PE.2.005 — Control Physical Access Devices

What PE.2.005 means in plain English

Keys, key cards, access codes, combinations, and badges — you need to know exactly who has what. Maintain a list of every physical access device you have issued. When someone leaves or no longer needs access, get the key back and change the code. If a key is lost, re-key the lock. This is just like managing computer passwords but for physical locks. Assessors will ask to see your key issuance list.

The assessment question

“Do you maintain an inventory of all physical access devices (keys, badges, access codes) with records of who they are issued to, and do you promptly recover or deactivate them when no longer needed?”

How to implement PE.2.005

1. Create a physical access device inventory spreadsheet listing every key, badge, and access code: the device identifier, who it is issued to, date issued, and the area it grants access to.
2. Add a step to your offboarding checklist: collect all physical access devices (keys, badges) and note the return date in your inventory. Change access codes within 24 hours if the departing employee knew them.
3. Conduct a quarterly audit: compare your inventory spreadsheet to current employees and verify no keys or badges are unaccounted for.
4. If a key or badge is reported lost, re-key the affected lock or deactivate the badge within 24 hours and document the incident.

Evidence your assessor will ask for

• Physical access device inventory (spreadsheet or database) with issuance records
• Evidence of device recovery on personnel departure (signed receipt or inventory update)
• Quarterly audit records showing inventory was reviewed and reconciled
• Incident log for lost or stolen access devices showing response actions taken

More Physical Protection controls