Logical and physical access controls
Logical and physical access controls require that an organization restricts access to its systems, data, and facilities to authorized users only. This involves implementing mechanisms to prevent unauthorized entry and ensuring that access is granted based on the principle of least privilege.
What it means
Logical access refers to the digital protections used to secure software, networks, and data. The intent is to ensure that a user can only reach the specific systems necessary for their job function and that their identity is verified before granting entry. This covers everything from password policies and multi-factor authentication (MFA) to firewall configurations and API keys.
Physical access refers to the tangible protections surrounding your hardware, offices, and data centers. The goal is to prevent unauthorized individuals from gaining physical proximity to servers or workstations where they could steal equipment or manually compromise a system. For organizations using cloud providers like AWS or Azure, the provider handles the facility security, but the organization remains responsible for securing its own corporate offices.
In practice, these controls must cover the entire lifecycle of an identity: how access is requested and approved (provisioning), how it is monitored during employment, and how it is revoked immediately upon termination (de-provisioning).
How to meet it
- Implement Multi-Factor Authentication (MFA) for all remote access and privileged accounts.
- Establish a Role-Based Access Control (RBAC) model to ensure users have the minimum level of access required for their role.
- Formalize an onboarding and offboarding process that triggers the creation and immediate revocation of credentials.
- Conduct periodic access reviews (e.g., quarterly) where managers verify that current user permissions are still appropriate.
- Secure physical locations using badge readers, locks, or security cameras, and maintain logs of who enters sensitive areas.
- Use a centralized identity provider (IdP) to manage passwords and authentication across multiple services consistently.
Evidence an auditor asks for
- A complete list of users with access to the production environment compared against current HR employee lists.
- Tickets or emails showing formal approval from management before new access was granted to a user.
- Timestamps proving that terminated employees' accounts were disabled within the organization's defined SLA (e.g., 24 hours).
- Signed-off reports from periodic access reviews demonstrating that permissions were audited and corrected if necessary.
- Physical access logs or visitor sign-in sheets for office spaces containing critical infrastructure.
Common pitfalls
- "Ghost accounts," where former employees or contractors retain active credentials because the offboarding checklist was not followed.
- Over-provisioning, such as granting every developer "Administrator" or "Root" privileges instead of specific scoped permissions.
- Lack of documentation for access approvals; having a process in place but failing to save the tickets or emails that prove it was followed.
- Using shared accounts (e.g., one "admin" login used by three people), which destroys individual accountability and audit trails.