Network Trace
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

05) For how many months does your organisation keeps its physical access control audit logs?

August 30, 2022
Physical Security
Building Access Control Logs

Please state the number of months that the access logs are kept for. If different retention times are used depending on the access control system, please state the different retention times in the notes and enter the lowest retention time in the answer box.

Physical access control logs are an auditable record of the date, time, location, and user identity of each valid and invalid entry attempt to your premises, and the reason for denial of access for each invalid entry attempt. A log can be manual or electronic. If you use a physical access control system, it should generate and store these logs for you.

Retention of the access log data is vital to support any subsequent investigation after a security incident, which can be some months after the actual event. Unless there is a local legislative ruling, it is recommended that access log data be kept for a minimum period of 12 months.

How to implement the control

As per control G4, an access control system should be implemented by an access control or physical security specialist who can help you to choose the correct specification of system and configure the system in a secure manner. The system should be configured to store all physical access logs. These logs should be protected using encryption controls.

For SMEs, most offices for rent will use an access control system that is under the control of the landlord. Speak to your landlord to find out how long the logs are kept for, and for the controls in place to protect the logs.

If you would like to contribute to this article or provide feedback, please email Contributors will be recognised on our contributors page.

Pattern Trapezoid Mesh

Defend against supply chain attacks with Defend-As-One.

No organisation is an island.