PE-2 Physical access authorizations: evidence and tests

What PE-2 physical access authorizations requires in practice

If an assessor, a customer contract or a system authorization reaches the room, floor or building where your system lives, PE-2 is the control that asks whether you know exactly who is allowed through the door and why. In short, PE-2 requires an approved list of individuals authorized to access the facility, credentials issued to those individuals, periodic review of the list, and removal of anyone who no longer needs access. Those four parts are what the assessor tests, and each one produces evidence you can show.

PE-2 is allocated to the low, moderate and high security control baselines in SP 800-53B, and it is not part of the privacy baseline. The three enhancements defined for PE-2 in Release 5.2.0 are not allocated to any SP 800-53B baseline, so the base requirement is what most programs must meet. The related visitor control, PE-7, was withdrawn and folded into PE-2 and PE-3, so visitor handling now sits in those two controls. On the CSF 2.0 side, NIST's crosswalk maps PE-2 to PR.AA-06, which covers physical access to assets, so the same evidence can support a Cybersecurity Framework review. Confirm the exact wording of any enhancement and baseline allocation against the CPRT entry before you cite it in a control narrative.

The usual difficulty is not writing the list but keeping it true. The authorization list is often correct on paper and out of step with the badge system, with HR records for employees and with contractor sponsor records. A contractor whose engagement ended may still hold an active badge, or a new hire may have a badge before the list is updated. Before an assessment, pull the approved list, export the active credentials from the access control system and compare them name by name, then trace each mismatch to a removal or a missing approval. Those reconciliations are the evidence that the four parts work together.

Which facilities, people and third parties PE-2 covers

PE-2 attaches to the physical facility where the system resides, so the first scoping question is which buildings and rooms count. The cards below cover the decisions that change the access list, the people on it and the effort to keep it current. Logical account reviews alone do not satisfy PE-2, because the control tests who can physically enter the place where the system sits.

The facility that houses the system

Start by naming each facility where in-scope components physically reside, such as a server room, a cage or a data hall. Each site needs its own approved access list. A single rack in a shared room still brings that room into scope, so confirm exactly which room or enclosure the assessor will walk through and record it in the system boundary documentation.

Colocation and cloud data center sites

When a colocation provider or cloud operator hosts the hardware, the organization often does not hold the access list itself. Decide whether the provider maintains the list under contract, whether the organization keeps its own copy of authorized names, and how the two are reconciled. Ask the provider for its physical access review evidence and confirm the contract gives your assessor access to it.

Employees, contractors and vendor engineers

Each population on the list needs a documented reason for access and a named approver. Contractors and vendor engineers tend to create the most churn because their engagements end on dates that do not match internal HR cycles. Add a step that expires their authorization when the engagement closes, rather than waiting for the next periodic review to catch it.

Cleaners, auditors and other occasional personnel

Cleaning crews, facilities staff and auditors may enter restricted space without holding system roles. Decide whether they belong on the PE-2 list or are handled as visitors under PE-8 with escort. Either choice must be applied consistently and written down, because an assessor will compare the badge system against the list and look for people present without a matching entry.

Shared facilities and alternate work sites

If the facility is shared with other tenants or business units, confirm whether one combined list or separate lists fit the boundary. Alternate work sites such as employee residences fall under PE-17 rather than PE-2, but any hardware kept there should be checked against this scope. Document the decision so the list owner and the assessor agree on what is covered.

Logical reviews do not replace physical reviews

Disabling a directory account or revoking a VPN token does not remove someone's ability to walk into a room. Periodic reviews under PE-2 must compare the physical access list with the badge or key system and the people who still need to be there. Use the identity system for evidence of joiners and leavers, but keep the facility list as its own reviewed artifact.

How an assessor tests PE-2 under SP 800-53A

This table compares the six SP 800-53A determination statements for PE-2 by assessment method, showing what the assessor asks for, the evidence requested and where findings usually arise. Read it as a sampling exercise: the assessor checks the written access list against actual facility access, not a single snapshot of the list.

Test method	What the assessor asks for	Evidence requested	Common findings
Examine: procedures	Written procedures for granting, reviewing and removing physical access to the facility housing the system	Approved access procedures, owner, review date, approval record	Procedures exist but do not name an owner, review cycle or removal trigger
Examine: authorized personnel access list	A maintained list of individuals authorized to enter the facility, with approval for each entry	Current access list, approval records, date of last review	List is outdated, lacks approvals or includes people who have left
Examine: authorization credentials	Credentials such as badges issued only to people on the approved list	Credential issuance log, badge inventory, matching against the access list	Badges issued without a matching list entry or still active after departure
Interview: personnel with authorization responsibilities	Who approves access, who reviews the list and how often they do it	Named approvers, review calendar, sample review records	Approvers cannot describe the review frequency or the removal process
Interview: personnel with physical access	Whether staff and contractors with access understand when it applies and how it ends	Access holder list, contractor roster, sign-off where used	Contractors with access are missing from the list or from the review scope
Test: processes for physical access authorizations	Walk the process end to end: request, approval, credential issue, periodic review and removal	Sampled requests, approvals, credential records and removal tickets, compared against facility entry records	Removal is delayed or undocumented, and the list diverges from who actually enters

How to build a PE-2 access list an assessor can trust

This sequence turns PE-2 from a policy statement into an access list, credential records and review decisions that an assessor can trace back to a named owner and a defined review cycle.

Define the facility boundary and populations
Start by naming the facility or facilities where the system resides, then list every population that may need access: employees, contractors, cleaning and maintenance staff, vendors and emergency responders. Record the boundary in a short scope statement that names the rooms, floors or buildings covered, so that anyone reviewing the list can tell what it governs. The output is a signed scope statement and a population register that the access list will be built from. Confirm with your facilities team that the boundary matches the physical areas where the system's hardware and media are actually located.
Assign an accountable owner for approvals
Name one accountable owner for the physical access list, usually a facilities or physical security manager, and a delegate for when that person is unavailable. The owner approves every addition and removal, and the approval rule is written into the procedure that PE-1 requires. Record the owner, the delegate and the approval rule in the access authorization procedure. The output is a documented ownership assignment that an assessor can match against the people who actually approve badges. Confirm that the owner has authority over the facility, not only over the system that sits inside it.
Set the review frequency as a defined parameter
PE-2 asks the organization to review the access list at a frequency it defines. Choose that frequency, document it as a parameter in the system security and privacy plan, and tie it to a named reviewer. Avoid leaving the value implicit, because an assessor will test whether the organization actually performed reviews at the interval it stated. The output is a documented review interval and a reviewer assignment. Check the interval against any stricter requirement your contracts, sector regulator or authorizing official imposes before you commit to it.
Connect the list to the source of truth
Link the access list to the authoritative record for employment and contracts, such as the HR system or the contractor management register. Entries should be created only when that record shows an active employment or contract need, and the list should be refreshed from that record rather than maintained by hand in parallel. If your identity platform is self-hosted, a directory such as FreeIPA can hold the group membership that drives facility access, and a provisioning tool such as authentik's SCIM provider can push changes to downstream badge or access applications. Confirm each integration's capabilities with its vendor before relying on it. The output is a documented data flow from the source of truth to the list.
Issue credentials against approved entries
Issue each badge, key or other authorization credential only after the owner has approved the matching list entry, and record the issuance with the person, credential identifier, areas granted, date and approver. Keep the issuance record separate from the list so that an assessor can compare the two. The output is a credential issuance log that reconciles one-to-one with the approved list. Investigate any credential that exists without a matching list entry, because that gap is the first thing an assessor will sample.
Document removal timing and trigger events
Define which events remove a person from the list, such as termination, contract end, transfer out of the facility population or a reported loss of credentials, and state how quickly removal must happen after each event. Link these triggers to the offboarding steps in your personnel security process. Record the removal, the credential return or deactivation and the date in a removal log. The output is a written removal procedure and a log that shows removals happen after the triggering events. Confirm the timing expectations with your sector regulator or customer contract, because this page does not supply a required interval.
Run the first full review and record decisions
Before the first scheduled review, run a full review of every entry on the list against the source of truth. For each entry, the reviewer records a decision to keep, change or remove the access, with a reason and the date. Remove credentials for any entry that is no longer justified, then reconcile the list with the credential log. The output is a signed review record with per-entry decisions, which becomes the baseline for later reviews. Keep this record with the system security and privacy plan so that an assessor can see both the list and the review that tested it.

Which evidence passes a PE-2 assessment

An assessor testing PE-2 looks for a chain of records: who is on the access list, why they were authorized, whether anyone reviewed the list, and whether removals happened when access ended. The six artifacts below connect those records, and each needs upkeep between assessments so it reflects the facility as it is on the day the assessor arrives.

Approved authorized access list

This is the named list of individuals authorized to enter the facility where the system resides, with the date each person was approved, the approving owner and the access areas granted. Assessors compare it against badge records and facility sign-in data, so names that appear in badge systems but not on the list are the first thing they will question. Export the list on a regular schedule your written procedure sets, and keep each export with its date so you can show what the list looked like at any point.

Credential issuance records

Issuance records show that each credential was given only after the person was on the approved list. They should capture the credential type, the issue date, the issuer and the list entry it traces back to. Check that issuance and list approval match in time, and that credentials issued to contractors or temporary staff carry an end date. Badge management tools often keep this history, so confirm it can be exported and that its retention matches your procedure.

Periodic review records with reviewer decisions

Review records prove that someone with authority checked the list at the frequency your procedure defines and recorded a decision for each person: keep, change or remove. A signed or system-logged decision per entry is stronger than a single sign-off on the whole list. Record the reviewer, the review date, the scope and any corrections made. Access certification workflows in identity tools, such as the campaigns in midPoint, can produce this kind of per-item decision trail if you configure them for physical access groups.

Removal records showing when access ended

Removal records answer the question assessors ask most often: how quickly did access end after a person no longer needed it. Each entry should show the person, the access removed, the trigger (such as a role change, contract end or termination), the date the trigger was known and the date credentials were deactivated. Gaps between those dates are where findings arise, so review them each month. Where identity tools drive deprovisioning, a connector log that shows the removal event can support the physical record.

Written review and removal procedure

The procedure sets the review frequency and the removal timing that every other record is measured against. It should name the owner of the list, the approver for new entries, the reviewer for periodic checks, and the steps for removing access. Assessors test the records against this document, so a procedure that promises a review cycle the logs do not show will fail. Confirm the frequency and deadlines with your own risk owners and your assessor, since NIST leaves the specific values to the organization.

Change history of the access list

The change history shows every addition, modification and removal to the list, with who made it and when. It proves the list was maintained rather than rewritten before an audit. Keep it in a system that does not allow silent edits, such as version-controlled exports or an audit log from the directory server. FreeIPa's 389 Directory Server, for example, stores users and groups with centralized administration, so its change logs can serve as a source for this history if you retain them.

Which self-hosted open-source tools can support PE-2 evidence

midPoint is an identity governance and administration platform licensed under EUPL-1.2+. Its access certification campaigns assign designated reviewers who must decide within a set timeframe whether each access item stays, changes or is revoked. For PE-2, the relevant items are the entitlements that feed the facility access list, such as role or group assignments tied to a site. The campaign record can show that someone periodically reviewed those assignments and acted on them.

Scheduled review campaigns: Configure recurring campaigns over the entitlements that correspond to facility access, so the periodic list review has a dated record.
Reviewer decisions: Each keep, change or revoke decision is captured against a named reviewer, which supports the approval accountability assessors ask about.
Access accumulation checks: Campaigns can surface roles that have built up over time, which helps catch individuals who should no longer be on the list.
Segregation of duties: Reviews can expose cases where one person holds conflicting site or role assignments.

Confirm with your own team that the facility access list is actually sourced from the identities midPoint governs, and that the physical access control system can accept those changes. The organization owns the approval decision, and reviewers must be people who have the authority to grant or withdraw facility access.

What meeting PE-2 costs in money and effort

This table breaks the cost of meeting PE-2 into its components, showing who is paid, whether each cost is one-time or recurring, and what pushes it up or down. NIST does not estimate compliance costs, so use the table to shape a written scope and quote rather than as a price guide.

Cost component	One-time or recurring	What drives it up or down	Open-source option
Identity source of truth	One-time build, then recurring upkeep	Number of employee and contractor identities, and how many sources (HR, contractor records) feed them	A self-hosted directory such as FreeIPA can hold the authorized population and groups, which can remove directory license spend
Badge or physical access system	Licenses or subscriptions recur; hardware is one-time	Number of facilities, doors and badge readers, and whether the vendor charges per door or per user	Confirm with the vendor whether open-source access control options cover your badge hardware before assuming any savings
Integration between HR, contractor records and the access system	One-time build, recurring maintenance	Number of systems to integrate and how often their data formats change	Provisioning connectors such as the authentik SCIM provider can push create, change and delete events to target applications, subject to what your access system supports
Initial authorized list build	One-time	Facility count, population size and how much access history exists to reconcile	Largely internal staff effort; a partner may prepare the list and reconciliation as a fixed-scope deliverable
Recurring list review	Recurring	Review frequency set in your own policy, number of access groups and number of approvers	Certification workflows such as those in midPoint can route review decisions to designated reviewers within a set timeframe
Removal handling	Recurring	Staff turnover, contractor churn and how quickly departures reach the access system	Automated deprovisioning from the identity source limits manual steps, but the timing of removals still needs a documented procedure
Evidence upkeep	Recurring	How evidence is generated: manually, from logs or from automated exports, and how long it is retained	Self-hosted logging and reporting can produce review records and removal logs for the assessor
Auditor sampling and examination time	Recurring per assessment cycle	Number of facilities in scope, number of access changes sampled and how well records are indexed	Clean, queryable records reduce the time an assessor spends sampling; confirm assessment scope and fees with your auditor in writing

Who owns PE-2 and what an outside partner can take on

The organization owns PE-2 in full. Its facility or security leadership approves who is on the authorized access list, decides which credentials are issued, sets the review frequency, and accepts or rejects the outcome of each periodic review. Those decisions carry the accountability, so they cannot be delegated to a vendor or to an assessor. Most of the day-to-day work sits with physical security, facilities and HR, who must keep the list current when people join, move or leave.

Approval decision: A named role approves each authorization and records the business need behind it.
The authorized list: Facilities staff maintain the list as a controlled record, with a clear owner and version history.
Credential issuance: Badge or key issuance follows the approval, and the organization tracks what was issued to whom.
Review outcomes: Reviewers keep, change or revoke each entry, and the organization acts on every revocation.
Removal triggers: HR separation, contractor end dates and role changes feed directly into removal from the list.

Before engaging any partner, confirm internally who holds each decision, because an assessor will ask for that accountability first.

Where PE-2 programs usually fall short

PE-2 programs tend to fail on ownership, evidence and reconciliation rather than on the existence of an access list. The cards below cover the gaps assessors most often find and one closing step for each that you can verify before an assessment begins.

No named owner approves the list

An access list that nobody is accountable for drifts quickly. PE-2 expects the list to be developed, approved and maintained, so an assessor will ask who signed off on it and when. Check that a named role, such as the facility security manager, has approved the list in writing, that the approval date is recorded, and that the approver has the authority to grant access to the facility. If the list has no approver, the control is not yet operating as described.

Review records show no decisions

Many organizations say they review physical access lists, but the records show only that a review meeting happened. The review should produce a decision for each person: keep, change or remove. Ask for the most recent review record and confirm it lists individuals, the reviewer, the date and the outcome for each entry. A review that approves the whole list without item-level decisions is hard to defend under PE-2.

Contractors and vendors missing from the list

Cleaning crews, maintenance technicians, colocation staff and integrators often hold facility access but are tracked only by their sponsoring manager or by the vendor's own roster. PE-2 covers every individual authorized to access the facility where the system resides, not only employees. Compare the access list against vendor rosters and current contracts, and confirm each external person has a sponsor, an end date and an entry on the authorized list.

Badge access outlives the engagement

Access often continues after employment or a contract ends because the badge is never deactivated. This is the gap PE-2 targets through removal when access is no longer required. Trace a sample of recent leavers and contract exits from the HR and procurement records to the badge system, and confirm that the credential was disabled and that the person was removed from the authorized list on or near the end date.

List not reconciled with the badge system

The authorized list and the badge system are often maintained separately, so a person can be on one and not the other. An assessor testing PE-2 will compare the two. Run a reconciliation that matches every active badge to an entry on the approved list, and every list entry to an issued credential where access is expected. Document the discrepancies and their resolution, because an unexplained mismatch is a finding.

Review frequency set but not followed

A policy may state that the list is reviewed at a defined frequency, yet the calendar shows the last review was far older than that. The frequency is the organization's own choice, but the organization must follow it. Confirm the frequency in the physical security procedure, check the dates of the last several reviews against it, and confirm that overdue reviews are tracked and escalated to the approver rather than silently skipped.

Questions buyers ask about PE-2 cost, effort and outsourcing

How much effort does PE-2 take to meet?

The effort depends mostly on how many facilities host the system, how many people hold access today, and whether anyone maintains a current list. PE-2 asks for an approved, maintained list of individuals authorized to access the facility where the system resides, credentials issued to those people, periodic reviews of the list, and prompt removal of anyone who no longer needs access. A single small server room with a short access list is a small job. A multi-site estate with contractors, badge systems spread across vendors and no existing list is a much larger one. Ongoing effort is recurring: every review cycle, every joiner, mover and leaver event, and every badge reissue draws on staff time. Ask your assessor which evidence they expect before estimating your own effort.

How long does a first pass at PE-2 usually take?

The duration is driven by the state of your records, not by the control itself. Timing usually depends on whether you can produce a reconciled access list quickly, how many badge or door systems must be matched against it, how many facility owners must approve entries, and whether your review frequency is already defined in policy. Organizations that already run a formal access review for facilities tend to move faster than those reconstructing the list from scratch. Because scope, sites and staffing vary widely, no duration is given here. Ask for a timeline built from a written scope, with milestones for list reconciliation, approval, credential review and the first documented review cycle.

Can we meet PE-2 in-house without outside help?

Many organizations can, provided they have a named owner for the facility access list, a documented review procedure and staff who can reconcile badge data with HR and contractor records. The control is administrative at its core, so internal facility, security and HR teams often carry most of the work. Outside help is most useful when the access list lives in several disconnected systems, when identity data needs to be exported and reconciled in a repeatable way, or when you want an independent check before an assessment. DeployOpen can prepare systems, records and evidence under a fixed-scope written agreement. Only an independent assessor can test the control and report on it.

What does PE-2 require from our staff day to day?

PE-2 needs people in three roles. Facility or security owners approve who gets access and why. Badge or credential administrators issue, change and revoke credentials and keep the record of what was issued. HR, procurement and contract managers tell the access owner when someone joins, moves, leaves or stops needing a site. The weak point in most programs is the last link: a departing contractor whose notice never reaches the person who revokes the badge. Agree on a trigger for each event, a named backup for each role and a log that shows removal dates. Assessors will want to see that these steps happen, not only that a policy describes them.

Can PE-2 be inherited from a colocation or cloud provider?

Possibly, but only for the part of the facility the provider actually controls, and you must verify it. Colocation and cloud operators often run their own physical access authorization programs for their data halls. Your system's authorization boundary, however, may include your own cage, rack, locked cabinet or office. Before relying on inheritance, ask the provider for its current evidence on physical access authorizations, the scope of the facilities it covers, and how it handles your staff and contractors. Then confirm in writing which parts of PE-2 you own. The provider's report is not a substitute for your own records covering your authorized people.

Is an open-source identity stack enough to meet PE-2?

An identity stack can support PE-2 but does not satisfy it alone, because the control concerns physical facilities as well as digital accounts. Tools such as authentik can push user and group changes to target applications over SCIM 2.0 and deprovision users when they lose application access, and FreeIPA stores users and groups in 389 Directory Server with centralized access control. Those capabilities help keep a single source of identity current. You still need to connect that source to physical badge systems, record approvals for facility access and produce review evidence. Confirm with your assessor whether your badge system can be fed from your directory, and document any manual steps that remain.

What should we ask for in a written quote for PE-2 work?

Ask for a quote that follows from a written scope, not a generic price. It should list the facilities and systems in scope, the access sources to be reconciled, the badge or door systems involved, the review cycle to be set up and the evidence to be delivered. Ask which deliverables are one-time, such as the initial list and procedure, and which recur, such as review support or retainer hours. Confirm what the vendor will not do, including any assessment or certification activity, which an independent assessor performs. Also ask who on your side must approve each milestone and what happens if the scope changes during the work.

How DeployOpen prepares PE-2 evidence with your team

DeployOpen works with your team to prepare the access list, credential process, review records and supporting systems that show PE-2 is operating for the facility where your system resides. Your organization owns the control and its decisions, and an independent assessor reaches the conclusion about it.

How we scope

Confirm which facility, rooms and systems fall within the PE-2 boundary for your system.
Document who owns the authorization decision, the access list and the review cadence.
Agree the written scope, deliverables and timeline with your team before any work starts.

How we build

Configure the self-hosted identity or directory source that holds the authorized personnel list.
Connect provisioning and deprovisioning so removals from the list follow a documented workflow.
Set up periodic access review campaigns that record each reviewer decision for later examination.

How we hand over

Deliver the approved access list procedure, credential issuance steps and review procedure as documents.
Provide exports and log samples that show authorizations, reviews and removals for the assessor.
Walk your staff through how to produce the same evidence on their own after the engagement ends.

How we support

Offer ongoing support and upgrades for the access platform as a retainer when your team wants it.
Review the PE-2 evidence set again after facility, staffing or policy changes that affect access.
Confirm with your assessor which artifacts they expect, so the evidence matches their test methods.