Scope Enterprise Active

Physical & Environmental Security

To protect the organization's physical assets, personnel, and facilities.

Domain ID
DOM-023
Domain Code
PHY
Business Owner
Facilities Security

Domain Overview

PHY · Full Domain Profile
Short Overview

Establishes the processes for securing physical facilities, protecting personnel, and managing environmental threats to critical infrastructure.

Description

Establishes controls to protect physical facilities and data centers from unauthorized access, environmental hazards, and other physical threats.

Why This Domain Matters

Physical security and cybersecurity are often managed by separate teams with limited coordination, missing the convergence of physical and digital threats.

Business Objectives

    Business Risks

      Common Challenges

        Key Capabilities

        Stakeholders, Industries & Technologies

        PHY · Operating Context

        Typical Stakeholders

        Applicable Industries

        Applicable Technologies

        Keywords & Tags

        Associated Controls Catalog

        6 Active Controls in Domain
        Control ID Control Name Category & Type Criticality Status Requirements Action
        PHY-001 Physical Security & Facility Access Management Establishes physical security including...
        Physical
        Detective
        		 Critical Active 📋 10 Reqs View →
        PHY-002 Environmental & Infrastructure Protection Establishes environmental protection inc...
        Physical
        Detective
        		 High Active 📋 10 Reqs View →
        PHY-003 Data Center & Critical Facility Security Establishes critical facility security i...
        Physical
        Detective
        		 Critical Active 📋 10 Reqs View →
        PHY-004 Sensitive Asset & Equipment Protection Establishes equipment protection includi...
        Physical
        Detective
        		 High Active 📋 10 Reqs View →
        PHY-005 Physical Media Handling & Secure Disposal Establishes physical media handling incl...
        Physical
        Corrective
        		 High Active 📋 10 Reqs View →
        PHY-006 Physical Emergency Preparedness & Response Establishes emergency preparedness inclu...
        Physical
        Corrective
        		 High Active 📋 10 Reqs View →

        Compliance Requirements & Audit Crosswalk

        60 Specific Audit Clauses

        The following requirements dictate specific audit evidence criteria and testing steps mapped directly under the controls of this domain.

        REQUIREMENT ID REQUIREMENT TITLE & DETAILS MAPPED CONTROL TYPICAL OWNER ACTION
        PHY-001-R001 Physical Security Governance The organization shall establish a physi... PHY-001 Physical Security & Facility A... Physical Security, Facilities, Security Operations, HR View ↗
        PHY-001-R002 Facility Access Authorization The organization shall authorize facilit... PHY-001 Physical Security & Facility A... Physical Security, Facilities, Security Operations, HR View ↗
        PHY-001-R003 Physical Access Control The organization shall implement physica... PHY-001 Physical Security & Facility A... Physical Security, Facilities, Security Operations, HR View ↗
        PHY-001-R004 Visitor Management The organization shall manage visitor ac... PHY-001 Physical Security & Facility A... Physical Security, Facilities, Security Operations, HR View ↗
        PHY-001-R005 Identification & Badging The organization shall implement identif... PHY-001 Physical Security & Facility A... Physical Security, Facilities, Security Operations, HR View ↗
        PHY-001-R006 Perimeter Security The organization shall implement perimet... PHY-001 Physical Security & Facility A... Physical Security, Facilities, Security Operations, HR View ↗
        PHY-001-R007 Surveillance Monitoring The organization shall implement surveil... PHY-001 Physical Security & Facility A... Physical Security, Facilities, Security Operations, HR View ↗
        PHY-001-R008 Physical Access Review The organization shall conduct periodic... PHY-001 Physical Security & Facility A... Physical Security, Facilities, Security Operations, HR View ↗
        PHY-001-R009 Physical Access Logging The organization shall maintain comprehe... PHY-001 Physical Security & Facility A... Physical Security, Facilities, Security Operations, HR View ↗
        PHY-001-R010 Continuous Improvement The organization shall establish a conti... PHY-001 Physical Security & Facility A... Physical Security, Facilities, Security Operations, HR View ↗
        PHY-002-R001 Environmental Protection Framework The organization shall establish an envi... PHY-002 Environmental & Infrastructure... Facilities, Physical Security, Infrastructure Operations, Business Continuity View ↗
        PHY-002-R002 Power Protection The organization shall implement power p... PHY-002 Environmental & Infrastructure... Facilities, Physical Security, Infrastructure Operations, Business Continuity View ↗
        PHY-002-R003 Cooling Management The organization shall implement cooling... PHY-002 Environmental & Infrastructure... Facilities, Physical Security, Infrastructure Operations, Business Continuity View ↗
        PHY-002-R004 Fire Detection The organization shall implement fire de... PHY-002 Environmental & Infrastructure... Facilities, Physical Security, Infrastructure Operations, Business Continuity View ↗
        PHY-002-R005 Fire Suppression The organization shall implement fire su... PHY-002 Environmental & Infrastructure... Facilities, Physical Security, Infrastructure Operations, Business Continuity View ↗
        PHY-002-R006 Water Protection The organization shall implement water p... PHY-002 Environmental & Infrastructure... Facilities, Physical Security, Infrastructure Operations, Business Continuity View ↗
        PHY-002-R007 Environmental Monitoring The organization shall monitor environme... PHY-002 Environmental & Infrastructure... Facilities, Physical Security, Infrastructure Operations, Business Continuity View ↗
        PHY-002-R008 Utility Redundancy The organization shall implement utility... PHY-002 Environmental & Infrastructure... Facilities, Physical Security, Infrastructure Operations, Business Continuity View ↗
        PHY-002-R009 Environmental Review The organization shall conduct periodic... PHY-002 Environmental & Infrastructure... Facilities, Physical Security, Infrastructure Operations, Business Continuity View ↗
        PHY-002-R010 Continuous Improvement The organization shall establish a conti... PHY-002 Environmental & Infrastructure... Facilities, Physical Security, Infrastructure Operations, Business Continuity View ↗
        PHY-003-R001 Data Center Security Framework The organization shall establish a data... PHY-003 Data Center & Critical Facilit... Data Center Operations, Physical Security, Facilities, IT Operations View ↗
        PHY-003-R002 Restricted Access The organization shall implement restric... PHY-003 Data Center & Critical Facilit... Data Center Operations, Physical Security, Facilities, IT Operations View ↗
        PHY-003-R003 Server Room Protection The organization shall implement protect... PHY-003 Data Center & Critical Facilit... Data Center Operations, Physical Security, Facilities, IT Operations View ↗
        PHY-003-R004 Communication Room Security The organization shall implement securit... PHY-003 Data Center & Critical Facilit... Data Center Operations, Physical Security, Facilities, IT Operations View ↗
        PHY-003-R005 Facility Monitoring The organization shall monitor data cent... PHY-003 Data Center & Critical Facilit... Data Center Operations, Physical Security, Facilities, IT Operations View ↗
        PHY-003-R006 Physical Inspection The organization shall conduct regular p... PHY-003 Data Center & Critical Facilit... Data Center Operations, Physical Security, Facilities, IT Operations View ↗
        PHY-003-R007 Critical Facility Review The organization shall conduct periodic... PHY-003 Data Center & Critical Facilit... Data Center Operations, Physical Security, Facilities, IT Operations View ↗
        PHY-003-R008 Security Logging The organization shall maintain comprehe... PHY-003 Data Center & Critical Facilit... Data Center Operations, Physical Security, Facilities, IT Operations View ↗
        PHY-003-R009 Compliance Review The organization shall conduct complianc... PHY-003 Data Center & Critical Facilit... Data Center Operations, Physical Security, Facilities, IT Operations View ↗
        PHY-003-R010 Continuous Improvement The organization shall establish a conti... PHY-003 Data Center & Critical Facilit... Data Center Operations, Physical Security, Facilities, IT Operations View ↗
        PHY-004-R001 Equipment Protection Framework The organization shall establish an equi... PHY-004 Sensitive Asset & Equipment Pr... IT Asset Management, Physical Security, Facilities, IT Operations View ↗
        PHY-004-R002 Equipment Inventory The organization shall maintain a compre... PHY-004 Sensitive Asset & Equipment Pr... IT Asset Management, Physical Security, Facilities, IT Operations View ↗
        PHY-004-R003 Physical Asset Protection The organization shall implement physica... PHY-004 Sensitive Asset & Equipment Pr... IT Asset Management, Physical Security, Facilities, IT Operations View ↗
        PHY-004-R004 Tamper Protection The organization shall implement tamper... PHY-004 Sensitive Asset & Equipment Pr... IT Asset Management, Physical Security, Facilities, IT Operations View ↗
        PHY-004-R005 Equipment Relocation The organization shall relocate sensitiv... PHY-004 Sensitive Asset & Equipment Pr... IT Asset Management, Physical Security, Facilities, IT Operations View ↗
        PHY-004-R006 Equipment Inspection The organization shall conduct regular p... PHY-004 Sensitive Asset & Equipment Pr... IT Asset Management, Physical Security, Facilities, IT Operations View ↗
        PHY-004-R007 Theft Prevention The organization shall implement theft p... PHY-004 Sensitive Asset & Equipment Pr... IT Asset Management, Physical Security, Facilities, IT Operations View ↗
        PHY-004-R008 Asset Monitoring The organization shall monitor sensitive... PHY-004 Sensitive Asset & Equipment Pr... IT Asset Management, Physical Security, Facilities, IT Operations View ↗
        PHY-004-R009 Asset Review The organization shall conduct periodic... PHY-004 Sensitive Asset & Equipment Pr... IT Asset Management, Physical Security, Facilities, IT Operations View ↗
        PHY-004-R010 Continuous Improvement The organization shall establish a conti... PHY-004 Sensitive Asset & Equipment Pr... IT Asset Management, Physical Security, Facilities, IT Operations View ↗
        PHY-005-R001 Media Classification The organization shall establish a class... PHY-005 Physical Media Handling & Secu... Records Management, IT Asset Management, Information Security, Physical Security View ↗
        PHY-005-R002 Media Storage The organization shall implement secure... PHY-005 Physical Media Handling & Secu... Records Management, IT Asset Management, Information Security, Physical Security View ↗
        PHY-005-R003 Media Transportation The organization shall transport physica... PHY-005 Physical Media Handling & Secu... Records Management, IT Asset Management, Information Security, Physical Security View ↗
        PHY-005-R004 Media Reuse The organization shall reuse physical me... PHY-005 Physical Media Handling & Secu... Records Management, IT Asset Management, Information Security, Physical Security View ↗
        PHY-005-R005 Media Destruction The organization shall physically destro... PHY-005 Physical Media Handling & Secu... Records Management, IT Asset Management, Information Security, Physical Security View ↗
        PHY-005-R006 Disposal Authorization The organization shall authorize the dis... PHY-005 Physical Media Handling & Secu... Records Management, IT Asset Management, Information Security, Physical Security View ↗
        PHY-005-R007 Disposal Verification The organization shall verify that media... PHY-005 Physical Media Handling & Secu... Records Management, IT Asset Management, Information Security, Physical Security View ↗
        PHY-005-R008 Disposal Documentation The organization shall maintain comprehe... PHY-005 Physical Media Handling & Secu... Records Management, IT Asset Management, Information Security, Physical Security View ↗
        PHY-005-R009 Media Review The organization shall conduct periodic... PHY-005 Physical Media Handling & Secu... Records Management, IT Asset Management, Information Security, Physical Security View ↗
        PHY-005-R010 Continuous Improvement The organization shall establish a conti... PHY-005 Physical Media Handling & Secu... Records Management, IT Asset Management, Information Security, Physical Security View ↗
        PHY-006-R001 Emergency Preparedness Framework The organization shall establish a physi... PHY-006 Physical Emergency Preparednes... Facilities, Physical Security, Business Continuity, Emergency Management View ↗
        PHY-006-R002 Emergency Procedures The organization shall establish emergen... PHY-006 Physical Emergency Preparednes... Facilities, Physical Security, Business Continuity, Emergency Management View ↗
        PHY-006-R003 Evacuation Planning The organization shall develop evacuatio... PHY-006 Physical Emergency Preparednes... Facilities, Physical Security, Business Continuity, Emergency Management View ↗
        PHY-006-R004 Emergency Communication The organization shall establish emergen... PHY-006 Physical Emergency Preparednes... Facilities, Physical Security, Business Continuity, Emergency Management View ↗
        PHY-006-R005 Emergency Response Resources The organization shall ensure emergency... PHY-006 Physical Emergency Preparednes... Facilities, Physical Security, Business Continuity, Emergency Management View ↗
        PHY-006-R006 Emergency Drills The organization shall conduct regular e... PHY-006 Physical Emergency Preparednes... Facilities, Physical Security, Business Continuity, Emergency Management View ↗
        PHY-006-R007 Incident Coordination The organization shall coordinate emerge... PHY-006 Physical Emergency Preparednes... Facilities, Physical Security, Business Continuity, Emergency Management View ↗
        PHY-006-R008 Recovery Activities The organization shall recover following... PHY-006 Physical Emergency Preparednes... Facilities, Physical Security, Business Continuity, Emergency Management View ↗
        PHY-006-R009 Emergency Review The organization shall conduct periodic... PHY-006 Physical Emergency Preparednes... Facilities, Physical Security, Business Continuity, Emergency Management View ↗
        PHY-006-R010 Continuous Improvement The organization shall establish a conti... PHY-006 Physical Emergency Preparednes... Facilities, Physical Security, Business Continuity, Emergency Management View ↗

        Cross-Mapped Regulatory Frameworks

        Harmonized Control Mappings
        Framework Code Framework Name & Description Family / Category Version Action
        MAPPED ASIS International Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —
        MAPPED ISO 31000 Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —
        NIST80053 NIST SP 800-53 (PE) NIST SP 800-53 Rev. 5 presents control f...
        NIST
        Control Catalog
        		 vRev. 5 View →
        COBIT2019 COBIT (APO13) COBIT is an enterprise governance and ma...
        COBIT
        Governance Framework
        		 v2019 View →
        MAPPED NFPA 1600 Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —
        MAPPED OSHA Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —
        MAPPED HIPAA Physical Security Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —