CVE-2023-38290

A.7.1 directly defines, builds and maintains physical perimeters that stop unauthorized physical actors from reaching the protected assets, which is the exact scenario CWE-1263 names; the bounded remainder is logical-only access-control flaws inside the perimeter that physical barriers never touch.

A.7.14 addresses secure sanitization and label removal of equipment/media being disposed or reused to stop information leakage; it has no bearing on whether a product sufficiently restricts physical access to protected areas during normal operation, so the weakness can still be present and exploitable.

A.7.2 directly mandates physical access controls (authentication, monitoring, restricted areas, visitor supervision, delivery segregation) that stop unauthorized physical actors from exploiting the weakness; the bounded remainder is non-physical vectors (e.g. remote side-channels or supply-chain tampering before delivery) that the clause explicitly isolates from its scope.

A.7.3 directly mandates physical siting, shielding, visibility controls and non-disclosure of facility locations that stop unauthorized physical actors from reaching the protected information, closing the dominant slice of CWE-1263; the bounded remainder is design-level logical access-control flaws inside the product itself that physical-facility measures do not reach.

A weakness discoverable only by hardware development or microarchitectural research (HARDWARE_ONLY_CWES) grades `finds` none against a software-development control: the frameworks we grade do not reach hardware development (owner, 2026-10-16).

A.7.6 directly mandates physical measures (no unsupervised work, locking/inspecting vacant areas, banning unauthorized recording devices, controlling endpoint devices) that stop an unauthorized actor with physical presence from interfering with or extracting the restricted information, leaving only a bounded remainder (e.g. sophisticated insider bypassing all procedural/physical barriers, or non-area-based physical attacks like emanations).