Most small defense suppliers have a lock on the server room door and a short list of people who hold a key. That list is the control, and it is also where the control fails, because keys leave no record. Nobody can tell you who opened the door last Tuesday.

Physical access authorizations (03.10.01) and physical access control (03.10.07) are both in CPCSC Level 1. An assessor wants a short list of who may enter, and some way to show that the list is what the door enforces.

Why I push access control over keys

Keys work. I recommend access control because it produces a record. Card or biometric beats a PIN, since a PIN can be known and a finger is harder to borrow. Card plus PIN belongs on the doors that matter, such as the server room and secure storage.

The rest is simple and auditors like it. Employee ID on a navy lanyard, screened contractors on yellow, visitors on red, and a card design that shows division at a glance. Exit processes that pull card access the same day the person leaves.

The credential floor

For credentials, I set the floor at 13.56 MHz Seos or iCLASS SE with custom keys, using HID's Elite program or equivalent, not the standard keyset. Use a corporate format such as HID Corporate 1000 or 2000.

Custom keys matter because of what happened in February 2024. HID's advisories, including CVE-2024-23806, showed that keys could be pulled from iCLASS SE configuration cards and encoders. The standard keyset is the one everybody has, so custom keys are the floor.

Three more settings follow from that:

  • Current firmware on the readers, with configuration-card changes locked out, so a card in the wrong hands can't reconfigure a door.
  • Legacy and 125 kHz technologies disabled at the reader. A reader that still accepts older technologies can be pushed down to them, so turn them off to stop the downgrade attack.
  • OSDP Secure Channel between reader and controller. It protects the link between the two. Readers and controllers sit on your network, so harden that network too.

Put all of it in the installer's scope of work, in writing, before the readers go on the wall.

Match it to what you make

Match the controls to what you make. A washer supplier on a defense program is a defense contractor, and doesn't need a scramble pad. Anti-passback and tailgating controls scale from a sign to a turnstile to a two-door vestibule. The point is that the choice was made on purpose and can be explained.

Held-open alarms

A held-open alarm fires when a door stays open longer than it should. On most access controllers it's a checkbox.

It catches what the credential can't: the door that was opened legitimately and then left open. A propped door doesn't care how good your cards are, and the alarm is how you find out.

Put held-open and forced-door alarms on the enclave doors, make sure someone receives them, and keep a record that they were tested. The record is the evidence. An alarm that nobody receives is a setting, not a control.

The same goes for cameras. Cover the entries and main routes, and verify recording this month. Know the difference between a camera that shows someone is there and one that identifies a face. Thermal doesn't identify. Bispectral can. Put at least 1 identification-quality camera at the enclave entry.