Physical entry controls effectiveness
Unauthorised physical entry is a lagging measure, but a clear one.
What the published 2016 guidance says
Unauthorised physical entry is a lagging measure, but a clear one. The construct counts entries into facilities that hold information systems, as a subset of physical security incidents, and compares the current count with the previous value. The overall count of physical incidents is read beside it. The target is below 1.0. Evidence is the incident reports and the access control logs. It is collected and reported quarterly. The physical security officer owns it, the incident response team collects, and the technology and security leads are clients. The action is to review the physical controls.
What it means in practice
Unauthorised physical entry is a lagging measure but a clear one. Compare the current count with the previous period and read it with the total number of physical incidents. The action descriptor is part of the measure: review the control, do not only chart the number.
Status of this record. For B.20, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Keep the physical incident reports and the access control logs. Count unauthorised entries and compare with the previous period. Report the total physical incidents beside it. Record the control review that follows.
Evidence an assessor asks for
- Physical securityPhysical security incident reports classified for unauthorised entry
- Incident managementAccess control logs analysed per quarter
- Physical securityTrend plot and the action taken when the ratio exceeds 1.0
The question an assessor will ask
An assessor will ask for physical security incident reports classified for unauthorised entry. The test for B.20 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Physical incidents recorded by facilities and never reaching the security incident process
- Ratio reported without the context of total incident volume
Before the next review
Before the next review, test this against one live record: physical incidents recorded by facilities and never reaching the security incident process.
What to check when the revision publishes
When DIS 27004 is published, compare the B.20 Physical entry controls effectiveness record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.