BSI C5:2020 PS-04 — Physical site access control

What this control requires

Implements access controls at premises per PS-01, using systems enforcing least privilege and need-to-know principles. Requires two-factor authentication for sensitive areas, tracks visitors, and logs access to prevent unauthorized entry to cloud systems.

In plain English

Implements access controls at premises per PS-01, using systems enforcing least privilege and need-to-know principles. In practice, this means you can prove you review site access control-level controls on a defined cadence.

Why it matters

BSI C5 is the default cloud-security baseline German public-sector buyers and many DAX-listed enterprises expect; gaps here directly block procurement in the DACH region and frequently appear as must-have items in EU public-tender documents.

This control is rated high. Auditors expect a named owner, a remediation SLA, and a tooling artefact that evidences continuous operation.

What an auditor looks for

A C5 attesting auditor (under ISAE 3000 / IDW PS 860) tests both the design and — for a Type 2 — the operating effectiveness over the attestation period. For each criterion they look for both the Basic and any in-scope Additional objectives.

Within Physical Security, the assessor will trace your implementation back to the catalogue reference (Criterion PS-04) and look for objective evidence on the latest two assessment cycles.

How to implement

Physical Security

Inheritance. For cloud-only operations, inherit physical controls from the provider's SOC 2 / ISO 27001 report and document the inheritance in the SoA.

Operational checklist

• Review. Document the trigger, the owner and the cadence.
• Security. Document the trigger, the owner and the cadence.
• Physical. Document the trigger, the owner and the cadence.
• Access. Document the trigger, the owner and the cadence.
• Authentication. Document the trigger, the owner and the cadence.
• Scope: site access control, management.

Evidence to collect

• Identity Scan. IAM / IdP exports — Entra ID, Okta, IAM Identity Center, Workspace directory — showing accounts, roles, MFA state and last sign-in.

Identity analytics (Okta, SailPoint, Access Analyzer) demonstrates least-privilege. Focus: Physical site access control.

How it maps to other frameworks

Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit.

• NIST SP 800-171 Rev. 3 3.10.8 — Access Control for Transmission
• SOC 2 (2017 TSC) CC6.1 — Logical Access Controls
• CIS Controls v8 6.7 — Centralize Access Control
• NIST SP 800-53 Rev. 5 PE-2(2) — Two Forms Of Identification
• ISO/IEC 27001:2022 A.8.2 — Privileged access rights

Related controls in BSI C5:2020

• Criterion IDM-05 — Regular review of access rights
• Criterion IDM-02 — Granting and change of user accounts and access rights
• Criterion IDM-01 — Policy for user accounts and access rights
• Criterion IDM-04 — Withdraw or adjust access rights as the task area changes
• Criterion AM-05 — Commitment to Permissible Use, Safe Handling and Return of Assets
• Criterion HR-01 — Verification of qualification and trustworthiness

References

• Bundesamt für Sicherheit in der Informationstechnik (BSI) — BSI C5:2020
• Catalogue identifier: Criterion PS-04

Topics: identity accessphysical securityidentity managementaccess reviewprivileged access