Cyber Posture

NIST 800-53 r5 · Controls catalogue · Family PE

PE-3Physical Access Control

Enforce physical access authorizations at {{ insert: param, pe-03_odp.01 }} by: Verifying individual access authorizations before granting access to the facility; and Controlling ingress and egress to the facility using {{ insert: param, pe-03_odp.02 }}; Maintain physical access audit logs for {{ insert: param, pe-03_odp.04 }}; Control access to areas within the facility designated as publicly accessible by implementing the following controls: {{ insert: param, pe-03_odp.05 }}; Escort visitors and control visitor activity {{ insert: param, pe-03_odp.06 }}; Secure keys, combinations, and other physical access devices; Inventory {{ insert: param, pe-03_odp.07 }} every {{ insert: param, pe-03_odp.08 }} ; and Change combinations and keys {{ insert: param, pe-3_prm_9 }} and/or when keys are lost, combinations are compromised, or when individuals possessing the keys or combinations are transferred or terminated.

Last updated: 09 May 2026 03:25 UTC

Implementations targeting this control (0)

ATT&CK techniques this control mitigates (0)

Weaknesses this control addresses (5)AI

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

CWE Name CVEs Why this control addresses it
CWE-306Missing Authentication for Critical Function2,567Requires verification of individual access authorizations before granting facility entry, addressing missing authentication for critical physical access.
CWE-732Incorrect Permission Assignment for Critical Resource1,824Mandates securing keys/combinations, periodic inventory, and rotation on compromise or personnel changes to correct improper physical permission assignments.
CWE-552Files or Directories Accessible to External Parties540Controls access to facility areas (including publicly accessible zones) to prevent external parties from reaching internal resources or sensitive locations.
CWE-778Insufficient Logging23Requires maintenance of physical access audit logs, directly mitigating insufficient logging of access attempts and events.
CWE-1263Improper Physical Access Control13Directly implements physical access authorizations, ingress/egress controls, visitor escorting, and key/combination management to prevent unauthorized physical entry.

Top CVEs where this control is the strongest mitigation

CVE Risk CVSS EPSS Match
CVE-2024-01481.57.60.0007good
CVE-2025-24200 KEV6.16.10.4816good
CVE-2025-24984 KEV3.14.60.0283good
CVE-2026-307041.89.10.0006good
CVE-2024-488311.78.40.0010good
CVE-2026-238531.78.40.0001good
CVE-2026-241541.57.60.0003good
CVE-2024-442861.57.50.0009good
CVE-2024-572611.47.10.0002good
CVE-2024-572541.47.10.0006good
CVE-2024-570612.09.80.0051good
CVE-2024-481231.78.40.0006good
CVE-2024-561821.68.20.0001good
CVE-2024-561811.68.20.0001good
CVE-2025-211031.67.80.0007good
CVE-2024-111471.57.60.0011partial
CVE-2026-326061.57.60.0001good
CVE-2024-121361.46.90.0001good
CVE-2024-572591.47.10.0007good
CVE-2025-206411.36.60.0003good

Other controls in family PE

PE-1 PE-10 PE-11 PE-12 PE-13 PE-14 PE-15 PE-16 PE-17 PE-18 PE-19 PE-2 PE-20 PE-21 PE-22 PE-23 PE-4 PE-5 PE-6 PE-7 PE-8 PE-9