// ITSP.10.171 · FAMILY 10 · 5 REQUIREMENTS

Physical protection

Last verified: 2026-10-05

// REQUIREMENTS

Identifier	Requirement	Level 1
03.10.01	Physical access authorizations	Level 1
03.10.02	Monitoring physical access
03.10.06	Alternate work site
03.10.07	Physical access control	Level 1
03.10.08	Access control for transmission

// INTENT

The hardware holding protected data sits behind physical access control with a short key list.

// WHAT A FIRST ASSESSMENT FINDS

The server closet is also the janitor's closet.

// THE WORK

A lock with a short key list, a visitor log and escort rule, cameras on entries and main routes, and held-open alarms on the enclave door.

// HOW WE CAN INTERPRET IT

Keys work, but I recommend access control because it produces a record. Card or biometric over a PIN, since a PIN can be known and a finger is harder to borrow. The simplest things make an auditor happy: employee ID on a navy lanyard, screened contractors on yellow, visitors on red, and a card design that shows division at a glance. Held-open alarms on the enclave door, which is a checkbox on most controllers. Cameras on the main routes, and know the difference between a camera that shows someone is there and one that identifies a face, which is why thermal doesn't identify and bispectral can. Anti-passback and tailgating controls scale with the risk, from a sign to a turnstile to a two-door vestibule. For credentials, I'd set the floor at 13.56 MHz Seos or iCLASS SE with custom keys (HID's Elite program or equivalent), not the standard keyset, in a corporate format such as HID Corporate 1000 or 2000. HID's February 2024 advisories (CVE-2024-23806) showed keys could be pulled from iCLASS SE configuration cards and encoders, so readers should be on current firmware with configuration-card changes locked out, legacy and 125 kHz technologies disabled at the reader to stop downgrade attacks, and OSDP Secure Channel between reader and controller. Card plus PIN on the doors that matter. Match all of it to what you make. A washer supplier on a defense program is a defense contractor, and doesn't need a scramble pad.

// TEMPLATES FOR THIS FAMILY

Level 1 requirements and evidence checklist

References

Protecting specified information in non-Government of Canada systems and organizations (ITSP.10.171)April 2025, updated October 2025
Canadian Centre for Cyber Securitycyber.gc.caRetrieved Oct 5, 2026
NIST SP 800-171 Revision 3, Protecting Controlled Unclassified Information in Nonfederal Systems and OrganizationsRevision 3
NISTcsrc.nist.govRetrieved Oct 5, 2026

Outbound links open in a new tab. Source-pinned. If a vendor moves a doc, this block gets updated.