PE-6 Monitoring physical access: requirements and evidence

What PE-6 monitoring physical access requires in practice

When an assessment package or FedRAMP-style submission asks for PE-6, the short answer is that you must monitor physical access to the facility where the system resides, review physical access logs at a frequency you define and after defined events, and coordinate the results of those reviews and investigations with your incident response capability. The requirement applies at the low, moderate and high baselines in SP 800-53B and is not part of the privacy baseline. The review frequency and the triggering events are organization-defined parameters, so the assessor will test whether you chose values, documented them and followed them. Write those values down before the assessor asks.

The risk is unnoticed entry. An unauthorized person who follows an employee through a door (tailgating), uses a borrowed badge or enters during a maintenance window may leave no alarm, and if nobody reads the logs, the gap can persist for weeks. Detection is slow when the logs are sensitive to tampering or are simply never looked at. The difficulty grows when the room is colocated or the facility operator controls the badge system and camera archives. In that case you may not hold the raw logs, and you must agree in writing on who produces them, how often you receive them and how fast the operator notifies you of anomalies. Confirm those terms with the operator and with your own facilities owner before you rely on them as evidence.

Review without a trigger is easy to skip, so pair the schedule with event-driven reviews. Examples of triggers to consider include a door alarm, a badge reported lost, a terminated employee's credential still active, or a visitor anomaly flagged under PE-8. Each review should produce a record showing who reviewed what, what was found and whether an incident ticket was opened. Route findings into the incident response process so that the same review evidence supports IR monitoring and reporting. Ask your facility operator and your auditor which records they will accept as proof of review, since that decision shapes what you must export and keep.

Which facilities, systems and third parties PE-6 covers

PE-6 applies to the physical facility where the system resides, so scoping starts with knowing every site that houses system components. Each site brings its own monitoring sources, owners and evidence trail, and third-party facilities add a shared-responsibility question the organization must answer in writing.

The facility where the system resides

PE-6 attaches to the facility that houses the system, not to the system as a logical object. List every data hall, server room, network closet and office where components sit, including backup media and remote hardware. For each site, record who can enter, which monitoring sources cover the doors and approaches, and which records prove monitoring happened. A site missing from the inventory is usually the one an assessor finds.

Colocation and cloud data centers

When a colocation provider or cloud platform hosts components, the organization often relies on the provider's guards, video and badge logs. Confirm in the contract which party monitors access, which physical controls are inherited and which remain the customer's, such as cage locks or rack keys. Ask the provider for its access review summaries or independent assurance reports covering physical security, and check how far back those records are kept.

Guards, video and badge readers

Each monitoring source produces different evidence. Guard logs show staff presence and response, video shows movement and tailgating, badge readers show credential use, and intrusion sensors show forced entry or propped doors. Map each source to the sites it covers, name its owner, and confirm that its clocks align with the enterprise time source so events can be correlated during an investigation.

Ownership and handoffs between parties

Monitoring often spans facilities teams, a landlord, a managed security provider and an internal security function. Document who receives alarms, who reviews logs, who escalates to incident response and who signs off on the review. Gaps tend to appear at handoffs, such as a landlord who holds video footage for a short period that the organization never requests. Write these responsibilities into a monitoring matrix and assign a named owner for each row.

Obtaining monitoring evidence from a hosting provider

An assessor will expect the organization to produce provider evidence on request. Agree in advance on what the provider supplies: access log extracts for defined periods, incident notifications, video retrieval procedures and escalation contacts. Confirm how quickly records can be obtained and whether the provider's retention meets the organization's review schedule. Where the provider cannot supply the records, the organization should document the compensating control it uses.

Remote and alternate locations

Staff working from home, branch offices or temporary sites can place system components outside monitored facilities. Decide whether these locations fall within PE-6 scope, and if so, which monitoring applies, such as device location controls or documented alternate work site rules. Record the decision in the scope statement so that the monitoring boundary is clear to assessors and to the team responsible for reviews.

How an assessor tests PE-6

This table maps the five SP 800-53A determination statements for PE-6 to the examine, interview and test methods and the assessment objects an assessor uses. The last column lists findings that commonly cause a gap, so you can check your own monitoring records before an assessment starts.

Assessment method	What the assessor looks for	Common findings
Examine: monitoring procedures	A written procedure for monitoring physical access to the facility, covering who monitors, what is monitored and how often reviews happen	Procedure exists but names no owner, frequency or event triggers
Examine: physical access logs and monitoring records	Access logs or records covering the facility, plus evidence that someone reviewed them at the defined frequency	Logs retained but no signed or dated review records
Interview: monitoring personnel	Staff who watch cameras, guards or sensor alerts can describe their duties, escalation steps and what they do with anomalies	Staff unsure who reviews logs or what counts as an anomaly
Interview: incident response personnel	Incident responders can explain how physical access findings reach them and how they are investigated and closed	No defined path from a physical access alert to an incident ticket
Test: monitoring process in operation	The assessor observes or samples real monitoring activity, such as a log review after a defined event, and traces it to a result	Review after a defined event is not performed or cannot be traced to a result

How to implement PE-6 step by step

This sequence turns PE-6 from a policy statement into a working monitoring process: defined review cadence, named monitoring sources, confirmed facility coverage, retained records, a tested handoff to incident response, and a first recorded review cycle that an assessor can examine.

Set the review frequency and triggering events
The organization defines how often physical access logs are reviewed and which events force an extra review, such as a reported tailgating incident, a lost badge, an alarm or a guard shift report with exceptions. PE-6 leaves both values to the organization, so the security owner, usually with the facility lead, writes them into the physical security procedures. The step is done when the frequency and triggers are approved, versioned and visible to the people who will run the reviews. An assessor will compare the reviews performed against these defined values, so vague wording here creates findings later.
Inventory and assign monitoring sources
List every source that shows physical access to the facility or the rooms that house the system: badge readers, door controllers, cameras, intrusion sensors, visitor logs and guard patrol records. For each source, name an owner who is responsible for its output, and record where the data lives and who can read it. Ownership is often split between the organization and a landlord, colocation provider or managed guard company, so the split must be written down. The output is a monitoring source register that shows each source, its owner and its log location.
Confirm coverage with the facility operator
Where the system sits in a facility the organization does not run, such as a colocation hall or a shared data center, agree in writing which monitoring the operator provides, how the organization receives access logs or alerts, and how quickly exceptions are reported. Walk the route from the building entrance to the system's room and mark any gap, such as a door without a reader or a camera that does not cover a rack row. The output is a coverage statement signed by both parties and a gap list with an owner and a closure plan for each item.
Define log retention and review records
Set how long physical access logs and video are kept, who can export or delete them, and where copies are stored so they cannot be altered by the people they describe. Define what a review record contains: the reviewer, the period covered, the sources checked, the exceptions found, the disposition of each exception and the date of the review. Retention periods depend on the organization's own requirements and any contract or regulation that applies, so confirm them with legal and the authorizing official rather than copying a figure. The output is a retention schedule and a review record template that the monitoring team uses every cycle.
Write the handoff to incident response
Agree the criteria that turn a physical access exception into an incident, and the path it takes to the incident response team. Include who receives the alert out of hours, how the facility operator is contacted, when law enforcement is involved and how evidence such as video exports is preserved with its chain of custody. Test the handoff with a tabletop exercise or a simulated door-forced event so the team confirms the contacts work. The output is a written escalation procedure and a record of the test, with any corrections made to the contact list.
Run and record a first review cycle
Carry out the first review using the defined frequency, sources and template, then record the outcome of every exception, including those judged benign. Where an exception is escalated, link the review record to the incident ticket so the two can be traced together. Identify process gaps, such as a source that could not be exported or a reviewer who lacked access, and assign corrective actions. The output is a completed review record, the escalation records it produced and a list of corrective actions. Keep these as the first set of evidence for the assessor, who will test whether reviews happen as defined.

Guards, video, sensors and the logs that prove them

An assessor testing PE-6 wants proof that someone or something actually watched the facility, not only that a system stored data. The three monitoring sources produce different kinds of evidence. Guard logs and shift reports show a named person was on post, what they observed, and what they escalated. Video retention and review records show that camera footage exists for the defined period and that a person reviewed it at the defined frequency or after a defined event. Badge and sensor event logs show what the system recorded, such as door held open, forced entry or a rejected credential. Each source answers a different question, so a mature program keeps all three and ties them together with a review record that names the reviewer, the date, the period covered and the outcome.

The central test is whether the evidence shows that someone looked. A badge export with thousands of rows and no reviewer signature shows that the system logged events, not that monitoring occurred. Ask your team for a sample of review records and confirm that each one states who reviewed the logs, which time window they covered, what anomalies they found and how each anomaly was closed or sent to incident response. Where guards or a monitoring service do the watching, confirm that their post orders, shift reports and escalation logs can be produced for the same period. Confirm also how long each source is retained, since an assessor will sample dates that may be months old.

PE-6 depends on inputs from other controls. The physical access logs produced under PE-3 are the primary data set that periodic reviews examine, so the quality of PE-3 logging determines what PE-6 can detect. Visitor records maintained under PE-8 are a related input, because a visitor who appears in the badge log without a matching visitor entry is a monitoring finding in its own right. Review outcomes that involve a possible incident should be passed to the incident response process, and the handoff should leave a record that links the monitoring review to the incident ticket, which is the coordination the control asks for.

Evidence that passes a PE-6 review

An assessor testing PE-6 looks for a documented monitoring procedure, proof that physical access was reviewed on schedule and after events, and a trail from those reviews into incident response. The cards below are the records that connect those three things, and most of them need to be kept current between assessments, not assembled the week before one.

Written physical access monitoring procedure

This is the document that defines how physical access to the facility is monitored, by whom, and at what frequency. It should name the monitoring sources (guards, video, badge or door sensors), the scheduled review cadence, and the events that trigger an unscheduled review, such as an alarm, a tailgating report or a lost badge. Check that the procedure names an owner and that its review dates are recorded, because assessors compare what the procedure says against what the logs show.

Physical access log exports for the period

Exports from the access control system covering the full review period, with entries for every monitored entry point. Assessors use them to confirm that logs exist, are complete and cover the facility where the system resides. Confirm the export includes timestamps, door identifiers and credential identifiers, and that gaps (offline readers, unsynchronized clocks) are documented rather than silently absent.

Signed or ticketed review records

Each scheduled review should leave a record showing who reviewed which logs, when, what they looked for, and what they found. A signed form or a closed ticket in the organization's tracker serves this purpose. Anomalies that were dismissed need a stated reason. Blank sign-offs or reviews completed in a single batch before an audit are the records assessors most often question.

Event-triggered review records

When a defined event occurs, such as a forced door alarm or an access attempt by a deprovisioned credential, the review should be tied to that specific event. The record should identify the triggering event, the logs examined and the outcome. Because PE-6 requires reviews when defined events occur, assessors will ask for at least a sample of these, so confirm your organization has actually triggered them and kept the paperwork.

Incident tickets showing coordination

PE-6 requires review results and investigations to be coordinated with the incident response capability. Evidence of this is a ticket that links a physical access finding to an incident record, with the handoff, containment steps and closure noted. Check that the ticket uses the same incident categories as the IR plan (see the IR family), so the assessor can trace the path from monitoring to response without manual reconstruction.

Current list of monitoring sources

An inventory of every system that feeds physical access monitoring, including badge readers, cameras, door sensors, guard stations and the log collector that gathers their output. Record each source's location, owner and log destination. Assessors use this list to judge whether the monitoring covers the facility, so it should be updated whenever a reader or camera is added, moved or retired.

What meeting PE-6 costs

This table breaks down the recurring and one-time costs of meeting PE-6 Monitoring physical access, who is typically paid for each, and what changes the total. NIST does not estimate compliance costs, so use the table to decide what to ask for in quotes from your facility operator, monitoring provider and assessor rather than as a budget.

Cost component	Who is usually paid	One-time or recurring	What drives it
Guard or monitoring service	Facility operator or an outsourced monitoring provider	Recurring	Number of monitored entry points, hours of coverage, and whether monitoring is staffed or alarm-only
Video and sensor hardware	Facility operator, or the organization if it owns the room	One-time, with recurring maintenance	Number of cameras and door or motion sensors, camera coverage of entry and exit points, and replacement cycles
Video and sensor retention storage	Organization or its storage provider	Recurring	Retention length set in policy, camera resolution, and number of facilities
Physical access log storage and analysis	Organization, or the cloud or data center provider hosting the log platform	Recurring	Volume of badge and door events, log retention period, and whether logs are forwarded to a central SIEM
Open-source log tooling	No license fee for the software, but staff time to deploy and maintain it	One-time setup, recurring operation	Integration effort with badge systems, rule tuning, and the number of log sources
Staff time for scheduled and event-driven log reviews	Organization staff or contracted reviewers	Recurring	Review frequency set by the organization, number of facilities, and how often events trigger a review
Incident coordination	Organization incident response staff	Recurring, spikes after events	Frequency of physical security alerts and the depth of investigations they require
Independent assessment sampling	Independent assessor	Recurring at each assessment cycle	Number of facilities in scope, sample sizes the assessor selects, and the volume of review records to examine

Who owns monitoring, who prepares evidence and who assesses it

Your organization owns PE-6. Under SP 800-53, the facility owner must monitor physical access to the facility where the system resides, decide how often access logs are reviewed and what events trigger an extra review, and make sure review results reach the incident response capability. Those decisions are management decisions, so they cannot be delegated to a partner or an assessor.

Monitoring decisions: Set the monitoring method (guards, video, door sensors or a mix), the review frequency and the defined trigger events, such as an alarm, a failed badge pattern or a visitor anomaly.
Review performance: Staff named in the procedure perform the reviews, sign off on them and record exceptions. Reviewers should not be the same people who administer the access system.
Incident response coordination: Route suspicious physical access findings to the incident response team, and record how each investigation was resolved.
Policy and procedure: Maintain the physical monitoring procedure that the assessor will examine, and keep it aligned with the PE-1 policy.
Ownership of evidence: Keep review records, investigation notes and log retention under your control, even when a partner built the pipeline.

Before engaging anyone, confirm that the named owner, reviewer and incident responder roles are written down and that someone with authority accepts the residual risk of the monitoring design.

Self-hosted open-source tools that produce PE-6 evidence

Can OpenSearch Security Analytics produce PE-6 evidence from physical access logs?

It can match physical access logs against detection rules, but only after those logs are ingested into it. OpenSearch Security Analytics runs detectors that match ingested logs from hosts, network devices and cloud services against prepackaged or custom Sigma rules. Each match is recorded as a finding with its rule, log type and severity, and alerts can go to channels such as Slack or email. A correlation engine links findings across log types in a correlation graph, which can help when a badge event, a network login and a camera-linked alert occur close together. The detectors are built around security logs, so confirm with your vendor or your own testing whether badge controller or video system feeds can be ingested and normalized into a usable log type. Keep the findings and alert history as evidence of monitoring and review.

How does Wazuh turn collected logs into alerts an assessor can review?

Wazuh decodes each collected log, then compares the event against its ruleset. The ruleset includes over 3,000 built-in rules and decoders, plus any custom rules your team writes. Matching events are written to alerts.log and alerts.json, mapped to MITRE ATT&CK, and forwarded to the Wazuh indexer for review in the dashboard. For PE-6, the useful pattern is a custom decoder and rule set for physical access events, such as repeated failed badge reads or access outside approved hours, so that the alert files and dashboard history show monitoring and follow-up. Wazuh does not read a door or a camera by itself. Confirm that the facility system can send its logs to a Wazuh agent or collector, and document which events are in scope.

What ingestion work must happen before these tools can monitor physical access?

The tools monitor logs that reach them, so physical access logs must be exported from the facility's own systems first. Typical sources include badge access controllers, door controllers, visitor management systems and video management platforms, each operated by the facility or its security vendor. Your team needs to decide the export method, the time source, the retention period and who can read the raw logs. Time stamps matter because a correlation across badge and network logs fails if clocks disagree. Ask the facility vendor whether it offers syslog, API or file export, and test a sample export before writing any detection rule. DeployOpen can plan and implement this integration inside your own infrastructure as part of a fixed-scope engagement, but the physical systems and their owners remain yours.

Do badge and video feeds fit these open-source log tools?

Confirm this for your own equipment before you commit to a design. The tools are built to ingest and analyze log data, and a badge reader or video system that exports structured event logs may fit that model. Video streams, raw camera footage and proprietary binary formats usually need a conversion or a vendor integration first, and some may not fit at all. Ask the physical security vendor for the export formats, event fields, rate of events and retention behavior. Then run a short proof of fit with sample data from each device class. Record the result in the PE-6 monitoring plan, so an assessor can see which feeds are covered by automated analysis and which are reviewed manually.

How can Nextcloud admin_audit serve as an audit trail beside physical controls?

Nextcloud's admin_audit app logs additional event information to audit.log in the data directory, or to a path set with logfile_audit. It does not monitor doors or facilities. It is useful as an example of an audit trail for a system that sits beside physical controls, such as a records system that holds visitor logs, access reviews or incident notes. Check that the audit log is protected, that its path and permissions are set deliberately, and that it is shipped to the same analysis platform as other records. The administrative logging configuration is described in the Nextcloud admin manual, and your team should confirm the events it captures for your version before relying on it as evidence.

How do OpenBao audit devices support evidence for physical access reviews?

OpenBao audit devices keep a detailed JSON log of every API request and response, including errors, with most sensitive values hashed with HMAC-SHA256. That makes them a strong audit trail for secret and key access, which matters when physical access reviews include who could reach key material or privileged consoles. If an access review finds a person who entered a server room, the same review can ask whether that person's account touched secrets during the window. Evidence should show that audit devices are enabled, that logs are retained and reviewed, and that failures to write audit logs are handled. Confirm the configuration and retention settings in the OpenBao documentation for your deployment, and keep the logs away from the people whose activity they record.

Who owns the PE-6 evidence when open-source tools produce it?

Your organization owns the control, the monitoring procedure and the evidence. The tools generate logs, alerts and audit records, but they do not decide what counts as an incident or who must respond. A reviewer must be named, the review frequency must be defined, and reviews plus investigations must be routed to the incident response process. An implementation partner such as DeployOpen can install, configure, document and test the tooling inside your infrastructure, and can prepare the evidence package. Only an independent assessor can test the control and issue findings. Ask a potential partner which artifacts they will hand over, who will operate the tools afterward, and how the scope is written before work starts.

What does it cost to run these tools for PE-6 evidence?

Software licensing is not the main cost driver, since the tools named here are open source under the licenses listed. The cost comes from the work: planning the scope, building log ingestion from physical systems, writing and tuning detection rules, hosting and storing logs, staffing reviews and keeping the platform patched. Implementation is usually a one-time effort, while hosting, log storage, rule maintenance and periodic review recur. Costs rise with the number of facilities, the volume of events, the number of device types and the retention period required. Ask any quote to separate one-time integration from recurring operations, and to state who pays for hardware, storage and on-call coverage. DeployOpen does not publish prices, and a quote follows from the written scope.

Where PE-6 programs usually fall short

Most PE-6 gaps are not missing guards or cameras. They are reviews that happen without a record, triggers that nobody defined, and monitoring that never connects to incident response. The cards below cover six gaps an assessor is likely to find, with the fix for each.

Reviews happen but are not recorded

Staff may check badge logs or video each week, but if no dated record shows who reviewed what, the assessor cannot test the review. PE-6 expects logs to be reviewed, and the examine method looks for physical access monitoring records. Keep a simple review log with the reviewer, date, period covered, anomalies found and the follow-up ticket reference. Ask whether the log is retained with the same care as the access logs themselves.

No event-triggered review defined

PE-6 requires logs to be reviewed at a defined frequency and when defined events occur. Many programs define only a routine schedule and never name the triggers. Typical candidates include a door forced alarm, an access attempt outside authorized hours, a lost badge report or a tailgating incident. Write each trigger down, assign an owner and state how quickly the review must start.

Facility operator logs not obtained

If your organization leases space in a colocation facility or shared data center, the building operator often controls badge systems, guard logs and video. Your PE-6 evidence then depends on records you do not hold. Confirm in the contract whether you can request physical access logs for your cage or suite, how far back they go and how quickly the operator delivers them. Without that, the monitoring requirement cannot be tested for the systems you run.

Incident response not linked

PE-6 requires the results of log reviews and investigations to be coordinated with the incident response capability. A review that finds a suspicious entry but never opens an incident record leaves the link broken. Define the handoff point, such as a severity threshold that opens a ticket for the incident response team, and test it once with a tabletop scenario. Confirm that the incident response plan names physical security events as an input.

Monitoring sources not inventoried

Access monitoring often spans badge readers, door sensors, guard tours, video recorders and alarm panels, sometimes run by different teams. A program that cannot list its sources cannot show that all physical access to the system's facility is monitored. Build an inventory with the device or service, location, owner, log destination and retention period. Reconcile it against the facility floor plan at least once a year and after any building change.

Review frequency left undefined

PE-6 uses a defined frequency for log review, which means the organization must set the value and document it. Some programs write that reviews occur regularly, which an assessor cannot test. Choose a specific interval for routine reviews, document the reason for it based on facility risk, and get the system owner to approve it. Check that the approved value appears in the system security and privacy plan and in the procedure, and that the actual review dates match it.

PE-6 questions buyers ask before bringing in help

How much effort does PE-6 physical access monitoring take?

Effort depends mostly on how many facilities hold the system, how many entry points they have, and how monitoring is already run. PE-6 has two recurring parts: monitoring physical access in real time through guards, video or sensors, and reviewing physical access logs on a defined frequency and after defined events. The one-time parts are defining the monitoring procedure, deciding review frequency and event triggers, and connecting results to the incident response plan. Ask any partner to split its quote into setup work and recurring review work, and to state which facility-owned tasks it assumes. The NIST SP 800-53B baseline selection (moderate adds PE-6(1), high adds PE-6(1) and PE-6(4)) also changes the scope, so confirm the baseline first.

Can a self-hosted tool produce the evidence for PE-6?

Partly. A self-hosted tool can produce the logs and alerts that show who did what, but it cannot monitor a door or a camera. Physical access badge events, visitor logs and video records come from the facility's access control and video systems, which are usually vendor products. Once those events are exported, a self-hosted log platform such as Wazuh can decode them, compare them against rules and write alerts to alerts.log and alerts.json, and OpenSearch Security Analytics can apply Sigma rules and record findings with a severity. Confirm that your access control system can export events in a format your collector accepts, and that the export is protected and retained as the assessor expects.

What does the facility team need to provide for PE-6?

The facility team owns the physical controls, so most of the input comes from them. Expect to need the list of monitored entry points, the current guard and video coverage, the access control vendor and export options, the schedule for guard tours or camera review, and the names of staff who review events. Facility staff also need to agree on what counts as a defined event that triggers a review, such as a forced door alarm or a badge denial pattern. A partner can document these decisions and build the evidence pipeline, but the facility must confirm they operate as written.

Does a colocation provider's monitoring count toward PE-6?

It can, but only if your organization can show that the provider's monitoring covers the facility where your system resides and that your organization has a way to see the results. Many colocation contracts state that the provider handles physical security, which does not by itself satisfy PE-6 for your system. Ask the provider for its monitoring procedures, log retention, and how it notifies customers of incidents. Then confirm in writing how those notices reach your incident response capability. Your system security plan should describe the split of responsibilities clearly, and your assessor will test that split.

Can a partner run the physical access log reviews for us?

A partner can prepare and operate the technical side of log reviews, such as collecting events, building review dashboards and alert rules, and documenting each review. It cannot take over accountability for the controls. Under SP 800-53, the organization owns its controls and must decide who reviews events, how often, and who investigates findings. Some organizations outsource the review task to a managed service, but the contract must name the reviewer, the frequency, the escalation path into incident response, and the records each review produces. Only an independent assessor can test and report on the control.

What will an assessor sample when testing PE-6?

SP 800-53A Rev. 5 assesses PE-6 through five determination statements using examine, interview and test methods. In practice, expect the assessor to examine the physical access monitoring procedures, a selection of physical access logs or monitoring records, and any records of reviews and investigations. They will interview the staff who monitor access and the incident response staff, and they may test whether monitoring processes run as written. Prepare a sample of dated review records, linked incident tickets for any events, and proof that review findings reached the incident response team. Ask your assessor which samples they expect and over what period.

How long does preparing PE-6 evidence take?

No fixed duration applies, because it depends on the number of facilities, the state of existing monitoring records and whether the access control system can export events. Work usually runs in three stages: confirm the baseline and responsibilities, build procedures and evidence collection, then run reviews long enough to produce a record history an assessor can sample. The last stage is the one most often underestimated, because an assessor needs dated records over a period, not a single review. Ask any partner for a written scope and timeline before work starts, and ask your assessor what observation period they expect.

How DeployOpen scopes PE-6 work

Every PE-6 engagement starts with a written scope that names the facilities, the systems housed there, the physical access sources in use (badge readers, guard logs, camera feeds, door sensors and visitor sign-in) and the log destinations that will be built or connected. DeployOpen works fixed-scope: the deliverables, the systems in scope and the completion conditions are agreed in writing before work begins, and the quote follows from that document. For PE-6 the deliverables usually include a configured collection path from physical access systems into a central log platform, parsing and enrichment for the fields that matter, detection rules for events such as after-hours entry or repeated denied badge attempts, a review schedule with a named reviewer, and an evidence pack that shows the monitoring running. Ask the partner to list each deliverable against a defined frequency and an owner, so no review obligation is left implied.

The division of responsibility matters as much as the technical scope. The organization owns PE-6. It decides which events are reviewed and how often, who investigates an alert, when a physical incident is escalated to its incident response capability, and whether a monitoring gap is accepted as a risk. DeployOpen prepares the systems, log pipelines and evidence that let those decisions be carried out and recorded, and it can run agreed technical checks on the pipeline. It does not issue assessment reports, attestations or certifications, and it does not decide that the control passes. Independent assessors make that determination. Before signing, confirm who performs each review step, where review records are kept, and which retainer or handover covers operation after the initial build. Expect the written scope to say so explicitly.

How DeployOpen prepares PE-6 evidence

DeployOpen prepares the systems, logs and documented review process that show PE-6 monitoring working in your facility. The organization keeps ownership of its physical security controls, and an independent assessor decides whether the control is met.

How we scope

Agree in writing which facilities, access points and monitoring sources fall within the PE-6 scope
Confirm which log sources and review cadence the organization has defined for physical access records
Identify incident response contacts who must receive review results and investigation outcomes
Engagements are fixed-scope, with deliverables and timelines agreed before work starts

How we build

Configure log collection from the self-hosted platforms that record system and facility-linked access events
Set up detection rules that flag anomalous access activity and route alerts to the responsible reviewers
Build a review workflow that records each scheduled and event-driven review with its findings
Test that alerts reach the incident response queue and that the review trail is complete and retained

How we hand over

Document the monitoring procedure, review schedule, alert rules and escalation paths in plain language
Deliver sample review records and incident coordination evidence that an assessor can examine
Provide a walkthrough so staff can explain the monitoring process to interviewers
Confirm with your assessor which artifacts they expect before the assessment begins

How we support

Ongoing support, upgrades and continuous testing are available as a retainer
Review rule tuning and log source changes after facility or system changes
Refresh documentation when the organization updates its PE policy or incident response plan
Ask your assessor or certification body to confirm the final determination, since DeployOpen does not issue assessment reports