Physical access badge review

Control Design Assessment (CDA)

Procedures evaluating whether the control is designed adequately.

1. 1.Obtain and read the badge-review procedure; confirm it defines the secure-area population in scope and the quarterly review cadence.
2. 2.Confirm reviewer independence from the individuals whose badge access is being reviewed.

Control Operating Effectiveness (COE)

Procedures evaluating whether the control operated over the testing period.

1. 1.Select 25 badge holders with secure-area access and confirm each was reviewed within the quarter.
2. 2.Confirm access flagged for removal during review was revoked.
3. 3.Confirm terminated employees' badges were deactivated within the defined SLA.

Linked risks

• Facility physical security lapsemitigation 3

Framework mappings & latest test