NIST Special Publication 800-53 Revision 5.1, control PE-2, calls for developing, approving, and maintaining a list of individuals authorized for physical access, issuing authorization credentials, reviewing the list at an organization-defined frequency, and removing people when access is no longer required. Its first enhancement addresses authorization based on position or role.
\nCISA’s Facility Access Control: An Interagency Security Committee Best Practice discusses the access-control process for federal facilities, including employees, visitors, screening, authentication, and physical access control systems. It stresses that risk and operations shape the selected controls.
\nBoth publications are U.S. federal guidance. They do not automatically impose a particular review interval or access model on a private organization. Applicable law, regulation, contract, collective bargaining, safety needs, building rules, and the organization’s risk decisions govern. The DSE process below is an operational recommendation, not a compliance determination.
\n\nDo not send managers a raw list of badge numbers and ask whether it “looks right.” Build a review package around people and work. For each identity, show employer or sponsor, status, role, home location, supervisor, contract end date, credential type, access levels, schedules, sensitive doors, last relevant use where lawful, and exceptions. Separate reliable source data from unresolved mismatches.
\nTrack completion by decision quality, not by percentage of emails answered. An approval with no accountable owner, “keep all,” or an unresolved system mismatch is not complete. Age outstanding reviews, suspend or escalate according to policy, and give security leadership a view of unsupported high-risk access.
\nRetain the reviewed population, data cutoff, decisions, approvers, changes, verification, unresolved exceptions, and next due date. Protect the review package because it maps people to secured areas. The result should answer two different questions with evidence: why the person needs entry, and whether the deployed system now enforces that approved need.
\nMeasure unsupported direct grants, overdue decisions, identities without sponsors, expired contractors still enabled, failed controller updates, and high-risk exceptions by age. Stop a review wave when source data is materially incomplete or the change pipeline cannot verify removals. Fix the data or deployment control first; a fast attestation on an unreliable population creates false assurance.
\n\n