Cyber Resilience

NIST 800-53 r5 · Controls catalogue · Family PE

PE-3Physical Access Control

Enforce physical access authorizations at {{ insert: param, pe-03_odp.01 }} by: Verifying individual access authorizations before granting access to the facility; and Controlling ingress and egress to the facility using {{ insert: param, pe-03_odp.02 }}; Maintain physical access audit logs for {{ insert: param, pe-03_odp.04 }}; Control access to areas within the facility designated as publicly accessible by implementing the following controls: {{ insert: param, pe-03_odp.05 }}; Escort visitors and control visitor activity {{ insert: param, pe-03_odp.06 }}; Secure keys, combinations, and other physical access devices; Inventory {{ insert: param, pe-03_odp.07 }} every {{ insert: param, pe-03_odp.08 }} ; and Change combinations and keys {{ insert: param, pe-3_prm_9 }} and/or when keys are lost, combinations are compromised, or when individuals possessing the keys or combinations are transferred or terminated.

Last updated: 20 August 2026 13:14 UTC

Implementations targeting this control (0)

ATT&CK techniques this control mitigates (0)

Weaknesses this control addresses (5)AI-assisted

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

CWE Name CVEs Why this control addresses it
CWE-306Missing Authentication for Critical Function3,300+Requires verification of individual access authorizations before granting facility entry, addressing missing authentication for critical physical access.
CWE-732Incorrect Permission Assignment for Critical Resource1,900+Mandates securing keys/combinations, periodic inventory, and rotation on compromise or personnel changes to correct improper physical permission assignments.
CWE-552Files or Directories Accessible to External Parties500+Controls access to facility areas (including publicly accessible zones) to prevent external parties from reaching internal resources or sensitive locations.
CWE-778Insufficient Logging28Requires maintenance of physical access audit logs, directly mitigating insufficient logging of access attempts and events.
CWE-1263Improper Physical Access Control13Directly implements physical access authorizations, ingress/egress controls, visitor escorting, and key/combination management to prevent unauthorized physical entry.

Top CVEs where this control is the strongest mitigation

CVE Risk CVSS EPSS Match
CVE-2024-48973 6.49.30.0022good
CVE-2023-38290 5.77.80.0019good
CVE-2024-28326 5.16.80.0027good
CVE-2025-4386 5.06.80.0016good
CVE-2022-32506 4.96.40.0043good
CVE-2024-39512 4.96.60.0022good
CVE-2025-6785 3.54.70.0022good
CVE-2025-596962.83.20.0021good
CVE-2025-8762 5.06.80.0018good
CVE-2024-36438 5.47.30.0019good

Other controls in family PE

PE-1 PE-10 PE-11 PE-12 PE-13 PE-14 PE-15 PE-16 PE-17 PE-18 PE-19 PE-2 PE-20 PE-21 PE-22 PE-23 PE-4 PE-5 PE-6 PE-7 PE-8 PE-9