Physical Entry Control

Based on official sourcesISMSISMS-PCheckpoints 2Evidence 4Cases 3

Certification criterion

Protected areas must be controlled so that only authorized persons may enter, and entry and access records must be reviewed periodically to ensure accountability.

Key checkpoints

Are protected areas controlled so that only persons whose entry is permitted under the entry procedure may enter?
Are entry records of internal and external persons for each protected area retained for a defined period, and are entry records and entry permissions reviewed periodically?

Detailed explanation

Entry control procedures for internal and external persons must be established so that only authorized persons may enter each protected area, and the status of persons permitted to enter must be managed.

Define the departments/duties/tasks permitted to enter each protected area, identify the employees granted entry permission, and manage the status of such permissions
For controlled areas, restrict entry so that only the minimum necessary personnel may enter according to business purposes
Entry procedure: entry application, approval by the responsible person, granting and revocation of entry permissions, recording of entry details, periodic review of entry records, etc.
Installation of access control devices: password-based, ID card-based, biometric-based, etc.
Establishment/operation of access control procedures: registration/deletion of persons with entry rights, management of entry permissions, visitor management, entry log management, etc.

Entry records of internal and external persons for each protected area must be retained for a defined period, and entry records and entry permissions must be reviewed periodically.

Retain entry records for a defined period in documentary or electronic form so that subsequent monitoring is possible
Review of entry records and entry permissions: persons who have not entered for a long period, abnormal entry attempts, excessive granting of entry permissions, etc.
Identify unauthorized entry attempts, persons who have not entered for a long period, etc., confirm the reasons, and take action
Through periodic review, recover access passes from and delete entry permissions of departed employees, and adjust entry permissions following changes in duties
Where entry logs cannot be recorded by the system, prepare an entry logbook to verify entry records

Related laws

Personal Information Protection Act Article 29 (Duty of Safety Measures)
Standards for Measures to Ensure the Safety of Personal Information Article 10 (Physical Safety Measures)

Evidence (examples)

Entry management logbook and entry logs
Entry registration application forms and approval records
Entry record review reports
Access control system management screens (status of registered persons with entry rights, etc.)

Nonconformity examples

The case where controlled areas are defined, protective measures are established, and employees permitted to enter are managed, but entry records are not reviewed periodically, so that many persons who have not entered for a long period following departure, transfer, etc. exist
The case where access control devices are installed in controlled areas such as the computer room and document storage, but the areas are kept open for extended periods without a valid reason or approval
The case where some external partner company staff are granted access cards allowing them to enter all areas at all times to an excessive degree