# Turn CJIS physical-access logs into quarterly incident-review input > CJIS policy links monitoring of physical access with quarterly and incident-driven review. Use logs to identify patterns, not merely to prove that a reader produced events. - Canonical URL: https://update.dsesecurity.com/updates/turn-cjis-physical-access-logs-into-quarterly-incident-review-input/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-08-25T21:35:45+00:00 - Modified: 2026-08-25T21:36:17+00:00 - Last reviewed by DSE: 2026-08-25 - Resource type: Playbook - DSE priority: Important - Topics: Access Control, Cybersecurity - Reading time: 3 minutes ## What you need to know CJIS policy links monitoring of physical access with quarterly and incident-driven review. Use logs to identify patterns, not merely to prove that a reader produced events. ## Potentially affected Organizations applying FBI CJIS Security Policy physical-access monitoring requirements to facilities, controlled areas, or information-system components. ## DSE recommendation Create a quarterly review that joins PACS, visitor, alarm, and incident records, documents anomalies and disposition, and triggers an additional review after relevant incidents. ## Article Bottom line: collecting door events is not the same as monitoring access. A meaningful review asks whether the sequence, time, person, area, and related incident make sense, and it records how each exception was resolved. ## Source fact: CJIS policy requires recurring and incident-driven review The [FBI CJIS Security Policy v6.1 — PE-6 Monitoring Physical Access](https://le.fbi.gov/file-repository/cjis_security_policy_v6-1_20260625.pdf#page=210), dated June 25, 2026, addresses monitoring physical access to information systems. It calls for reviewing physical-access logs at least quarterly and when incidents indicate a need for review, in coordination with the incident-response function. The policy gives examples of potentially significant activity such as access outside normal work hours, repeated access to areas not normally accessed, access for unusual lengths of time, and out-of-sequence access. Those examples turn a compliance calendar into an investigative process. The reviewer needs enough context to distinguish maintenance, shift work, reader faults, shared credentials, forced access, and unauthorized behavior. ## Source boundary and applicability The policy’s applicability depends on criminal justice information, agency role, contract, system and facility boundary, and direction from the CJIS Systems Agency or Information Security Officer. The policy does not prescribe one PACS report or guarantee that a local log contains the fields needed for review. Current agency requirements and retention rules govern. ## Applicability questions - Which facilities, areas, systems, and components are included in the review population? - Which PACS, visitor, guard, alarm, key, and incident sources provide relevant evidence? - Are identity, door, result, time, reason, and administrative-change fields trustworthy and synchronized? - Who investigates out-of-hours, repeated, unusual, or out-of-sequence activity? - Which incident types trigger an immediate additional review and how far back should it reach? ## DSE recommendation: run a documented, risk-ranked review The following steps are DSE recommendations based on the cited source. Define the in-scope data sources, review cadence, incident triggers, reviewer, escalation owner, and disposition vocabulary. Normalize door and person identifiers and protect source logs from unauthorized alteration. Each quarter, examine high-risk doors and accounts, after-hours access, repeated denials, forced or held doors, administrative grants, disabled-account use, unusual sequences, and gaps in logging. Join records with approved work orders, schedules, visitor sponsors, and incident cases. Do not close an anomaly merely because a badge was valid; confirm that the person, purpose, time, route, and authorization align. Open an incident or corrective ticket when they do not. Record coverage limitations and fix missing events or unsynchronized time. ## Verification and evidence Retain the applicability decision, quarterly review procedure, source inventory, completeness and time checks, protected review output, exception samples, investigation and disposition records, incident-triggered reviews, management sign-off, and remediation tracking. Protect criminal justice information and personal data in accordance with current policy. ## Official references - [FBI CJIS Security Policy v6.1 — PE-6 Monitoring Physical Access](https://le.fbi.gov/file-repository/cjis_security_policy_v6-1_20260625.pdf#page=210) – Federal Bureau of Investigation; June 25, 2026 ## Primary reference - Name: FBI CJIS Security Policy v6.1 — PE-6 Monitoring Physical Access - Authority: le.fbi.gov - URL: https://le.fbi.gov/file-repository/cjis_security_policy_v6-1_20260625.pdf#page=210 - Source publication date: 2026-06-25 ## Citation and use Preferred citation: “Turn CJIS physical-access logs into quarterly incident-review input,” DSE Security, https://update.dsesecurity.com/updates/turn-cjis-physical-access-logs-into-quarterly-incident-review-input/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.