AO coverage. Addresses all Manage Physical Access objectives: physical access devices are identified, controlled, and managed.

Identified. One register lists every physical access device: each badge with its holder and zone groups, each brass key by keyway and stamped number with its custodian, each keypad door with its PIN age and the list of people who know it, and the spares held in the safe. Building the register the first time turned up eleven unaccounted keys, which was itself the most valuable output of this control.

Controlled at issue. Devices are issued only against an approved request through the same workflow as logical access, and the recipient signs for it. Spares and blanks live in a safe in the IT area with two custodians; the keyway is a restricted profile so a copy cannot be cut at a hardware store. Nobody carries a master except the facilities lead, and that key is signed out for a specific purpose rather than held permanently.

Controlled in use. Keys may not leave the building except for the facilities lead's on-call key. Keypad PINs are individual where the hardware supports it; where it does not, the shared PIN is treated as a weak control, the door behind it holds nothing in scope, and it is on the list to be replaced with a reader.

Managed over time. Return is enforced at offboarding — the checklist itemizes each device from the register by serial or stamp, and the ticket cannot close with an outstanding item. Lost badges are deactivated immediately on report; a lost key triggers a risk decision, and for the server room or a CUI storage cabinet the decision is rekey, which we have done once. Shared PINs rotate on a schedule and immediately on any departure of someone who knew them.

Maintenance. Quarterly inventory: badges reconciled against the active roster automatically, keys physically sighted or accounted for by custodian signature. Annual review of which doors still need mechanical keys at all, with the long-term goal of eliminating them.

Accepted gap. The two keypad doors cannot log who entered, only that the door opened. Both lead to areas without in-scope systems, camera coverage compensates, and their replacement is on the facilities plan for next year.

• Physical access device register covering badges, keys, and keypad doors
• Signed issue records and the key custody log
• Offboarding checklist itemizing device return, plus a completed example
• Rekey work order and the loss report that triggered it
• Quarterly physical inventory results with custodian signatures