AO coverage. Addresses the Physical Access Logs objective: audit logs of physical access are maintained.

What is logged. Every badge read on every controlled door — grants and denials — with the credential, the door, and the timestamp. Denials matter as much as grants; a series of denials at the server room door is the signal this log exists to produce. Door-forced and door-held-open events are logged as well. Visitor entries and exits come from the kiosk record, and the landlord's paper lobby book is collected weekly and retained as a supplementary record.

Retention. Badge and kiosk records are retained for one year, which exceeds our incident lookback needs and matches the contract's records expectation. Retention is a configuration setting on the badge server plus a nightly export to the log platform, so a failure or tampering of the badge appliance does not take the only copy with it.

Integrity. Only two administrators can modify badge system configuration, and their administrative actions are themselves logged and reviewed by someone else. The nightly export lands in storage the badge administrators cannot delete. Time is synchronized from the same source as the rest of the environment so physical and logical timelines line up during an investigation.

Review, which is the part that was missing. A monthly checklist covers: after-hours access to zones 2 and 3, all server room reads compared to change tickets, repeated denials by credential and by door, and any badge used during a period the holder was known to be away. Findings are noted with a disposition even when the disposition is 'confirmed with the employee, legitimate.'

Use in incidents. The incident runbook cites the physical log as a standard evidence source; on any case involving a device or media, the responder pulls the door history for the relevant window as a matter of course.

Maintenance. Quarterly verification that every controlled door still reports events and that the nightly export ran; annual test of the retention setting by retrieving a record from eleven months back.

Accepted gap. The landlord's lobby and building entrance logging is theirs, and the paper book is easily falsified. We treat it as supplementary rather than authoritative and rely on our own suite-door reads as the first trustworthy record.

• Badge system audit report sample showing grants, denials, and door-forced events
• Retention configuration and the nightly export job to the log platform
• Completed monthly review checklists with dispositions
• Administrative action log for the badge system with independent review
• Retrieval test result for a record older than ten months