Cyber Resilience

NIST 800-53 r5 · Controls catalogue · Family PE

PE-3Physical Access Control

Enforce physical access authorizations at {{ insert: param, pe-03_odp.01 }} by: Verifying individual access authorizations before granting access to the facility; and Controlling ingress and egress to the facility using {{ insert: param, pe-03_odp.02 }}; Maintain physical access audit logs for {{ insert: param, pe-03_odp.04 }}; Control access to areas within the facility designated as publicly accessible by implementing the following controls: {{ insert: param, pe-03_odp.05 }}; Escort visitors and control visitor activity {{ insert: param, pe-03_odp.06 }}; Secure keys, combinations, and other physical access devices; Inventory {{ insert: param, pe-03_odp.07 }} every {{ insert: param, pe-03_odp.08 }} ; and Change combinations and keys {{ insert: param, pe-3_prm_9 }} and/or when keys are lost, combinations are compromised, or when individuals possessing the keys or combinations are transferred or terminated.

Last updated: 04 July 2026 08:17 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: mostly · 2 mapping(s) from 1 framework(s): CSF 2.0 2 (mostly)

See the full cumulative-coverage rollup →

Implementations targeting this control (0)

ATT&CK techniques this control mitigates (0)

Weaknesses this control addresses (5)AI

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

CWE Name CVEs Why this control addresses it
CWE-306Missing Authentication for Critical Function2,820Requires verification of individual access authorizations before granting facility entry, addressing missing authentication for critical physical access.
CWE-732Incorrect Permission Assignment for Critical Resource1,875Mandates securing keys/combinations, periodic inventory, and rotation on compromise or personnel changes to correct improper physical permission assignments.
CWE-552Files or Directories Accessible to External Parties563Controls access to facility areas (including publicly accessible zones) to prevent external parties from reaching internal resources or sensitive locations.
CWE-778Insufficient Logging25Requires maintenance of physical access audit logs, directly mitigating insufficient logging of access attempts and events.
CWE-1263Improper Physical Access Control13Directly implements physical access authorizations, ingress/egress controls, visitor escorting, and key/combination management to prevent unauthorized physical entry.

Top CVEs where this control is the strongest mitigation

CVE Risk CVSS EPSS Match
CVE-2022-212808.06.30.7655good
CVE-2024-01485.57.60.0028good
CVE-2025-24200 KEV10.06.10.0491good
CVE-2025-24984 KEV10.04.60.0183good
CVE-2022-214908.06.30.7867good
CVE-2022-215508.06.30.5070good
CVE-2026-307047.09.10.0031good
CVE-2024-488315.58.40.0016good
CVE-2026-238535.58.40.0016good
CVE-2026-241545.57.60.0026good
CVE-2024-442865.57.50.0034good
CVE-2024-572615.57.10.0027good
CVE-2024-572545.57.10.0036good
CVE-2015-1769 KEV10.06.60.0434partial
CVE-2024-570407.09.80.0112partial
CVE-2024-570617.09.80.0066good
CVE-2024-481235.58.40.0018good
CVE-2025-211035.57.80.0020good
CVE-2024-111475.57.60.0039partial
CVE-2026-326065.57.60.0014good
CVE-2024-572595.57.10.0036good
CVE-2022-509765.57.70.0014good
CVE-2026-200105.57.40.0017partial
CVE-2025-206413.56.60.0008good

Other controls in family PE

PE-1 PE-10 PE-11 PE-12 PE-13 PE-14 PE-15 PE-16 PE-17 PE-18 PE-19 PE-2 PE-20 PE-21 PE-22 PE-23 PE-4 PE-5 PE-6 PE-7 PE-8 PE-9