors may have no view. Blind spots at server room doors weaken any attempt to correlate access events with video. Closure: map every entrance, loading dock and controlled room against camera fields of view, close the gaps or document compensating guard checks, and test that recordings are retrievable.
Guard and vendor records outside scope
Security guards, reception contractors and facilities vendors often keep their own logs, and those logs sit outside the organization's monitoring. Assessors may ask for them because guards are part of the alarm and camera response. Closure: write guard post orders and logging requirements into the contract, require copies of shift and patrol logs to the organization on a set schedule, and include vendor-run sites in the assessment boundary.
Common questions about DE.CM-02 cost, time and effort
How much does it cost to meet DE.CM-02 physical environment monitoring?
No supplied figure sets a price for DE.CM-02, and the cost depends on your site footprint and existing systems. The main components are the monitoring tools you already own or buy (access control logs, camera recording, alarm and lock status feeds), the people who review logs and investigate exceptions, and the time spent documenting the monitoring process. Costs recur through log review, retention storage and periodic testing of alarms and locks, while setup is largely one-time. Costs rise with the number of sites, the number of doors and cameras, and how much of the physical estate is already instrumented. Ask any partner for a fixed-scope quote that lists each system in scope, each deliverable and who performs each recurring task.
How long does DE.CM-02 work take when a company has many sites?
Duration grows with the number of sites, but no supplied fact gives a timeline, so treat any figure you hear as a question to confirm. A single office with an existing badge system is usually simpler than a multi-site estate with mixed access control vendors, separate camera networks and local guard contracts. Time is driven by how many systems produce logs, whether those logs already reach a central store, and how many facilities teams must be consulted. Ask for the schedule to be split by site, with a separate line for each system integration and for the evidence review at the end.
Can our own team implement DE.CM-02 without outside help?
Yes, many organizations do this in-house, provided the team has access to the physical security systems and the authority to change how logs are kept. The work needs someone who understands badge reader logs, visitor records and alarm tamper signals, and someone who can route those events into a review process with named owners. Outside help is most useful when logs from several vendors must be normalized, when no one owns the physical security stack, or when evidence must be assembled for an assessor. An implementation partner prepares systems and evidence, but the organization still owns the controls and the review decisions.
What do facilities and HR need to provide for DE.CM-02?
Facilities owns the physical controls, so it must confirm door, lock, alarm and camera inventories, explain the guard coverage model and provide maintenance and tamper-check records. HR must supply joiner, mover and leaver events so that badge access can be matched to current employment status, and it should confirm how visitor sponsorship works. Both teams need to agree on who reviews unusual badge patterns, failed attempts and alarm events, and how quickly exceptions are escalated to security. Without this agreement, logs exist but nobody can show that monitoring took place.
Does NIST certify that we meet DE.CM-02 or the CSF 2.0 Core?
No. NIST states that it does not offer certifications or endorsements of CSF-related products, implementations or services and has no plans for a conformity assessment program. Alignment with DE.CM-02 is therefore either a self-assessment that you document and own, or an independent assessment performed by a qualified assessor you hire. Any organization offering a NIST CSF certificate should be treated with caution, and you should ask who would issue it and what standing it has with your customers. Where a contract requires proof, agree with the requesting party in advance what kind of evidence they will accept.
What should we ask a partner to include in a DE.CM-02 quote?
Ask for a written, fixed scope that names the facilities, access control systems, camera platforms, alarm and lock sources and guard arrangements in scope. The quote should list each deliverable, such as log routing, review procedures, evidence packs and a test of tamper alerts, and state which items the client must provide. Request a split between one-time setup work and recurring tasks such as log review support or periodic testing. Confirm who issues any assessment report, which is the independent auditor or assessor and not the implementation partner, and ask how changes in scope are priced.
Which DE.CM-02 monitoring logs can a self-hosted platform help evidence?
Self-hosted platforms can keep audit trails of administrative actions, which helps show that the systems behind physical monitoring are themselves watched. For example, an illustrative Nextcloud deployment can write extra event information from the admin_audit app to audit.log in its data directory, or to a path set with logfile_audit. Physical access systems themselves, such as badge readers and camera recorders, are usually vendor products, so confirm their log export options before scoping. Keep retention and access to these logs documented, because an assessor will ask how long records exist and who can change them.
How DeployOpen prepares DE.CM-02 evidence
DeployOpen works on DE.CM-02 Physical environment monitoring as a fixed-scope implementation inside the client's own infrastructure. The organization keeps ownership of its physical controls and monitoring decisions, while DeployOpen prepares the logging, records and documentation that show the monitoring operates.
How we scope
- Agree in writing which physical access logs, visitor records and alarm sources are in scope.
- Map each source to the DE.CM-02 outcome and to the evidence an assessor would request.
- Confirm which parts remain with the client, such as guard operations and facility vendors.
How we build
- Configure self-hosted platforms to ingest badge reader and access control events where the client's systems can export them.
- Set up alerting rules for repeated failed badge attempts and out-of-hours door activity, reviewed against the client's baseline.
- Protect collected records with access restrictions, retention settings and integrity controls appropriate to the client's policy.
How we hand over
- Deliver a written description of each monitored source, its owner, review frequency and escalation path.
- Provide sample log extracts and alert records that show the monitoring running as designed.
- Document known gaps, such as sources that cannot be integrated, so the client can address them before assessment.
How we support
- Offer ongoing support and upgrades as a retainer after handover, if the client wants them.
- Re-test alert rules and log ingestion after changes to access control or facility systems.
- Provide an independent auditor or assessor with the evidence pack, while they alone issue any report or opinion.
