A server rack, network cabinet or PLC panel with its door open, or with a key left in it, hands an intruder the console, the ports and the operating mode switch without touching a single logical control. MITRE D3FEND names the countermeasure Physical Locking (D3-EPL) and defines it as "Employ a mechanical locking device for securing moveable portions of physical barriers (e.g., doors, gates, drawers) in a secured position." It sits under the Isolate tactic as a child of Physical Access Mediation (D3-PAM), and its digital artefact is the Computer Enclosure. This card covers what D3FEND says about locks, where locking matters most for IT and OT, how to manage keys, how to verify locks are doing their job, and where they fail. It is a short card because the D3FEND entry is short; the building-level programme is in the D3-PAM Physical Access Mediation card and the Physical Security Guide for Security Teams.
Key takeaways
- A lock is an authentication device. D3FEND describes a physical mechanism with an associated credential: when the credential is presented, the bolt can open or close. Keys and combinations therefore need the same lifecycle as any credential.
- The target is the enclosure. D3FEND ties D3-EPL to the Computer Enclosure artefact: racks, cabinets, cases and control panels that contain computing platforms.
- OT key switches belong in RUN. D3FEND and NIST SP 800-82 Rev. 3 both say PLC and safety system keys should be in the Run position unless the device is being actively programmed.
- No ATT&CK mapping in D3FEND. D3FEND lists no ATT&CK techniques for D3-EPL (checked November 2026); the value comes from the physical attack paths it closes, such as hardware additions and operating mode changes.
- Locks need records and inspection. D3FEND's considerations call for maintenance and access records, tamper inspection and a key management system for keyed locks.
D3-EPL at a glance
| Attribute | Value |
|---|---|
| D3FEND ID | D3-EPL (d3f:PhysicalLocking) |
| Tactic | Isolate |
| Parent technique | Physical Access Mediation (D3-PAM), synonym Physical Access Control |
| Digital artefact | Computer Enclosure (D3FEND relation: mediates access to Computer Enclosure); D3FEND notes an enclosure may contain a Physical Lock |
| D3FEND references | US NRC Regulatory Guide 5.12 on the general use of locks; NIST SP 800-82 Rev. 3 Guide to OT Security |
| ATT&CK techniques in D3FEND | None listed |
| Typical enforcement points | Rack and cabinet doors, side panels, network closet doors, desktop and laptop cable locks, OT control panels, PLC key switches |
| Main limitation | A lock delays and deters; without key control, inspection and monitoring it cannot show whether it was opened |
What D3FEND says about physical locking
The D3FEND knowledge base article lists six considerations. Each translates into a concrete practice for IT and OT estates.
| D3FEND consideration | What it means in practice |
|---|---|
| Locks for specified materials should follow relevant regulations | Check sector rules for the space: for example, the US NRC guide sets lock standards for nuclear facilities and classified matter |
| Lock equipment cabinets when not needed for operation or safety; keep OT asset keys in RUN unless otherwise specified | Racks and panels closed and locked by default; PLC and safety system keys removed in Run |
| Locks and hardware properly installed, operable and free of substantive signs of tampering | Regular physical inspection of locks, hinges and side panels |
| Records of maintenance, access, tamper marks and incidents | A lock and key register, and a log of who opened what and when |
| A key management system for locks operated by a physical key | Issued keys tracked to named people, returned and inventoried |
| Key locks highly resistant to opening by force and tampering | Choose lock grades to match the asset, not the cheapest cabinet default |
The OT key switch
Many programmable controllers have a physical key switch that selects the operating mode. ATT&CK for ICS describes the modes under ICS T0858 Change Operating Mode: in Program mode the logic can be changed; in Run mode program upload and download are disabled; Remote allows the mode to be changed remotely. NIST SP 800-82 Rev. 3 states that keys of OT assets such as PLCs and safety systems should be in the Run position at all times unless they are being actively programmed. Locking the panel and removing the key in Run is therefore a physical control on a logical attack path. The logical side is covered in D3-OPR Operating Mode Restriction.
ATT&CK techniques and D3-EPL
D3FEND relationship: none listed. D3-EPL mediates access to the Computer Enclosure, a physical artefact that no ATT&CK technique in the D3FEND ontology acts on, so D3FEND infers no offensive techniques (D3FEND 1.6.0, checked November 2026). The table is NHI Mgmt Group's own view of ATT&CK v20 techniques whose usual precondition is hands on the enclosure. It is not part of D3FEND.
| ATT&CK ID | Technique | What a locked enclosure changes (NHI Mgmt Group view) |
|---|---|---|
| T1200 | Hardware Additions | Inline implants, rogue switches and keyloggers need access to the ports inside the rack or case |
| T1091 | Replication Through Removable Media | Front and rear USB ports on locked servers and kiosks are out of reach |
| T1052 | Exfiltration Over Physical Medium | Drives and media inside a locked enclosure cannot simply be removed |
| T0858 (ICS) | Change Operating Mode | A PLC key switch behind a locked panel, with the key removed in Run, cannot be turned to Program |
For the device-side controls see MITRE ATT&CK T1200 Hardware Additions and M1034 Limit Hardware Installation.
Where it is implemented
| Enclosure | Typical lock | Key control approach | Notes |
|---|---|---|---|
| Data centre and colocation racks | Keyed, combination or electronic rack handles on front and rear doors and side panels | Per-rack or per-row keys, or electronic handles tied to the access control system | Shared-key cabinets in colocation halls are common; side panels can bypass locked doors |
| Network and comms closets | Door lock plus locked wall cabinet | Keys issued to named network staff and facilities, not left in the room | Often in shared office space, so the cabinet lock matters |
| Desktops, kiosks and laptops | Cable locks and lockable chassis | Master-keyed sets are convenient but one lost key opens all | NIST SP 800-53 PE-3(4) Lockable Casings covers this case |
| OT control panels and PLCs | Panel door locks and controller key switches | Keys held by named engineers, removed in Run, logged when issued | Safety and operational access must still be possible in an emergency |
Electronic rack handles and door locks that report events are covered by D3-ELM Electronic Lock Monitoring. Site-level design for data halls is in the Data Centre Security Guide.
Where identity fits
Physical keys and combinations are shared, unnamed credentials unless you make them otherwise. The US NRC guide's key control practice reads like an identity lifecycle: keys issued only to authorised individuals, an access list reviewed annually, keys inventoried, and keys, cards, codes and combinations changed when someone with access is terminated or transferred. It also discourages master keying, because one compromised master can expose every lock in the system. Treat rack and panel keys with the same joiner, mover and leaver discipline as accounts.
Implementation steps
- List the enclosures. Record every rack, cabinet, closet and OT panel that holds computing or network equipment, its location, owner and current lock type.
- Set the default to locked. Make "closed and locked unless in use for operation or safety" the written rule, and remove keys from PLC switches in Run.
- Build the key register. For each lock record the keys or combinations, who holds them and when they were last changed. Retire master keys for sensitive enclosures where you can.
- Define change triggers. Change keys or combinations when a key is lost, when compromise is suspected, and when a holder leaves or changes role, following the triggers in the NRC guide. Set a scheduled change interval for high-value areas.
- Close bypasses. Check side panels, adjacent racks without partitions, removable hinges and cable entry points. A locked door on an open-sided rack is not a locked rack.
- Plan for emergencies. Make sure fire, safety and operations staff can reach what they must in an emergency, through escorted or recorded key access rather than unlocked panels.
How to verify it works
- Walk-round audit: on a set schedule, check that each enclosure on the list is locked, that no keys are left in locks or nearby, and that PLC key switches are in Run with the key removed.
- Tamper inspection: inspect locks, hinges and panels for damage or marks, and record findings, as D3FEND's considerations require.
- Key inventory: reconcile every issued key and combination holder against the current access list; investigate any unreturned key.
- Authorised physical test: include rack and cabinet access in authorised physical penetration tests, and record which enclosures were opened and how.
| Metric | Example target (NHI Mgmt Group suggestion, not a standard) | Why it matters |
|---|---|---|
| Enclosures found unlocked in walk-round audits | Zero | The control only works when used |
| Keys and combinations reconciled to a named, current holder | 100% | Unknown holders are unrevocable access |
| Days from leaver to key or combination change for areas they held | Within the leaver process window | Matches logical access removal |
| PLC key switches found outside Run without an approved change | Zero | Direct indicator of OT exposure |
Limits, bypasses and failure patterns
- Keys left in the lock: the most common failure, especially on PLC key switches and rear rack doors.
- Common keys: many cabinets ship with the same key for every unit of a model, so the lock deters only people who do not own one. Replace or rekey cylinders on sensitive enclosures.
- Master key sprawl: one lost master key exposes every lock in the system, and remastering is expensive.
- Bypass around the lock: open side panels, shared rack rows and removable hinge pins let someone reach equipment without opening the locked door.
- No record of opening: a mechanical lock cannot tell you who opened it. Pair high-value enclosures with electronic locks, monitoring or D3-VS Video Surveillance.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | PE-3 Physical Access Control | Includes securing keys, combinations and other physical access devices, inventorying them, and changing them when lost, compromised or when holders are transferred or terminated |
| NIST SP 800-53 Rev 5 | PE-3(4) Lockable Casings | Use lockable physical casings to protect defined system components from unauthorised physical access |
| NIST SP 800-53 Rev 5 | PE-6 Monitoring Physical Access | The monitoring that a mechanical lock alone cannot provide |
| NIST CSF 2.0 | PR.AA-06 | Physical access to assets is managed, monitored and enforced commensurate with risk |
| NIST SP 800-82 Rev 3 | OT physical access guidance | Locks, card readers and guards in combination; PLC and safety system keys in Run |
| MITRE D3FEND | D3-PAM, D3-EPL | Parent and technique |
Practitioner checklist
- Keep an inventory of every rack, cabinet, closet and OT panel with its lock type and owner.
- Keep enclosures locked unless they are in use for operation or safety.
- Keep PLC and safety system keys in Run and removed, except during approved programming.
- Maintain a key and combination register tied to named holders.
- Change keys and combinations on loss, suspected compromise and holder departure.
- Avoid master keys for sensitive enclosures and rekey common-key cabinets.
- Inspect locks, hinges and side panels for tampering and record the results.
- Pair high-value enclosures with electronic lock monitoring or video.
Standards and references
- MITRE D3FEND: Physical Locking (D3-EPL)
- NIST: SP 800-82 Rev. 3 Guide to Operational Technology (OT) Security
- US NRC: Regulatory Guide 5.12 Rev. 1, General Use of Locks in the Protection and Control of Facilities
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls (PE-3, PE-3(4))
- NIST: Cybersecurity Framework 2.0
- MITRE ATT&CK for ICS: T0858 Change Operating Mode
Related NHI Mgmt Group resources: D3-PAM Physical Access Mediation · Physical Security Guide for Security Teams · Physical and Environmental Security Policy Template · Data Centre Security Guide · MITRE D3FEND Guide