Physical entry controls system evaluation
The physical entry control system is graded on a six-point ladder.
What the published 2016 guidance says
The physical entry control system is graded on a six-point ladder. Zero means no access control; one, a PIN; two, a pass card; three, card and PIN; four, the previous level with active logging; five, the previous level with the PIN replaced by biometrics. A grade of three is treated as satisfactory. The evidence is a qualitative assessment of the installation, covering the card system, PIN use, logging and biometrics. It is collected, analysed and reported yearly, with a twelve-month review. The facility manager owns it, internal or external audit collects, and the management committee is the client.
What it means in practice
This is a maturity scale for a physical control, from no system to biometric entry with logging. The value is the explicit ladder: a reader can see why a score of 2 is weaker than 3, and the assessor can test the claim against the installation.
Status of this record. For B.19, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Assess each facility against the ladder and record the grade with the evidence. Report the distribution, not only the average. Set a target grade for each facility class and review it yearly.
Evidence an assessor asks for
- Physical securityAssessment record of the entry control system against the scale
- Physical securityAuditor's inspection notes on card, PIN, logging and biometrics
The question an assessor will ask
An assessor will ask for assessment record of the entry control system against the scale. The test for B.19 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Grade assigned from the design rather than from inspection of what is active
- Logging installed but not activated, wrongly scored at 4
Before the next review
Before the next review, test this against one live record: grade assigned from the design rather than from inspection of what is active.
What to check when the revision publishes
When DIS 27004 is published, compare the B.19 Physical entry controls system evaluation record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.