A forced server room door or a badge reader that keeps rejecting the same card is a security event, but in many organisations it lands in a facilities console that the SOC never sees. MITRE D3FEND names this countermeasure Electronic Lock Monitoring (D3-ELM), with the synonyms Door Lock Monitoring and Lock State Monitoring, and defines it as monitoring electronic lock and door hardware states and access events, such as locked or unlocked, access granted or denied, door forced or held, and tamper, to detect and respond to unauthorised entry. It sits under the Detect tactic as a child of Physical Access Monitoring. This card explains the event model, where the control is implemented, how to test door and tamper sensors, and how to bring lock events into security monitoring. It is written for security engineers, SOC leads and facilities security teams responsible for data centres, network rooms and other controlled spaces.
Key takeaways
- The PACS is the sensor. D3FEND describes a physical access control system (PACS) that collects events from door controllers, readers and door hardware, logs access decisions and raises alarms for door-held, door-forced and tamper conditions.
- No ATT&CK mapping exists. D3FEND relates D3-ELM to no ATT&CK technique (D3FEND 1.6.0, checked November 2026); its value is detecting physical intrusion that enterprise ATT&CK does not model.
- Supervised, encrypted reader links matter. D3FEND recommends supervised reader-to-controller protocols such as OSDP, which with Secure Channel uses AES-128 and reports wiring faults and reader failures.
- Alarm tuning decides whether anyone responds. Door-held alarms on busy doors train staff to ignore the console; tune per door and per time of day.
- Sensors must be tested. A door position switch that is bypassed or failed reports "closed" forever, so scheduled physical tests are part of the control.
D3-ELM at a glance
| Attribute | Value |
|---|---|
| D3FEND ID | D3-ELM (d3f:ElectronicLockMonitoring) |
| Tactic | Detect |
| Parent technique | Physical Access Monitoring |
| Digital artefact | Electronic Combination Lock (D3FEND relation: monitors). D3FEND defines it as a door closer, an input device, a controlling device and a lock released when the correct combination or token is presented |
| Related artefact | Electronic Combination Lock Event, an event when the lock's bolt changes position |
| D3FEND references | FIPS 201-3; NIST SP 800-116 Rev. 1; NIST SP 800-53 Rev. 5; SIA OSDP v2.2 |
| ATT&CK mapping in D3FEND | None, direct or inferred |
| Main limitation | Detects events at monitored doors only; tailgating behind an authorised person produces a valid access event |
The event model
D3FEND lists the component types that feed the PACS: door controllers, readers (badge or PIV card, keypad) and door hardware (door position switch, request-to-exit, bolt or latch, tamper). The events they produce fall into a small set that every security monitoring design should name explicitly.
| Event | Source component | What it can indicate | Suggested handling (example, tune per site) |
|---|---|---|---|
| Access granted | Reader and controller | Normal entry, or entry with a stolen or shared credential | Log; correlate with identity and time |
| Access denied, repeated invalid attempts | Reader and controller | Lost or revoked card in use, PIN guessing, cloned card | Alarm after a threshold on sensitive doors |
| Door forced | Door position switch without a valid grant or request-to-exit | Physical break-in or a faulty switch | Immediate alarm with linked camera view |
| Door held open | Door position switch past the allowed time | Propped door, tailgating, delivery | Local sounder first, then alarm |
| Tamper | Reader, controller or enclosure tamper input | Someone opening or removing a reader or panel | Immediate alarm |
| Communication or supervision fault | Supervised reader link, controller heartbeat | Cut wiring, reader swap, network outage | Alarm; treat sensitive doors as unmonitored until fixed |
| Lock state change | Bolt or latch sensor | Lock left unlocked by schedule or override | Alert outside scheduled unlock windows |
D3FEND adds that integration with video systems can bring up the relevant camera view when a lock alarm fires. That integration is what lets an operator tell a forced door from a faulty switch in seconds.
ATT&CK relationship
D3FEND lists no ATT&CK techniques for D3-ELM, direct or inferred. Enterprise ATT&CK starts once an adversary interacts with systems, and physical entry is mostly outside it. The practical link is that physical access enables later techniques such as hardware additions and exfiltration over removable media; see MITRE ATT&CK T1052 Exfiltration Over Physical Medium for one example. For AI systems, MITRE ATLAS models physical environment access separately; see AML.T0041 Physical Environment Access. These are NHI Mgmt Group pointers, not D3FEND mappings.
Where it is implemented
| Layer | What it provides | Security considerations |
|---|---|---|
| Readers and door hardware | Credential capture, door position, request-to-exit, tamper inputs | Use supervised inputs so a cut or shorted wire is reported, not read as "closed" |
| Reader-to-controller link | Transport of credentials and status | OSDP, published as IEC 60839-11-5:2020, with Secure Channel (AES-128) protects credentials in transit and supervises the link; SIA's current version is 2.2.2 (October 2024) |
| Door controllers | Local access decisions and event buffering | Harden and patch like any networked device; keep them on an isolated PACS network as D3FEND recommends |
| PACS server and console | Event logging, alarm correlation, operator workflow | Role-based operator accounts, audit of overrides and schedule changes |
| PIV and smart card authentication | Cryptographic card authentication at the door | NIST SP 800-116 Rev. 1 gives a risk-based approach for choosing PIV authentication mechanisms for facility access; FIPS 201-3 defines the PIV credential |
| Video management integration | Camera call-up on alarms | Time synchronisation between PACS and video so footage matches events |
| SIEM or SOC integration | Physical events alongside logical security events | Forward at least alarms, denials and overrides; map badge IDs to directory identities |
The building systems that host many PACS deployments are covered in the Building Management System Security Guide.
Where identity fits
A badge is an identity credential, and the PACS holds an identity store that often drifts from the directory. Leavers whose badges stay active, contractors with no end date and shared visitor cards are the physical equivalent of orphaned accounts. Link PACS cardholders to directory identities, revoke badges in the same leaver workflow as logical access, and correlate the two: a badge entry at one site and a VPN login from another country within the same hour is worth an alert. The Derived PIV Credentials guide covers how PIV identities extend to mobile devices.
Implementation steps
- Classify doors. Rank doors by what they protect: data centre and network rooms, executive and finance areas, perimeter, general office. Monitoring depth and alarm handling follow the class.
- Fit and supervise sensors. Make sure every monitored door has a door position switch, request-to-exit, lock state sensing where available and tamper inputs, wired as supervised inputs with backup power.
- Secure the reader links. Move high-class doors to OSDP with Secure Channel enabled, and isolate controllers on a dedicated PACS network.
- Set life-safety behaviour. Decide fail-safe or fail-secure per door with facilities and fire safety, and document emergency release. D3FEND lists this as a consideration because it changes what a power or network fault means.
- Tune alarms. Set held-open times per door, invalid attempt thresholds per class and schedules for unlock windows. Pilot on a few doors, record nuisance alarms for two weeks and adjust before scaling.
- Integrate with video and the SOC. Link cameras to doors and forward alarms and overrides to the SIEM with directory identity attached.
- Write the response. Define who responds to a forced door, tamper or supervision fault, in what time, and what evidence (event log, video, badge history) is preserved.
- Roll back safely. If a change to schedules or thresholds creates an alarm flood, revert to the previous saved configuration rather than disabling alarms on the door.
How to verify it works
- Door walk tests: on a schedule, for each high-class door, test a valid entry, a denied credential, a forced opening (opening without a grant, with the operator informed), a held-open timeout and a tamper input. Confirm each event appears in the PACS console, the SIEM and the camera call-up.
- Supervision tests: disconnect a reader link or input in a controlled test and confirm the fault alarm fires.
- Power tests: test backup power and confirm the lock behaves as designed, fail-safe or fail-secure.
- Badge lifecycle audit: compare active cardholders with the directory monthly and investigate any active badge without a current identity.
- Clock check: confirm PACS, controllers, video and SIEM agree on time.
| Metric | Example target (NHI Mgmt Group suggestion, not a standard) |
|---|---|
| High-class doors passing the full walk test | 100% each quarter |
| Door forced and tamper alarms acknowledged | Within 5 minutes |
| Nuisance door-held alarms per door per week | Falling after tuning, close to zero on high-class doors |
| Active badges without a matching current identity | Zero |
| High-class doors on supervised, encrypted reader links | Rising to 100% |
Limits, bypasses and failure patterns
- Tailgating: a person following an authorised user produces one valid access event. Door-held alarms and video catch some cases; anti-tailgating hardware and staff awareness address the rest.
- Unsupervised legacy wiring: older reader interfaces without supervision or encryption expose credentials on the wire and report nothing when tampered with, which is why D3FEND points to supervised, encrypted protocols.
- Alarm fatigue: untuned held-open alarms on busy doors lead operators to acknowledge everything without looking.
- Facilities silo: events that stay in a facilities console are not correlated with logical security events, so a physical intrusion that precedes a network attack looks like two unrelated incidents.
- Stale cardholders: badges that outlive employment are valid credentials for people with no right to enter.
- Unhardened PACS network: controllers reachable from the corporate network become a route to unlock doors remotely.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | PE-3 Physical Access Control, PE-3(1) System Access | Enforcing physical access at entry points |
| NIST SP 800-53 Rev 5 | PE-6 Monitoring Physical Access, PE-6(1) Intrusion Alarms and Surveillance Equipment, PE-6(2) Automated Intrusion Recognition and Responses, PE-6(4) Monitoring Physical Access to Systems | The monitoring and alarm controls D3-ELM implements; see the NIST SP 800-53 PE Physical and Environmental Protection guide |
| NIST CSF 2.0 | DE.CM-02, PR.AA-06 | Monitoring the physical environment; managing and monitoring physical access |
| ISO/IEC 27001:2022 Annex A | A.7.2 Physical entry, A.7.4 Physical security monitoring | Entry controls and continuous monitoring of premises |
| FIPS 201-3 and NIST SP 800-116 Rev. 1 | PIV credential and its use in facility access | Credential strength at the door |
| IEC 60839-11-5:2020 (OSDP) | Reader-to-controller protocol | Supervised, encrypted reader links |
Practitioner checklist
- Classify doors and set monitoring depth by what each protects.
- Fit door position, request-to-exit and tamper inputs as supervised inputs with backup power.
- Use OSDP with Secure Channel on high-class doors and isolate the PACS network.
- Document fail-safe or fail-secure behaviour and emergency release per door.
- Tune held-open times and invalid attempt thresholds per door before scaling.
- Forward forced, tamper, supervision fault and override events to the SOC with directory identity.
- Link cameras to doors and keep clocks synchronised.
- Revoke badges in the same leaver workflow as logical access and audit monthly.
- Walk-test every high-class door on a schedule and record results.
Standards and references
- MITRE D3FEND: Electronic Lock Monitoring (D3-ELM)
- NIST: SP 800-116 Rev. 1 Guidelines for the Use of PIV Credentials in Facility Access
- NIST: FIPS 201-3 Personal Identity Verification (PIV) of Federal Employees and Contractors
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls (PE-3, PE-6)
- Security Industry Association: Open Supervised Device Protocol (OSDP)
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: NIST SP 800-53 PE Physical and Environmental Protection · Building Management System Security Guide · Derived PIV Credentials · MITRE D3FEND Guide