PE-3 Physical access control: requirements and evidence

What PE-3 physical access control asks for at every entry point

An assessor or contract that requires NIST SP 800-53 PE-3 is asking one question: can you show that physical access to the facility housing the system is actually enforced at each entry and exit point? PE-3 Physical access control requires the organization to enforce physical access authorizations at defined entry and exit points by verifying that each person is authorized and controlling who comes in and goes out. It also requires physical access audit logs to be kept, public areas and visitors to be controlled, and keys, combinations and other access devices to be secured, inventoried and changed. Keys and combinations must be changed periodically and whenever they are lost, compromised, or held by someone who leaves or transfers. In *SP 800-53B*, PE-3 belongs to the low, moderate and high baselines but not to the privacy baseline. The high baseline adds enhancement PE-3(1). The former PE-7 Visitor control is withdrawn and folded into PE-2 and PE-3, so visitor handling now appears in both places.

The difficulty is that no single team owns this control. Facilities usually runs the doors, guards and locks. IT owns the badge or entry system and the logs it produces. HR knows who is authorized and when that changes. Paper registers, key cabinets and combination records may sit with yet another group. Before scoping work, confirm in writing who is accountable for each entry point, each log source and each key or device inventory, and whether a single register covers the whole facility or only the rooms that hold the system. Also confirm which of these items fall inside the system boundary, because an assessor will test only what the organization has defined.

Start with a walk-through of every entry and exit point that serves the system's rooms, including loading docks and emergency doors. For each point, record what enforces access (guard, card reader, key, combination), where its logs are stored, who can change its settings, and how keys or codes are issued and retrieved. Then compare that record with the authorization list maintained under PE-2 to find gaps, such as a door that accepts a credential nobody reviews. Ask your facilities and physical security provider to confirm which items they will produce as evidence and how long those records are retained. This check is the groundwork an independent assessor will repeat, so it is worth doing before any assessment begins.

Which facilities, doors and people fall under PE-3

PE-3 applies to the physical locations where in-scope system components live, and those locations follow the system boundary and the baseline the organization selected. The cards below cover the scoping decisions that change the work, from data center rooms to contractors. The organization owns each decision and records the rationale in its system documentation.

Data halls and server rooms

Any room that houses servers, storage, network core or hypervisors that belong to the system boundary is in scope for PE-3 at the entry and exit points that lead to it. Confirm the room list against the asset inventory, not the floor plan, because equipment is often moved between rooms. Record each door, its access method and who can approve entry. Document which doors are controlled by the organization and which are controlled by a landlord.

Wiring closets and telecom rooms

Wiring closets often hold the switches, patch panels and cabling that connect in-scope components, and they are frequently overlooked because they are small or shared with building services. If a closet provides the only path to a system component, treat its door as a PE-3 entry point. Check whether the lock is keyed to a shared master, since that changes who can enter without a logged authorization.

Colocation and cloud facilities

When a colocation provider or cloud platform hosts in-scope hardware, the organization must decide whether it inherits PE-3 from the provider's controls or must evidence them itself. Request the provider's assessment report and the specific physical access controls it covers, then compare them with the system boundary. Gaps usually appear in how the organization's own cages, racks and escorted visits are controlled.

Loading docks and shared offices

Loading docks, mail rooms and shared offices are entry points that people outside the system's authorization list can reach. They do not hold system components, but they can lead toward them, so the organization decides whether the route to an in-scope room is controlled. Map the path a visitor or delivery driver would take from the outside door to the protected room, and place a PE-3 control at each point where that path crosses a boundary.

Contractors, cleaners and maintenance staff

Contractors, cleaning crews and maintenance technicians need physical access that is authorized, time-bound and logged, even when they are not system users. Decide which of them are escorted, which receive credentials and how keys or access codes are issued and returned. Confirm that the staffing agreement or service contract states these terms, because the organization is responsible for enforcing them.

Key, combination and device holders

People who hold physical keys, combinations or access tokens for in-scope rooms form part of the PE-3 population, even if they never enter the room. Build a list of every holder, including former employees whose keys were never recovered. Ask each facility owner to confirm the list at least once during the assessment period, since staff transfers and vendor changes are the usual source of unrecorded access.

How an assessor tests PE-3 with the SP 800-53A procedure

This table maps the three SP 800-53A assessment methods for PE-3 to what the assessor looks at, whom they speak with, and where organizations usually fall short. Read each row as a question the assessor will ask, then check whether your records answer it for every entry point and sampled period.

Method and focus	What the assessor examines or tests	Evidence that passes	Common findings
Examine: procedures	The written procedures that address physical access control at the facility housing the system	Current procedure covering entry and exit points, verification steps, visitor escort and key handling, with an owner and review date	Procedure exists but does not name the facility or the entry points it covers
Examine: access control logs	Physical access logs or records for the entry and exit points in scope, across the period assessed	Complete log extracts with timestamps, identity of the person, and the door used, covering the sampled dates	No logs exist for the sampled period, or logs omit the door or the identity
Examine: device inventory	Inventory records of physical access control devices such as badges, readers, keys, combinations and locks	Inventory listing each device or key set, its holder, and its status, reconciled against the facility walkthrough	Keys with no holder record, or access devices missing from the inventory
Examine: entry and exit list	The list of system entry and exit points against which access enforcement is claimed	Documented list of every entry and exit point for the facility, matched to physical access mechanisms	Entry points such as loading docks, fire exits or side doors missing from the list
Interview: responsible personnel	Staff who grant, review and remove physical access and manage keys or combinations	Consistent answers about who verifies authorization, how visitors are escorted and when combinations were last changed	Staff describe a process that differs from the written procedure or cannot name the owner
Test: enforcement processes	Whether the documented process actually verifies authorization before granting entry and controls ingress and egress	Walkthrough or sample where a request is traced from approval to credential issue to door enforcement	Credentials issued without a documented approval, or doors propped open without alerts
Test: supporting mechanisms	Guards, entry systems, locks and monitoring devices that implement the access control in practice	Test results showing the mechanism denies unauthorized entry and records the attempt	Mechanism works at one entry but not at secondary entries, or logging is disabled
Test: key and combination changes	Whether keys and combinations are changed when lost, compromised or held by departing staff	Change records tied to the triggering event, with dates and the staff involved	No change record after a staff departure, or changes made on a fixed schedule only

Implementing PE-3 physical access control step by step

This sequence turns the PE-3 requirement into a facility process that an assessor can trace, from the list of entry and exit points to the registers and rules that govern keys, combinations and access devices. Each step ends with a record the assessor can examine.

Inventory entry and exit points for in-scope rooms
Start with the rooms that house the system, its network closets, storage and any spaces that hold keys or access devices. Walk each room and record every door, gate, loading bay, roof or ceiling hatch, and emergency exit that gives access, along with the path from public areas to the room. The output is a signed entry and exit point register that names each point, its room, its control type and the team that owns it. Confirm the list against the facility floor plans, because assessors commonly test whether the register matches the building as it is.
Assign who verifies authorization at each point
For each point in the register, decide how authorization is verified and who is responsible for it. The method may be a guard checking identification against the access list, a badge reader tied to the authorized list, or a key cabinet where staff sign out keys. Document the verifier, the check performed and the fallback when the primary method fails, such as a power outage affecting readers. The output is a verification matrix that links each point to a method and an accountable role. Assessors often interview the people named here, so the matrix should describe what those people actually do.
Define the physical access log format and retention
Set the fields every access record must contain, such as the person or credential, date and time, point used, direction of travel and the result of the check, and decide where the records are stored. Badge system exports, guard logbooks and key sign-out sheets should all use the same field set so they can be reviewed together. Define how long records are kept and who reviews them, and confirm the retention period against your own policy and any contract or regulator that applies, since the facts supplied for this page do not set one. The output is a log specification and a retention schedule that an assessor can compare with real records.
Set visitor escort and public area rules
Write the rules that govern visitors and public areas: how visitors are identified, who must sign them in, which areas they may enter, and when an escort from authorized staff is required. Explain how escorts are assigned, what happens if an escort leaves the visitor unattended and how visitor records link to the physical access log. This is also where you define how contractors and delivery staff are treated when they are not on the authorized list. The output is a visitor escort procedure and a sample sign-in record. Confirm these rules align with the PE-8 visitor access records control, which is a separate requirement that reads the same visitor data.
Build the key, combination and access device register
Create one register for every physical key, combination, badge stock and access device that opens an in-scope point. Record the item identifier, the point it opens, the holder or custodian, the storage location and the date of issue. Assign a named owner for each item, because an unowned key is the most common gap an assessor finds during inventory testing. Store spare keys and blank badges under the same controls as issued ones. The output is an inventory register with an owner field completed for every entry, reconciled against the physical count at a defined interval that you set.
Write the rule for changing keys and combinations
Define when keys and combinations must be changed. The PE-3 requirement covers periodic changes and changes after a key is lost, compromised, or held by someone who leaves or transfers. Set the periodic interval in your own policy, since the supplied facts do not give one, and write triggers for the event-driven changes. Link the rule to your staff departure process so that offboarding automatically creates a register check and a change request. The output is a change procedure with a trigger list and completed change tickets that show each event was handled. Assessors usually sample departures and losses to confirm the change happened.
Connect the records to a central inventory
Bring the register and the log into a system of record so they can be reviewed and reported. Asset tools such as GLPI can hold the register of physical items and racks, and tools that track system components can show which devices sit behind each point. Confirm the tool's exact capabilities for physical access items with the vendor before relying on it, since the supplied facts describe asset tracking for computers and equipment rather than keys. The output is a linked set of records in which each access point, owner and device can be traced, ready to be examined during assessment.
Test the sequence and collect assessment evidence
Before an assessment, run a walkthrough that follows one sample entry point from the register through verification, logging, visitor handling and key control. Pick a departed staff member and a visitor, then check that the records show the expected steps. Collect the procedures, logs, inventory records and interview notes that map to the assessment objects in SP 800-53A for PE-3, and note any gaps with an owner and a closure date. The output is an evidence binder and a short gap list that the control owner signs off, giving the assessor a clear path from the requirement to the records.

Which evidence passes a PE-3 physical access control test

An assessor testing PE-3 looks for records that show access was enforced at real entry and exit points, not just written down. The six artifacts below connect: each one proves a different part of the control, and together they let a reviewer trace an authorization from approval through the door, the visitor log and the key register. Each organization sets its own review cadence for keeping them current between assessments.

Entry and exit point inventory

A current list of every entry and exit point covered by PE-3, with the type of control at each one (lock, card reader, guard post, turnstile or mantrap), the owner, and the system or room it protects. Assessors use it to confirm that the access points they sample are the ones the organization defined. Check it against floor plans and site walks, and record when a door is added, removed or changed. Reconcile it whenever the facility layout changes.

Physical access logs with review records

Entry and exit logs from badge readers, guard logbooks and entry systems, along with the records showing someone reviewed them. Assessors sample individual entries and ask whether each one matches an authorization. The review record matters as much as the log: a dated sign-off by a named reviewer, with any anomalies followed up, shows the logs are used. Many organizations set a monthly sign-off for their own review cycle and keep the reviewed logs under the retention period they define.

Verified authorization list linked to PE-2

The list of people approved for access to each controlled area, showing who approved them, when they were verified, and when access was last reviewed. PE-3 requires entry to be enforced against authorization, so this list must match what the badge system or guards actually check. Link each entry to its PE-2 authorization record so an assessor can trace a person from approval to credential to door. Remove people who have left or changed roles and keep the removal date.

Visitor escort records

Records showing that visitors and public areas were controlled, including who signed in, who escorted them, the areas visited, and times in and out. Assessors compare these records with the physical access logs to find visitors who moved without an escort or appear in logs without a sign-in entry. Keep the escort assignment and sign-out with each visit so gaps are visible. Visitor records also connect to the PE-8 visitor access records control.

Key, combination and access device register

A register listing every physical key, combination and access device, its holder, its issue date and the locations it opens. PE-3 requires these to be secured and inventoried, so the register must reconcile with what is physically held. Reconcile holders against the staff roster each quarter, which is a reasonable starting point for many organizations, and confirm that unassigned items are stored securely. Missing items should be traced and reported, not quietly removed from the list.

Key and combination change records

Records showing when keys and combinations were changed, why, and who approved the change. PE-3 calls for changes on a periodic basis and when keys or combinations are lost, compromised, or held by staff who leave or transfer. Assessors check that each departure or loss triggered a change within the timeframe the organization defined, so keep the trigger, the work order and the verification together. Confirm the schedule the organization set for routine changes and test that the records match it.

What meeting PE-3 costs in money and effort

This table breaks the cost of meeting PE-3 into components, showing who is paid, whether each cost is one-time or recurring, and what pushes it up or down. NIST does not estimate compliance costs, so no figures appear here; use the drivers to scope a written quote. The main takeaway is that entry point count and guard hours usually dominate, while open-source logging and inventory can remove license spend.

Cost component	Who is paid or who spends effort	One-time or recurring	What drives it up or down
Access control hardware and badge system	Hardware vendor, integrator or facilities contractor	One-time installation, with recurring maintenance and replacement	Up with entry point count and sites; down by reusing existing badge systems
Access control software and logging licenses	Software vendor; open-source alternatives carry no license fee	Recurring license or subscription, where commercial	Up with user count and integrations; down by choosing self-hosted tools with audit logging
Facilities staff and guard time	Internal facilities team or contracted guard provider	Recurring	Up with guard coverage hours, number of entry points and after-hours access; down by consolidating entry points
Engineering time to integrate physical access logs	Internal engineers or implementation partner	One-time integration, with recurring review of log feeds	Up with number of log sources and need for correlation; down with a single log destination
Asset inventory of keys, combinations and access devices	Facilities or security staff, plus any inventory tool setup	One-time baseline, then recurring updates	Up with key count, staff turnover and device types; down with a maintained inventory tool and clear issuance records
Register and evidence upkeep	Compliance lead and facilities staff	Recurring, usually tied to review cycles	Up with number of sites, change frequency and manual record keeping; down with automated log retention
External review or testing of physical controls	Independent physical security tester or assessor	Recurring or periodic, scoped per engagement	Up with site count, facility complexity and test depth; down with a written scope agreed before work starts
Auditor sampling time	Independent auditor or assessor	Recurring per assessment cycle	Up with number of entry points and records sampled; down with complete, indexed evidence ready at the start

Open-source tools that support PE-3 evidence

The four tools below produce logs and inventories that an assessor may sample while testing PE-3. None of them controls a door, badge reader or key, so they support the evidence trail around physical access rather than enforcing it. Physical access logs and key registers must come from the facility's own systems.

Nextcloud admin audit logging

The admin_audit app records additional event detail to audit.log in the data directory, or to a path set with logfile_audit. For PE-3 this supports a record of who accessed the application layer, which can help when an assessor asks how a system access trail is kept. It does not record who entered a room. Confirm which events the app captures in your version, confirm where the log is written, and confirm that it is copied to protected storage with a retention period set by your policy.

OpenBao audit device records

OpenBao audit devices keep a detailed JSON log of every API request and response, including errors, with most sensitive values hashed with HMAC-SHA256. This supports access records for secrets, which matter when keys, combinations or access credentials are stored in a secrets manager and must be traced when they are changed or compromised. Check which values are hashed in your configuration, confirm where the audit device writes, and make sure the log is reviewed and retained under your own procedure.

GLPI asset inventory

The GLPI Assets module tracks computers, monitors, network equipment, peripherals, printers and racks, entered manually or pushed automatically by the GLPI Agent through native inventory built into GLPI since version 10. An accurate rack and device register supports the PE-3 expectation to inventory access devices and to know which in-scope components sit in which controlled area. GLPI does not track keys, badges or combinations unless you record them yourself. Confirm that the register covers the locations assessors will sample.

Wazuh endpoint inventory

The Wazuh Syscollector module collects hardware, operating system, installed software, network interfaces, open ports, services, users and groups from each endpoint and stores them in the Wazuh indexer for dashboard views and reports. This helps show which systems exist in a controlled area and who holds local accounts on them, which supports review of access to equipment. It does not show physical presence or entry events. Confirm agent coverage across the inventory and how often reports are exported for your assessment file.

Who owns PE-3, who can help, and where the auditor stops

Your organization owns PE-3. The physical access authorizations, the decisions about who enters which door, the custody of keys, combinations and access devices, and the sign-offs that show the control operates all stay with your staff. The assessor will ask who is accountable, so the names on the policy, the access lists and the key registers must be people inside your organization.

Authorization decisions: Your security or facilities owner approves who may enter each defined entry and exit point and removes access when the need ends.
Key and combination custody: Named holders are responsible for keys, combinations and access devices, and your records show when they are issued, changed or returned.
Changes after compromise or departure: Your team decides when keys or combinations are changed after a loss, a compromise, or a staff member leaves or transfers.
Guards and entry systems: If guards or door systems enforce access, your operations staff run them and review their outputs.
Sign-offs and approvals: Your management approves the PE-3 procedures and reviews the access logs and inventories on the schedule you define.

Before an assessment, confirm that every one of these duties has a named owner and that the owner can produce the record that proves the duty was performed.

Where PE-3 programs usually fall short and how to close the gap

Most PE-3 findings are not missing locks or guards. They are gaps between the records that say who may enter, what devices exist, and what actually happened at the door. Each card below names one gap, the fix, and the evidence an assessor would expect to see once it is closed.

Keys and access devices with no holder record

Badges, metal keys and fobs get handed out at the front desk and never tied to a named person in an inventory. PE-3 expects access devices to be secured and inventoried, so an assessor will ask who holds each one today. Close the gap by logging every issuance, return and loss against a named holder and a device identifier. Evidence that it is closed: a current device inventory reconciled against the issuance log, with a sample of recent returns and one documented loss. Ask your team to produce this in one pass before the assessor does.

Shared combinations never changed after departures

Door codes and safe combinations often outlive the people who knew them. PE-3 requires keys and combinations to be changed periodically and when they are lost, compromised, or held by staff who leave or transfer. Check every combination against your separations and transfers list for the last review period. Evidence that it is closed: a change log showing each combination's last change date, the trigger for each change, and a link from the HR offboarding ticket to the facility change record.

Side doors missing from the entry inventory

Assessors test PE-3 at defined entry and exit points, and a side door, loading dock or roof hatch that never made the list is a gap they will find on a walkthrough. Build the list from floor plans and a physical walk, not from the access control vendor's configuration alone. Evidence that it is closed: a signed list of entry and exit points for each facility housing the system, with the control type and the reader or guard assigned to each, and a note on any point with no control.

Visitor escort rules with no visitor record

Many facilities require escorts for visitors in restricted areas, but nothing records that an escort was present. PE-3 covers controlling visitors and public areas, and the related visitor record control (PE-8) depends on the same log. Require a sign-in entry with the visitor's name, host, time in and time out, and escort name for each restricted area visit. Evidence that it is closed: a sample of visitor logs for a defined period that match badge or door event data, with any gaps explained in writing.

Access logs kept but never reviewed

Door event logs exist in most facilities, yet nobody is assigned to review them, so a tailgating pattern or a badge used after termination goes unnoticed. PE-3 requires physical access audit logs to be kept, and assessors will ask who reviews them and how often. Assign a named reviewer, define the review frequency, and record each review with the anomalies found and the follow-up. Evidence that it is closed: signed review records, with a sample showing an anomaly raised, investigated and closed.

Authorization lists that do not match door rights

The approved access list and the controller's actual permissions often drift apart, so a person removed from the list may still open a door. PE-3 requires authorizations to be verified at entry and exit points, which means the list is only useful if it matches what the reader accepts. Reconcile the list against controller exports on a set schedule and after each onboarding or offboarding batch. Evidence that it is closed: a reconciliation report showing zero unexplained differences, or each difference with a documented correction.

PE-3 physical access control questions buyers ask

How much does PE-3 physical access control cost to implement?

PE-3 has no published price, and NIST does not estimate compliance or implementation costs. The cost is driven by what the organization already owns: whether the facility has card readers, locks, cameras and guards, and whether the access system can export logs. Most of the spend falls into a few components: physical hardware and installation for entry points, the access control system licence or service, staff time to maintain authorization lists and key registers, and periodic re-keying or combination changes. Some costs are one-time (installation, initial inventory) and others recur (log review, re-keying, maintenance contracts). Ask any provider for a quote that separates hardware, software, installation, labor and recurring items, and that states which facility sites are in scope.

How long does it take to implement PE-3 access control?

The timeline depends on how many entry and exit points are in scope, whether hardware must be installed or only configured, and how mature the existing physical access processes are. NIST does not set implementation timelines for Rev. 5 controls; for federal systems, timing is governed by OMB Circular A-130 and the agency's own authorization schedule. A realistic plan starts with an inventory of doors, keys and access devices, then defines the authorization and escort procedures, configures the access system and log retention, and finally tests enforcement at each point. Hardware lead times and facility construction windows usually set the critical path, so ask for a written schedule tied to a fixed scope before work begins.

What does PE-3 need from facilities, HR and IT staff?

PE-3 spans three functions, and each owns a different part of the control. Facilities staff own the physical points of entry, locks, readers, guard posts, keys and combinations, and the key and access device inventory. HR owns the trigger events for change: staff who leave or transfer must have their access removed and keys recovered, and HR records feed the authorization process. IT or security staff own the access control system, its audit logs, retention, and the link between badge records and directory accounts. Visitor escort rules need agreement across all three. Write down who approves each authorization, who reviews the logs and how often, so an assessor can follow the path from a request to a recorded entry.

Can our organization implement PE-3 without an outside partner?

Yes, an organization can implement PE-3 itself, since the control is owned by the organization and not by a vendor or consultant. The work is mostly procedural and physical, and many facilities teams already perform parts of it. External help is most useful for areas where mistakes are costly or hard to see: designing the authorization workflow, configuring audit logs so they meet retention and review needs, integrating the access system with identity and HR sources, and preparing evidence for an assessment. DeployOpen plans, configures and documents self-hosted open-source systems that can support this evidence, but it does not assess controls or issue reports. An independent assessor must still test the control, so plan for that step regardless of who does the build.

How does PE-3 relate to PE-2, PE-6 and PE-8?

PE-3 enforces access at the point of entry, while the related controls cover who should be allowed in, how entry is watched, and how visitors are recorded. PE-2 defines the approved list of people authorized for physical access and the credentials issued to them, so PE-3 depends on PE-2 for the authorizations it checks. PE-6 covers monitoring, including reviewing access logs and responding to incidents, which turns PE-3's logs into detection. PE-8 covers visitor access records, which overlap with PE-3's visitor escort requirement. In practice, one access process can satisfy all four, but each control needs its own documented procedure, owner and evidence so an assessor can test it separately.

What changed with PE-7 being withdrawn, and does it affect PE-3?

PE-7 Visitor control is withdrawn in SP 800-53 Release 5.2.0 and its requirements were incorporated into PE-2 and PE-3. For PE-3, this means visitor control is now part of the entry and exit enforcement requirements, including controlling public areas and visitors, rather than a separate control. Existing programs that cited PE-7 should update their control mapping in the system security plan and point visitor evidence to PE-3 and PE-2. Confirm the exact wording of the withdrawal note and the incorporated text in the NIST CPRT or OSCAL catalog, and check whether your authorization package or contract references the old identifier.

How DeployOpen prepares PE-3 evidence for an assessment

DeployOpen works on PE-3 by preparing the systems and records an assessor will examine, interview and test against. The organization keeps ownership of its physical access decisions, and an independent assessor reaches the conclusions about whether the control is met.

How we scope

We agree in writing which entry and exit points, systems and log sources fall within the PE-3 scope.
We confirm which SP 800-53B baseline applies, since PE-3 sits in the low, moderate and high baselines and PE-3(1) is added at high.
We list the access devices, keys and combinations that need an inventory, and name the owners who will confirm the records.

How we build

We configure self-hosted tools that record physical access events, such as asset and location records and audit trails for administrative actions.
We set up an inventory of access devices in a self-hosted asset management platform, populated manually or through automated agents.
We map each PE-3 determination statement to the artifact, log or record that will show it, so gaps appear before the assessment.

How we hand over

We deliver the procedures, inventory records, log configuration notes and test results that the organization will present to its assessor.
We document how physical access logs are retained, protected and reviewed, and who is responsible for each review step.
We record open gaps in a plan of action and milestones, with owners named by the organization, and walk the team through the handover.

How we support

Ongoing support, upgrades and periodic re-checks of PE-3 evidence are available as a retainer agreed in writing.
We can rerun the evidence checks after facility changes, staff turnover or a key or combination compromise.
Ask us to confirm in writing which parts of PE-3 remain with your facilities, security and assessor teams after handover.