FC · 4 controls

Facilities Terrain

Buildings, zones, and the maintenance paths reaching through them

FC-1

Facility Terrain IdentificationAccountable: Authorizing Official / CISO

Facilities housing mission systems, data, or personnel in identified workforce terrain shall be represented on the terrain overlay, with the elements each contains recorded.

PurposeTo resolve the estate to physical locations, so that defense, recovery and continuity can be reasoned about in the place things actually are.Activities10 · Metrics2

FC-2

Physical Zone BoundaryAccountable: Authorizing Official / CISO

Facilities shall be divided into zones whose boundaries are enforced and logged, and the zone containing each decisive point shall be identified.

PurposeTo establish physical boundaries that constrain movement and produce a record of crossing, so that physical terrain can be defended in depth rather than at a perimeter.Activities10 · Metrics2

FC-3

Maintenance Access ControlAccountable: Authorizing Official / CISO

Vendor and remote maintenance shall occur only within an approved, time-boxed, supervised window, and no maintenance path shall exist outside one.

PurposeTo ensure the maintenance path — authorized, expected, and outside the normal identity plane — is bounded in time and observed while open.Activities10 · Metrics2

FC-4

Environmental ContinuityAccountable: Authorizing Official / CISO

For each facility carrying a mission service, the environmental conditions the service depends on shall be identified, and the period the facility can sustain the service without them shall be stated.

PurposeTo know how long the physical ground holds without support, so that recovery objectives are not contradicted by the buildings the services sit in.Activities10 · Metrics2