PS-04 Physical Site Access Control
Changed since C5:2020
Basic criterion
Linguistic adaptations, changed order of requirements within the criterion.
Linked criterion to the policy defined in IAM-01.
Removed requirement that revocation of access authorisations have to occur automatically, and that a withdrawal has to occur after six months. Instead add that exceptions to the revocation period can only be made in well-founded individual cases.
Extended aspects to be addressed in the physical access control policy by exceptions in case of emergencies.
Extended requirements regarding visitors and external personnel to be addressed in the physical access control policy.
Extended requirement regarding the use of an access control system by having this system support authentication, authorisation, and log of entry and exit events.
Bullet points are now sorted to ease discussions about specific list items.
Wording in C5:2020
Basic criterion
At access points to premises and buildings related to the cloud service provided, physical access controls are set up in accordance with the Cloud Service Provider's security requirements (cf. PS-01 Security Concept) to prevent unauthorised access.
Access controls are supported by an access control system.
The requirements for the access control system are documented, communicated and provided in a policy or concept in accordance with SP-01 and include the following aspects:
- Specified procedure for the granting and revoking of access authorisations (cf. IDM-02) based on the principle of least authorisation ("least-privilege-principle") and as necessary for the performance of tasks ("need-to-know-principle");
- Automatic revocation of access authorisations if they have not been used for a period of 2 month;
- Automatic withdrawal of access authorisations if they have not been used for a period of 6 months;
- Two-factor authentication for access to areas hosting system components that process cloud customer information;
- Visitors and external personnel are tracked individually by the access control during their work in the premises and buildings, identified as such (e.g. by visible wearing of a visitor pass) and supervised during their stay; and
- Existence and nature of access logging that enables the Cloud Service Provider, in the sense of an effectiveness audit, to check whether only defined personnel have entered the premises and buildings related to the cloud service provided.
Basic criterion
Preventive and detective physical access controls in premises and buildings related to the cloud service provided are implemented. They are in accordance with the cloud service provider's security requirements (cf. PS-01) and based on the principles defined in IAM-01 to prevent unauthorised access. They are documented and communicated in a policy or framework in accordance with SP-01 and include the following aspects:
- Specified procedure for the granting and modifying of user accounts and access rights (cf. IAM-02) based on the 'least-privilege-principle' and the 'need-to-know-principle';
- Revocation of access authorisations if they have not been used for a period of two months. Exceptions are only made for well-founded individual cases and follow a defined exception process according to SP-03;
- Authentication with at least one factor for access to any non-public area;
- Multi-factor authentication for access to areas hosting system components that process cloud service customer data;
- Existence and nature of access logging that enables the cloud service provider, in the sense of an effectiveness audit, to check whether only defined personnel have entered the premises and buildings related to the cloud service provided;
- Physical access control exceptions applicable in case of emergency, including an analysis procedure following every use of these exceptions; and
- For visitors and external personnel, measures that ensure identification and tracking of every individual such that their activities are traceable and - in case of activities that infringe information security - stoppable in an appropriate reaction time. These measures are appropriate and proportional to the sensitivity of the zone the visitors or external personnel are in. The appropriate reaction time frame is determined based on a risk assessment (cf. OIS-07).
Supplementary information
For implementing access control based on the need-to-know-principle, a zoning framework can be deployed with each on-premises area having separate access permissions. If a zoning framework is implemented, each on-premises area should be physically separated with its own access control system. Examples for zoning on-premises can be:
- Green zone: Public area, contains no resources that are relevant to the provisioning of the cloud service;
- Yellow zone: Private area, contains means for supporting the cloud service such as development, administration and supervision; and
- Red zone: Sensitive area for production systems such as the server rooms.
Examples for reasonable exceptions to the revocation of access authorisations after two months of inactivity are e.g. cases where personnel with specific roles, such as management positions or supervisors, requires only occasional but crucial entry. The rationale for the exceptions should be documented and during the review critically assessed if they are still necessary.
The cloud service provider displays a warning at the entrance of each applicable non-public area regarding its limits and access conditions.
Physical access control to the site is managed by an electronic access control system that supports authentication, authorisation, and logging of entry and exit events.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources