NIST SP 800-66 Rev 2
Physical

NIST SP 800-66 Rev 2 164.310(a)(2)(iii): Access Control and Validation Procedures (Addressable)

Implement procedures to control and validate access to facilities based on role or function, including visitor control and access to software programs for testing and revision.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 57 controls across 18 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

CMMC 2.0 · 7 controls

CIS Controls v8 · 5 controls

  • CIS-16.8 Separate Production and Non-Production Systems
  • CIS-5.1 Establish and Maintain an Inventory of Accounts
  • CIS-6.1 Establish an Access Granting Process
  • CIS-6.2 Establish an Access Revoking Process
  • CIS-6.8 Define and Maintain Role-Based Access Control

FedRAMP High · 5 controls

  • CM-5 Access Restrictions for Change
  • MA-5 Maintenance Personnel
  • PE-2 Physical Access Authorizations
  • PE-3 Physical Access Control
  • PE-8 Visitor Access Records

FedRAMP Moderate · 5 controls

  • CM-5 Access Restrictions for Change
  • MA-5 Maintenance Personnel
  • PE-2 Physical Access Authorizations
  • PE-3 Physical Access Control
  • PE-8 Visitor Access Records

NIST SP 800-53 Rev 5 · 5 controls

ISO 27001:2022 · 4 controls

  • 7.2 Physical entry
  • 7.6 Working in secure areas
  • 8.31 Separation of development, test and production environments
  • 8.4 Access to source code

NIST SP 800-161 Rev 1 · 4 controls

PCI DSS 4.0 · 4 controls

  • 9.2.1 9.2.1 Facility entry controls for CDE systems
  • 9.3.1 9.3.1 Personnel physical access procedures for the CDE
  • 9.3.2 9.3.2 Visitor access procedures for the CDE
  • 9.3.3 9.3.3 Visitor badges returned or deactivated

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 3 controls

NIST SP 800-171 Rev 3 · 3 controls

SOC 2 · 3 controls

  • SOC2-CC6.2 CC6.2 Registering and authorising users before issuing credentials
  • SOC2-CC6.3 CC6.3 Role-based access, least privilege and segregation of duties
  • SOC2-CC6.4 CC6.4 Restricting physical access to facilities and assets

ISO 27002:2022 · 2 controls

  • 7.2 Physical entry
  • 7.6 Working in secure areas

ISO 27701:2019 · 2 controls

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

  • ANSSI-HYG-26 Control and Protect Access to Server Rooms and Technical Areas

Authorised Economic Operator (AEO) Programmes - Global Standards · 1 control

C5 (Germany) · 1 control

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

  • CFTC-SS-6 Physical Security and Environmental Controls Category

NIST Cybersecurity Framework 2.0 · 1 control

  • NIST-CSF-PR.AA-06 Physical access to assets is managed, monitored, and enforced commensurate with risk

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Physical

Query this from an agent

The graph holds this control, the 57 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-66 Rev 2 controls