Physical access controls are employed to:

The fundamental purpose of physical access controls is to implement a security layer that protects an organization's assets. These assets include not only tangible items like computer hardware, infrastructure, and property but also intangible assets such as data and intellectual property. Critically, this protection also extends to ensuring the safety and security of the organization's personnel from unauthorized intruders or threats. Physical access controls achieve this by restricting entry to facilities and sensitive areas to only authorized individuals, thereby mitigating risks like theft, damage, and harm to people.

A. This is incorrect because the principle of access control is to restrict entry to authorized individuals, not to grant universal access.

B. While many access control systems log entries and exits, tracking employee movements is a secondary function or a byproduct, not the primary objective.

C. Ease and efficiency are desirable qualities for an access control system, but the primary goal is security, which may sometimes necessitate sacrificing convenience.

1. National Institute of Standards and Technology (NIST). (2020). Security and Privacy Controls for Information Systems and Organizations (NIST Special Publication 800-53

Revision 5). U.S. Department of Commerce. In the introduction to the Physical and Environmental Protection (PE) control family

the objective is stated as to "limit physical access to information systems

equipment

and the respective operating environments to authorized individuals" (p. 199). This directly supports the goal of protecting assets.

2. National Institute of Standards and Technology (NIST). (2018). A Recommendation for the Use of PIV Credentials in Physical Access Control Systems (PACS) (NIST Special Publication 800-116

Revision 1). U.S. Department of Commerce. Section 1.1

"Purpose

" states that the document provides guidance for "controlling physical access to Federal buildings and facilities

" which is done to protect the people and property therein (p. 1).

3. Saltzer

J. H.

& Schroeder

M. D. (1975). The Protection of Information in Computer Systems. Communications of the ACM

18(7)

387–408. This foundational paper on security principles

often cited in university curricula

establishes that a key design principle is "Least Privilege." Applied to physical security

this means access is granted only as needed to perform one's duties

reinforcing the idea that protection and restriction

not universal access

are the goals. (Principle 4

p. 9).