Physical Access Logs

A paper sign-in sheet is a compliant audit log.

The requirement's discussion accepts procedural logs, automated logs, or a combination. A visitor logbook at the door plus badge system records for employees covers a typical office, and neither requires new spending.

Log the controlled areas, not just the front door.

Physical access points include interior areas with supplemental controls, such as a server room. Where the room has its own badge reader, its log answers this. Where it has a key, a key sign-out sheet does.

Cameras can be the log.

Motion-triggered footage where every clip carries a timestamp is a chronological record of access. For a facility with several entrances and no badge readers, timestamped camera coverage of the entry points is a workable log that asks nothing of anyone day to day.

Define a retention period and honor it.

The requirement says maintain and leaves the period to you. Pick a number, write it into the procedure, and keep the logs that long, because the assessor checks your practice against your own stated period.

Maintained means reviewable, not reviewed.

No objective requires a routine review of these logs. Keep them retrievable so an investigation can reconstruct who was where. A folder of sign-in sheets meets that bar.

This is another of the six requirements 32 CFR 170.21 keeps off any POA&M.

A POA&M, a plan of action and milestones, defers an unmet requirement past the assessment, and a missing log cannot be deferred that way. Have the log running before the assessment, not after it. A sheet of paper and a pen start the evidence today.