What does CIP-004 R5.2 entail regarding unescorted physical access?

CIP-004 R5.2 addresses the management of unescorted physical access to critical infrastructure facilities. This requirement emphasizes the need for access to be actively monitored and controlled, ensuring that individuals retain access privileges only as long as they are necessary for their role.

When access is granted to individuals, it should reflect their current job responsibilities and the nature of the work they need to perform. If an individual no longer requires access—due to changes in their role, termination of employment, or project completion—then their access rights must be revoked. This practice is critical for maintaining security and minimizing risks associated with unauthorized access to sensitive facilities.

The emphasis on revocation underscores the dynamic nature of access control; it is not a one-time process but rather requires continuous assessment and adjustment based on operational needs and personnel changes. Thus, ensuring that unescorted physical access is revoked when it is no longer necessary is a fundamental aspect of risk management within the NERC CIP framework.