API 1164 PR.AC-2: PR.AC-2 A physical security plan for sites with IAC cyber assets, aligned to the highest profile present

The plan must require a formal physical security plan that sets processes grounded in risk, plus operational and procedural controls, over physical access at every site holding IAC cyber assets, aligned to the risk of the highest-profile segregated environment at the site. At the Enhanced Profile the plan applies least privilege to physical access, sets controls for physical access logs (sign-in sheets, badge events), defines access during emergency response (first responders, site containment), sets layered physical barriers for assets that perform or support essential functions in proportion to the risk (control centres, control rooms, meter and valve stations) and specifies electronic monitoring and alerting.