What PR.AA-06 requires for physical access under NIST CSF 2.0
If an audit, a customer questionnaire or a CSF adoption project now asks how physical access is controlled, the answer should show that physical access to assets is managed, monitored and enforced in proportion to risk. That is the outcome PR.AA-06 describes in NIST CSF 2.0, a Subcategory of the Identity Management, Authentication, and Access Control Category in the Protect Function. The risk being addressed is unauthorized or unlogged entry to places where assets sit, such as server rooms, network closets, data centers, labs, records storage and production floors. Logical access under PR.AA-01 to PR.AA-05 governs who can authenticate to systems and what they can do once inside. PR.AA-06 covers the doors, rooms and people that come before any login, so a strong identity program can still be undermined by a badge that opens the wrong room or a visitor who walks past the reception desk.
This is hard for predictable reasons. Facilities teams usually own locks, guards, cameras and alarm monitoring, while IT owns the systems the badges and logs feed into, so nobody holds the whole picture. Legacy badge systems may not export logs in a form that security tools can read, and access revocation for departing staff can depend on a manual step that is easy to miss. Visitors and contractors are often signed in on paper or not logged at all. Before writing any control, confirm with the facilities owner which areas exist, which hold high-risk assets, who can grant physical access and where each access event is recorded. A useful first check is to sample five or ten recent visitor records and see whether the escort, purpose and times can be traced.
NIST publishes three Implementation Examples for PR.AA-06: using guards, cameras, locked entrances and alarms; adding controls for areas with high-risk assets; and escorting guests, vendors and other third parties in business-critical areas. Treat these as illustrations of the outcome, not as pass criteria. An assessor will ask whether your controls match the risk your organization has identified, and the answer depends on your own asset inventory and risk decisions. Informative references such as the SP 800-53 physical and environmental controls and the ISO/IEC 27001 physical control entries listed in NIST's Reference Tool can help you find evidence, but confirm the mappings against the current versions you are assessed against before relying on them.
Which facilities, assets, people and vendors fall under PR.AA-06
PR.AA-06 applies wherever physical access to assets matters, so scoping starts with an inventory of places and the assets inside them. The cards below cover the facility types, shared and outsourced locations, and third parties that change how much control work an organization owns.
Data centers and server rooms
These are the most direct PR.AA-06 scope items because they hold the systems whose loss or tampering is most costly. Record every room that houses servers, storage, backup media or security appliances, including rooms that are not labeled as data centers. Check who holds keys or badges, whether cameras cover entrances, and whether an alarm reaches a staffed point. Each room should have a named owner for its access list.
Offices holding sensitive equipment
General office space becomes in scope when it holds laptops with sensitive data, printers that retain images, or workstations used for privileged work. Scope these by asset, not by floor, so a single finance team's room is not missed. Confirm that after-hours entry is logged and that shared areas do not give unescorted access to restricted equipment.
Network closets and cabling rooms
Network closets are easy to overlook because they are small, yet they house switches, patch panels and the cabling that carries traffic between systems. Tampering here can silently reroute or intercept data. List every closet, its lock type and who holds keys, and check whether the closet is inside a space that is already controlled. Unlocked closets in shared corridors are a common gap to verify.
Labs, OT and industrial areas
Research labs, test benches and operational technology areas often have physical hazards and devices that cannot be patched on the normal schedule. Access rules may need to differ here, for example by requiring a second person for changes to controllers. Confirm with the operations team which devices are safety-relevant before setting controls, because some alarms and locks may interact with physical safety systems.
Shared buildings and colocation sites
When the organization shares a building or rents space in a colocation facility, the landlord or provider often controls the perimeter, guards and cameras. The organization still needs to define which of those controls it relies on and how it verifies them. Ask the provider for its physical access policy, visitor logging approach and audit reports that cover its facilities, and record the division of responsibility in writing.
Visitors, contractors and vendors
Third parties are in scope because they enter areas the organization controls, even when they are not employees. Illustrative example: a cleaning contractor who enters a server room after hours without an escort has created a PR.AA-06 gap regardless of the contract terms. The organization owns the escort and access rules for areas it controls, so vendor agreements should reference those rules and the sign-in records should be retained.
How an assessor tests physical access controls
This table lists the main assessor test steps for PR.AA-06, the evidence each step asks for and the findings that usually come up. Read each row as a question the assessor will put to your facility records and staff, and prepare the matching artifact before fieldwork starts.
| Test step | What the assessor checks | Evidence requested | Common finding |
|---|---|---|---|
| Policy and risk classification | Whether physical access rules exist and whether areas are classified by the risk of the assets they hold | Physical access policy, area classification register, date of last review | Policy exists but no area is classified, so access levels cannot be tied to risk |
| Facility walkthrough | Whether locks, entrances, guards and restricted rooms match the documented classification | Floor plans marked with access zones, a walkthrough checklist signed by the assessor | Restricted server or records room opens to the general office zone |
| Badge and key holder sampling | Whether sampled holders have a current business need and an approved access level | Badge or key holder list, sample selection record, approval tickets | Former staff or contractors still hold active badges or physical keys |
| HR and contractor reconciliation | Whether the access list matches current employment and contract records | HR roster extract, contractor end dates, vendor access list | Contract ended months earlier, but the vendor badge remains valid |
| Camera and alarm review | Whether cameras and alarms cover sensitive entrances and whether retention and alert handling are configured | Camera placement map, retention settings, alarm event log, response procedure | Camera covers the lobby but not the rear entrance to the high-risk room |
| High-risk area controls | Whether rooms holding critical assets have controls added beyond the general perimeter | Added control list (such as dual authorization or mantrap), access logs for those rooms | High-risk room has the same single badge reader as the open office |
| Visitor and escort records | Whether visitors are logged, badged, identified and escorted in business-critical areas | Visitor log for a sampled period, escort assignment records, visitor badge issue record | Visitor log is incomplete, with no sign-out time or escort name |
| Access removal after exit | Whether physical access is revoked promptly when employment or contract ends | Offboarding checklist, revocation timestamps, returned badge and key records | Revocation is recorded as done, but the badge system shows it still active |
| Log and monitoring review | Whether access events are retained, reviewed and tied to investigations | Badge event export, review sign-off, sample of investigated exceptions | Access events are collected but nobody reviews them, so anomalies go unnoticed |
How to implement physical access control in proportion to risk
This sequence turns PR.AA-06 from a general intent into a working physical access program: areas are ranked by risk, each zone gets its own access rules, controls are matched to those rules, visitors are escorted by documented procedure, and logs are reviewed on a schedule that someone owns.
Classify physical areas and assets by risk
Start by listing the facility locations that hold or process your assets, including offices, data rooms, network closets, loading docks, labs and any third-party colocation space. Facilities, security and IT owners should rate each area by the value and sensitivity of what sits there and by what an unauthorized presence would mean for operations or data. The output is a zone register: one row per area with its owner, the assets it holds and a risk rating. Confirm the register with the risk owner before you design any controls, because every later decision depends on it.
Define access rules for each zone
For each zone in the register, write who may enter, under what conditions, at what hours and with which approval. Rules should follow from the risk rating, so a public lobby and a server room should not share the same entry criteria. Facilities and the system owner sign off on the rules. The output is an access matrix that maps zones to roles, approval paths and entry conditions, and it becomes the reference that badge provisioning and audits both check against.
Set up or review locks, badges, guards, cameras and alarms
Compare the physical controls in place against the access matrix. Check that entrances can be locked and that doors close and latch, that badges are issued from a controlled process and can be revoked, that cameras cover entries and sensitive corridors, and that alarms reach people who will respond. Guards are useful where the zone rating calls for a live response. Record each gap as a finding with an owner. The output is a control inventory tied to zones, and confirming that each control works as described is the check that closes this step.
Add controls for high-risk areas
Areas rated highest need controls beyond the standard set, such as stronger entry verification, two-person entry, mantrap or interlocked doors, tighter camera retention or restricted hours. Choosing these controls is a risk decision, so the risk owner should document why each one is proportionate and what residual risk remains. Ask any physical security contractor to state which controls they provide and which remain your responsibility. The output is a documented list of added controls per high-risk zone, with the residual risk accepted by name.
Write visitor and third-party escort procedures
Define how guests, vendors, contractors and other third parties sign in, how their identity is checked, what badge they receive, which business-critical areas they may enter and who must escort them. NIST's implementation examples for PR.AA-06 name escorting guests and third parties in business-critical areas, so the escort rule should be written down and not left to habit. Train reception and the escorts on the procedure. The output is a visitor and third-party procedure with a sign-in record template and a named escort responsibility for each area.
Connect access logs to review
Access events from badge readers, door controllers and camera systems only protect you if someone reads them. Decide which events are logged, where they are stored, who can view them and how long they are kept, and confirm that the logs cannot be edited by the people whose access they record. Set alerts for events that break the access matrix, such as denied entries in high-risk zones or entries outside approved hours. The output is a log source list, a retention setting, and a named reviewer with a defined review routine.
Run periodic access reviews
Physical access drifts as people change roles, leave or take on temporary work. Compare current badge holders and visitor approvals against the access matrix, remove access that no longer fits, and check that revoked badges were actually deactivated. Record the review date, the reviewer, the exceptions found and the corrective action. Ask your auditor or assessor which review frequency they expect for your risk level, since the framework does not set one. The output is a signed review record for each cycle, which is the evidence an assessor will request first.
How physical access evidence connects to logical access records
PR.AA-06 sits beside the identity and access subcategories because a badge is an identity credential too. The same joiner, mover and leaver records that drive account creation and removal for systems should govern who holds a badge, which doors it opens and when it is revoked. If an employee leaves and their directory account is disabled on the last day but their badge still opens a server room for another two weeks, the organization has a gap that an assessor will read as a failure of access management, not of facilities. Ask the people who run physical security and the people who run identity to name one authoritative source for personnel status, and confirm that badge provisioning and deprovisioning are triggered from it. Contractors, vendors and visitors need the same treatment, with defined end dates tied to their engagement records.
Physical logs deserve the same review discipline as system logs. Door controller events, badge reads, alarm arms and disarms, and camera recordings are evidence only if someone reviews them at a defined frequency, investigates exceptions and keeps a record of that review. An assessor will typically ask for a sample of access events, the reviewer's sign-off, and proof that unusual patterns, such as badge use outside rostered hours or repeated failed reads at a high-risk area, were escalated. Confirm with your facilities team which events the access control system records, how long those records are kept, and who holds the administrator role that can edit badge permissions. That role should be as tightly controlled as privileged system administration.
Three technical questions come up repeatedly. First, time synchronization: door controllers, cameras and the identity platform must share a trusted time source, or timestamps cannot be correlated during an investigation. Check the clock source and drift on each controller and record the result. Second, retention: the period for which badge and camera records are kept should be set in policy, justified by the organization's own legal and investigative needs, and applied consistently across sites. Confirm the retention setting in each system rather than assuming a default. Third, tamper resistance: logs and configuration changes should be protected against silent alteration, for example by forwarding events to a central store that facilities staff cannot edit, and by alerting when logging is disabled. Independent auditors and certification bodies decide whether this evidence is sufficient for the framework you are assessed against.
Evidence that satisfies PR.AA-06 and how to keep it current
An assessor testing PR.AA-06 looks for a chain of records: the policy that sets the rule, the risk view that sets the strictness, and the logs and reviews that show the rule was applied. Each artifact below should be dated, owned and refreshed on a schedule so the evidence still matches the building when an assessment begins.
Physical access policy and zone standards
The written rule set that says who may enter each area, under what conditions and with which controls. Assessors compare it against what happens at the door, so it must name the zones, the approval authority for each and the escort rules for visitors and vendors. Review it on a fixed cycle and after any site change, such as a new tenant, a new data hall or a relocated server room. Record the version, approver and date on every revision. Confirm with your own facilities and security teams which review interval your policy sets.
Zone and asset risk register
The record that ties each physical area to the assets inside it and to the risk that justifies its controls. This is what makes the controls *proportionate*, the word the outcome turns on. Include server rooms, network closets, records storage, labs and high-risk equipment, with a rating for each and the reason for it. Update it when assets move or when a risk assessment changes the rating, and keep prior versions so you can show why a control was added or removed.
Access matrix and approval records
A matrix that lists which roles, contractors and groups hold access to which zones, plus the approval trail behind each grant. It is the document an assessor uses to sample a person and then check whether that person's access matches the matrix. Generate it from the badge or access control system where possible, and reconcile it against HR and contractor rosters monthly. Flag any grant that has no named approver or no expiry date for contractors.
Badge and key issuance logs
Records of every credential issued, changed, lost, returned or revoked, including physical keys and key cabinets. Assessors check that issuance followed identity verification and that terminated personnel lost access on time. Keep the issuing operator, the date, the zones granted and the return or deactivation date. Export these logs on a regular schedule so the trail survives system upgrades, and check that revoked credentials stop working in the access control system.
Periodic access review sign-offs
Signed reviews in which a zone owner confirms that each listed person still needs each listed area. Auditors look for the reviewer's name, the population reviewed, the decisions made and the removals carried out afterward. A review that approves everything without evidence of checking is weak evidence, so record the changes made. Confirm the review frequency your risk register supports for high-risk zones, which is usually shorter than for general offices.
Visitor, escort and camera records
Visitor sign-in logs with identity checks, escort assignments and the camera and alarm configuration that monitors them. Include camera placement drawings, the retention period set for footage, alarm event logs and the test records showing alarms reach a responder. Check that retention settings match what the policy promises, and export a sample of footage metadata and alarm logs during each review so the proof exists outside the vendor console. Ask your provider which retention defaults apply and whether they can be changed per zone.
Physical incident and change records
Incident tickets for tailgating, forced entry, lost credentials and alarm failures, with root cause and corrective action, plus change records for lock replacements, reader firmware updates and badge system configuration changes. Assessors use these to test whether the controls learn from failure and whether changes were approved before they took effect. Link each incident to the risk register entry it affected, and close each change ticket only after the test evidence is attached.
What meeting PR.AA-06 costs in money and effort
This table breaks the cost of meeting PR.AA-06 into its components, showing who is paid for each, whether the cost is one-time or recurring, and what pushes it up or down. Read it as a checklist for building a quote, since most of the spend sits in hardware, staffing and evidence upkeep rather than software licenses.
| Cost component | One-time or recurring | Who is paid | Main cost drivers |
|---|---|---|---|
| Physical security hardware (locks, readers, cameras, alarm sensors) | One-time for installation, recurring for replacement and maintenance | Hardware vendor, installer or electrical contractor | Number of facilities, doors and zones, and the cabling needed in existing buildings |
| Access control licenses or hosted fees | Recurring, usually per door, reader or user | Commercial access control vendor or hosting provider | Facility count and user volume. Self-hosted open-source access tooling can remove this license line but not the hardware |
| Monitoring and guard services | Recurring | Contracted guard company or monitoring center | Hours of coverage, number of high-risk rooms and visitor volume requiring staffed reception |
| Engineering and facilities time | One-time for design and integration, recurring for changes | Internal security, IT and facilities staff, or an implementation partner | Integration with identity systems, badge provisioning workflows and the number of sites involved |
| Extra controls for high-risk areas | One-time for build-out, recurring for inspection and maintenance | Construction contractor, vendor and internal staff | Number of rooms holding business-critical assets and the controls each one requires |
| Visitor and escort procedures | Recurring | Internal staff or contracted reception staff | Visitor volume, vendor traffic and how many escorts are needed in critical areas |
| Evidence upkeep (access logs, reviews, records) | Recurring | Internal compliance staff or an implementation partner preparing evidence | Log retention periods, frequency of access reviews and number of sites to sample |
| External review or penetration testing of physical controls | Recurring, usually periodic | Independent physical security tester | Scope of facilities tested and whether social engineering and tailgating tests are included |
| Auditor sampling time | Recurring at each assessment cycle | Independent auditor or assessor | Number of sites in scope, sample size and the quality of evidence on hand. Auditors issue reports, not the implementation partner |
Where open-source tools help and where they do not
Most of what PR.AA-06 asks for sits outside software. Guards, locked entrances, cameras, alarms, visitor escorts and extra controls around high-risk areas are physical and procedural measures, and an assessor will test them by walking the facility, inspecting hardware and reviewing how staff actually behave. A self-hosted open-source platform can support parts of the evidence, but it cannot replace the door, the lock or the guard post. Treat any tool that claims to *manage* physical security as a record-keeping aid, and confirm its capabilities before you rely on it.
Where open-source software does help is in the records that show the controls operate. Visitor registration logs, badge issuance and revocation records, access review workflows, and centralized logs from door controllers or camera systems can all be captured and retained on infrastructure you control. The practical questions are whether the platform can export access events with timestamps and identities, whether reviews can be scheduled and signed off by the right owner, and whether retention meets your own policy. Confirm each of these in your environment, including whether the physical access system vendor offers the integration you need. Also confirm the license terms of every component, because some open-source projects restrict commercial or hosted use.
Expect the parts of PR.AA-06 that involve hardware, facility services and staffing to remain with the organization or its facilities provider, regardless of which software you adopt. An implementation partner can help you define which records must exist, configure logging and review workflows and prepare evidence for an independent assessor, but the controls themselves, and any report or certificate, come from your own operations and an independent assessor. Ask any partner to separate software-delivered evidence from physical controls in its written scope, so that gaps in the facility are not hidden behind a dashboard.
Who owns physical access controls and what partners can prepare
Your organization owns the physical access controls and their day-to-day operation. That means deciding which assets and areas carry which level of risk, approving who gets access, and making sure guards, cameras, locks and alarms actually run as designed. NIST's PR.AA-06 outcome asks that physical access be managed, monitored and enforced in proportion to risk, so the risk decisions themselves are yours to make and to document.
- Risk tiering of areas: Decide which rooms, floors and sites hold business-critical assets and which need extra controls.
- Access approval and removal: Own the process that grants, reviews and revokes badges, keys and visitor passes.
- Monitoring and response: Staff or contract the people who watch camera feeds, respond to alarms and investigate anomalies.
- Escort rules: Set who must escort guests, vendors and other third parties, and enforce those rules.
- Operating records: Keep the logs, review sign-offs and exception approvals that show the controls work over time.
Confirm internally who signs off on each high-risk area and where the operating records are stored, because an auditor will ask for both.
An implementation partner can prepare the systems and evidence that support physical access management. In a self-hosted environment, that usually means the identity, logging and ticketing systems that record who was granted access, when and by whom. The partner does not own the doors, guards or cameras, and does not decide the risk tolerance for your sites. Their work is preparation: making the records consistent, exportable and reviewable.
- Access matrix: Document which roles or groups are allowed into which zones, mapped to the risk tiers your team approved.
- Evidence templates: Build forms for access requests, approvals, quarterly reviews, visitor escort logs and exception records.
- Log exports: Configure systems that issue badge or access events to a central store and produce scheduled exports for reviewers.
- Review workflows: Set up ticketed review cycles with named reviewers, due dates and escalation paths.
- Integration with identity records: Connect physical access groups to the same identity source used for logical access, where your architecture allows it.
Before engaging a partner, confirm in writing which systems are in scope and who owns each evidence output after handover.
Physical site work, such as installing locks, mounting cameras, wiring alarms or contracting guard services, is usually performed by facilities teams or specialist security vendors. A security implementation partner typically does not install or maintain this hardware. The boundary matters because the hardware is the control, and the people who install and service it are the ones who can confirm it was built correctly.
- Locks and entrances: Facilities or a locksmith vendor installs and maintains locked doors, turnstiles and key control.
- Cameras and alarms: Specialist vendors install, calibrate and service camera systems and intrusion alarms.
- Guard services: Contracted guard firms staff posts, patrols and visitor desks under their own procedures.
- Maintenance records: Facilities keeps service tickets and test results that show alarms and cameras were working during the review period.
- Vendor contracts: Your contracts should require the vendor to provide logs, service records and incident notices in a form your team can use as evidence.
Ask facilities or each vendor what records they produce and how often, and confirm that those records reach the people who prepare your evidence.
An independent auditor, assessor or certification body tests whether the controls exist and operate as described, then reports on the results. DeployOpen does not issue audit reports, attestations or certifications. NIST itself does not offer certifications or endorsements of CSF implementations, so any formal assurance you need comes from a third party you select and pay for. The auditor relies on your evidence, so the quality of the records matters as much as the controls themselves.
- Sampling: The auditor selects access events, visitor logs or review records to test against your documented procedures.
- Walkthroughs: The auditor may ask staff to show how a badge is revoked or how an alarm is handled.
- Independence: The same party that built the evidence templates should not be the party that judges the controls.
- Scope agreement: Confirm with the auditor which sites, zones and time periods are in scope before fieldwork starts.
- Findings and remediation: Your team owns the response to any finding and the corrective action plan.
Before fieldwork, ask the auditor which evidence formats they accept and whether they need access to raw system exports.
Common physical access gaps and how to close them
Physical access failures rarely come from missing locks. They come from records that drift apart, rooms that were never classified, and evidence that was never kept. The cards below cover the gaps assessors most often find under PR.AA-06, each with a closing action the organization can verify.
Access not removed after departure
Badges, door permissions and alarm codes often outlive the person's employment or contract. PR.AA-06 expects physical access to be managed for the whole life of the relationship, including its end. Check whether offboarding tickets include physical access revocation, whether contractors have end dates in the badge system, and whether removals are logged with a timestamp. Sample a list of recently departed staff and compare it against active badge holders. Close it by making badge revocation a required offboarding step with a recorded completion date.
No risk classification of rooms
Without a classification, every door gets the same controls, so server rooms and print rooms are treated alike. PR.AA-06 asks that access be managed in proportion to risk, which requires the organization to decide which areas hold high-risk assets. Check whether a current list of secure areas exists, who approved it, and whether it matches the asset inventory. An asset owner who cannot name the room housing their systems is a warning sign. Close it by publishing a room classification register tied to the asset inventory and reviewing it on a set schedule.
Visitors without escort records
Guests, vendors and other third parties often enter business-critical areas with no record of who escorted them or when. NIST's Implementation Examples for PR.AA-06 specifically call for escorting these visitors in such areas, so the escort itself must be provable. Check whether visitor logs capture identity, purpose, host, entry and exit times, and whether the escort is named. Vendors with standing access should appear in the same records. Close it by requiring a named escort and a sign-in and sign-out entry for every visit to a restricted area.
Cameras without retention or review
Cameras that record but are never reviewed, or that overwrite footage on an unknown cycle, give the organization little evidence after an incident. PR.AA-06 covers monitoring as well as enforcement, so monitoring must be defined. Confirm the retention period in writing, who may export footage, whether camera coverage includes high-risk doors and entry points, and whether any alerts from door events get reviewed. Ask the vendor or facilities team to demonstrate a retrieval from a past date. Close it by documenting retention, a named reviewer and a retrieval test with its result kept.
High-risk areas with office controls
Server rooms, cryptographic key storage and network closets often use the same door hardware and badge rules as general offices. NIST's Implementation Examples for PR.AA-06 call for added controls where high-risk assets sit. Check whether those rooms have separate authorization lists, stronger locks or multi-person entry, and alarm monitoring that is active outside business hours. A room that anyone with a general badge can enter is a classification failure, not a configuration detail. Close it by applying an additional control set to every room in the classification register, such as a separate authorization list and entry logging.
HR and badge records out of step
HR systems, badge systems and asset inventories often hold different versions of who works where. A transfer may leave old room permissions in place, and a rehire may get a duplicate badge. PR.AA-06 depends on accurate records, so mismatches create gaps that no single control can catch. Compare a monthly extract of active employees with active badge holders and list the differences. Confirm which system is the source of truth and whether the sync is automatic or manual. Close it by naming the authoritative system and reconciling it against badge permissions on a fixed cycle, with exceptions assigned to an owner.
Questions buyers ask about PR.AA-06 cost, effort and audits
Can PR.AA-06 be certified under NIST CSF 2.0?
No. NIST does not offer certifications or endorsements of CSF-related products, implementations or services, and it has no plans for a conformity assessment program. PR.AA-06 is a Subcategory you assess and report against, not a certificate you can earn. Organizations that need independent assurance usually ask an external assessor to test the physical access controls against the Subcategory's outcome and report on what they found. Only that independent assessor issues a report. DeployOpen prepares systems, controls and evidence for the assessment, but it does not issue audit reports or certifications. If a customer asks for a CSF certificate, ask them which assessment report or attestation they actually need.
How much effort does PR.AA-06 take, and what drives it?
Effort depends mostly on how many physical sites you run, how many areas hold high-risk assets, and how much of the physical environment is already documented. NIST's Implementation Examples for PR.AA-06 cover guards, cameras, locked entrances and alarms, extra controls for high-risk areas, and escorts for guests, vendors and other third parties in business-critical areas. Each of those needs a defined standard, a named owner, and records that show it runs. Colocation or cloud facilities add effort because you must obtain and review the provider's physical security evidence. Ask your team to inventory sites and business-critical areas first, since that inventory sets the scope for everything else.
Can we meet PR.AA-06 in-house without outside help?
Often yes, if you already run facilities security, access badge administration and CCTV retention under documented procedures. NIST describes the outcome, not a fixed method, so the organization decides how to meet it. Teams usually need outside help in three places: a gap review of current physical controls against the three Implementation Examples, a clear escort and visitor procedure with records, and consistent evidence across sites. A fixed-scope engagement can cover one or more of these while your staff keep ownership of the controls. Physical security decisions remain with your facilities and security leaders, and an independent assessor still tests the result.
What should a fixed-scope quote for PR.AA-06 include?
Ask for a written scope that names the sites, areas and physical controls covered, such as access control systems, cameras, alarms, guard operations and visitor escort procedures. The quote should list deliverables, for example a gap review against the Subcategory, a configuration or procedure set, the evidence pack for each control and a handover session. It should state the assumptions, including what your staff provide, which systems are in scope, and any third-party facilities excluded. Ask how changes to scope are priced and approved in writing. Because DeployOpen does not publish a price list, the quote follows directly from this written scope.
How does an auditor test physical access evidence?
An assessor typically asks what the controls are, who owns them, and how you know they work. They sample access logs, badge provisioning and deprovisioning records, visitor logs and escort records, camera retention settings, alarm response tickets and guard post orders. They may walk the site to observe locked entrances, high-risk area controls and visitor handling. For each sample, they check that the record matches the documented procedure and that exceptions were reviewed. Keep dated records, approvals and review notes, because an assessor cannot accept an undated screenshot as proof of ongoing operation. NIST's PR.AA-06 informative references point to SP 800-53 Rev. 5.2.0 physical and environmental controls, which many assessors use as a test reference.
How often should PR.AA-06 physical access reviews happen?
NIST does not set a review frequency for PR.AA-06 in the material supplied, so set one based on your risk assessment and the sensitivity of each area, then document it. Common practice is to review access lists for high-risk areas more often than general office areas, and to test alarms and camera recording on a regular schedule. Confirm any frequency your regulator, customer contract or sector standard requires before setting yours. Record each review with the reviewer, date, findings and corrective actions, so the history itself becomes evidence.
Which PR.AA-06 costs are one-time and which recur?
One-time costs usually include the initial gap review, procedure drafting, site walkthroughs, any hardware or camera changes, and the first evidence pack. Recurring costs include guard services, badge administration, camera and log storage, alarm monitoring, periodic access reviews and assessor fees for each assessment cycle. Costs rise with the number of sites, the number of high-risk areas and the volume of visitors that need escorts. Fees for an independent assessor are set by that assessor, so request their written scope separately from any implementation work. Ask your implementation partner to separate one-time and recurring items in the quote.
How DeployOpen scopes and prepares PR.AA-06 evidence
DeployOpen helps organizations prepare the systems, documentation and evidence behind PR.AA-06 Physical access, working inside the client's own facilities and infrastructure. The organization keeps ownership of its physical security controls, and an independent assessor decides whether the evidence meets the requirement.
How we scope
- Engagements are fixed-scope, with the physical locations, assets and access points to be covered agreed in writing before work starts.
- The written scope names which high-risk areas, guest and vendor escort processes, and monitoring tools fall under PR.AA-06.
- Scope also states who in the organization owns each physical control, such as facilities, security operations or a hosting provider.
How we build
- We help configure self-hosted access logging, camera and alarm event feeds, and visitor records so they can be reviewed against PR.AA-06.
- We document how locked entrances, guards and escort rules map to the agreed scope and to the organization's risk decisions.
- Where a control depends on a third-party data center, we record what that provider must supply and confirm it with them.
How we hand over
- Deliverables include the scoped control inventory, configuration records, procedures and sample evidence for each agreed control.
- Each piece of evidence is labeled with the control it supports, the owner, and the period it covers, so an assessor can trace it.
- We hand over the documentation in the client's own repositories, and the client decides what to share with its auditor.
How we support
- Ongoing support, upgrades and periodic review of physical access records are available as a retainer.
- Retainer scope, frequency and response expectations are set in writing, so the client knows what is covered after handover.
- Questions about how a specific assessor will test PR.AA-06 should be confirmed with that assessor before the scope is finalized.
