Bottom line: collecting door events is not the same as monitoring access. A meaningful review asks whether the sequence, time, person, area, and related incident make sense, and it records how each exception was resolved.
\nThe FBI CJIS Security Policy v6.1 — PE-6 Monitoring Physical Access, dated June 25, 2026, addresses monitoring physical access to information systems. It calls for reviewing physical-access logs at least quarterly and when incidents indicate a need for review, in coordination with the incident-response function. The policy gives examples of potentially significant activity such as access outside normal work hours, repeated access to areas not normally accessed, access for unusual lengths of time, and out-of-sequence access.
\nThose examples turn a compliance calendar into an investigative process. The reviewer needs enough context to distinguish maintenance, shift work, reader faults, shared credentials, forced access, and unauthorized behavior.
\nThe policy’s applicability depends on criminal justice information, agency role, contract, system and facility boundary, and direction from the CJIS Systems Agency or Information Security Officer. The policy does not prescribe one PACS report or guarantee that a local log contains the fields needed for review. Current agency requirements and retention rules govern.
\nThe following steps are DSE recommendations based on the cited source.
\nDefine the in-scope data sources, review cadence, incident triggers, reviewer, escalation owner, and disposition vocabulary. Normalize door and person identifiers and protect source logs from unauthorized alteration. Each quarter, examine high-risk doors and accounts, after-hours access, repeated denials, forced or held doors, administrative grants, disabled-account use, unusual sequences, and gaps in logging. Join records with approved work orders, schedules, visitor sponsors, and incident cases.
\nDo not close an anomaly merely because a badge was valid; confirm that the person, purpose, time, route, and authorization align. Open an incident or corrective ticket when they do not. Record coverage limitations and fix missing events or unsynchronized time.
\nRetain the applicability decision, quarterly review procedure, source inventory, completeness and time checks, protected review output, exception samples, investigation and disposition records, incident-triggered reviews, management sign-off, and remediation tracking. Protect criminal justice information and personal data in accordance with current policy.
\n