Every logical control assumes the attacker cannot simply walk up to the server, the network port or the console, and physical access mediation is the countermeasure that makes that assumption true. MITRE D3FEND names it Physical Access Mediation (D3-PAM), with the synonym Physical Access Control, and defines it as "the process of granting or denying specific requests to enter specific physical facilities (e.g., Federal buildings, military establishments, border crossing entrances.)" It sits under the Isolate tactic as a child of Access Mediation (D3-AMED), and Physical Locking (D3-EPL) is listed as its own child. This card explains what D3-PAM covers in D3FEND's model, why it has no ATT&CK mapping, which physical controls deliver it for IT and OT assets, and how to test that it holds. It is written for security architects, data centre and facilities security leads and auditors; the deep treatment of badge systems is in the Physical Access Control Systems Security Guide.
Key takeaways
- It is a decision, not a door. D3-PAM is the grant or deny decision on each request to enter a space; locks, readers, turnstiles and guards are the enforcement points that carry out that decision.
- D3FEND has no ATT&CK mapping for it. D3-PAM acts on Physical Artifact, and no ATT&CK technique in the D3FEND data shares that artefact, so the value has to be argued from the physical attack paths it closes.
- Isolation is the point for IT. In the ontology D3-PAM both mediates access to and isolates physical artefacts, so the goal for security teams is to keep people without a need away from servers, network closets, consoles and OT cabinets.
- Badges are identities. A badge is a credential issued to a person with a lifecycle, so joiner, mover and leaver processes, review and revocation apply just as they do to accounts.
- Test by trying to get in. Logs show who used a badge, not who followed them through. Authorised physical testing and door-held and forced-open alarms are the real evidence.
D3-PAM at a glance
| Attribute | Value |
|---|---|
| D3FEND ID | D3-PAM (d3f:PhysicalAccessMediation) |
| Synonym | Physical Access Control |
| Tactic | Isolate |
| Parent technique | Access Mediation (D3-AMED) |
| Child technique | Physical Locking (D3-EPL): a mechanical locking device securing moveable parts of physical barriers such as doors, gates and drawers |
| Digital artefact | Physical Artifact (relations: mediates-access-to and isolates); D3FEND sub-classes include Computer Enclosure, Physical Key, Physical Lock and Vehicle |
| ATT&CK mapping | None in D3FEND data (checked November 2026, D3FEND 1.6.0) |
| D3FEND reference | CNSSI 4009, Committee on National Security Systems Glossary |
| Related detective technique | Physical Access Monitoring (D3-PHAM), under Detect |
What it does
D3FEND's parent, Access Mediation, is defined as granting or denying requests both to use information services and to enter physical facilities, and it adds that decisions should enforce least privilege, scoped durations and, where applicable, just-in-time access. D3-PAM is the physical half of that definition. The same principles apply: a person's badge should open only the doors their role needs, time schedules should limit when, and access should end when the need ends. The parent's wider model and its logical siblings are covered in the MITRE D3FEND Access Mediation Implementation Guide.
D3FEND keeps detection separate. Recording, reviewing and logging who enters and leaves an area is Physical Access Monitoring (D3-PHAM), a Detect technique. A mature programme needs both: D3-PAM decides and enforces, D3-PHAM proves what happened.
ATT&CK relationships
D3FEND lists no ATT&CK technique for D3-PAM. Its digital artefact, Physical Artifact, is not one that ATT&CK techniques are modelled as acting on, so D3FEND infers no relation. The table below is an NHI Mgmt Group view, not a D3FEND mapping: these are ATT&CK v20 techniques whose usual precondition is physical presence, so physical mediation reduces the opportunity for them.
| ATT&CK ID | Technique | Why physical access matters (our view) |
|---|---|---|
| T1200 | Hardware Additions | Implanting a device on a network port or host needs someone at the port or host |
| T1091 | Replication Through Removable Media | Inserting media into air-gapped or restricted systems needs physical access to them |
| T1052 | Exfiltration Over Physical Medium | Carrying data out on a device is limited where media cannot reach the system or leave the area unchecked |
The matching ATT&CK mitigation for device control is M1034 Limit Hardware Installation, and the technique pages are MITRE ATT&CK T1200 Hardware Additions and MITRE ATT&CK T1052 Exfiltration Over Physical Medium. For AI systems, MITRE ATLAS covers the physical route in AML.T0041 Physical Environment Access.
Where it is implemented
| Layer | Enforcement point | What to configure |
|---|---|---|
| Site and building perimeter | Gates, reception, visitor management, turnstiles | Visitor identification and escort, visitor access records, anti-passback where tailgating risk is high |
| Restricted IT spaces | Badge readers on data halls, comms rooms and network closets | Access groups per room, time schedules, two-factor at the door (badge plus PIN or biometric) for the most sensitive rooms |
| Racks and cabinets | Locked racks, cages, lockable casings (the Physical Locking child) | Rack-level locks or electronic rack access for shared and colocation spaces; key control for any mechanical keys |
| Devices and ports | Locked enclosures, port locks, console access | Restrict who can reach consoles, out-of-band management and unused network ports |
| OT cabinets and field sites | Cabinet locks, fenced enclosures, remote site access control | Tie access to work orders; alarm on cabinet opening |
| Controller and reader communications | Access control panels and readers | OSDP with Secure Channel (AES-128) in place of legacy Wiegand; OSDP is published as IEC 60839-11-5:2020 |
For United States federal facilities, FIPS 201-3 defines the PIV credential and NIST SP 800-116 Revision 1 gives a risk-based approach to choosing PIV authentication mechanisms for facility access. Credential technology choices and the Wiegand to OSDP migration are covered in depth in the Physical Access Control Systems Security Guide and are not repeated here.
Where identity fits
The badge database is an identity store. Each badge is an authenticator bound to a person, contractor or visitor, and the access groups on it are entitlements. Feeding the physical access control system from the HR or identity governance system, so that leavers lose door access at the same time as account access, closes the most common gap. Shared badges, contractor badges and badges issued to service vehicles or robots behave like shared and non-human accounts and need named owners and expiry dates. Convergence of the two programmes is covered in Physical and cyber security convergence.
How to verify it works
- Entitlement review: each quarter, have room owners approve who holds access to their data hall, comms room or OT cabinet, and remove the rest.
- Leaver reconciliation: compare active badges with active HR records weekly; any badge without a current owner is a finding.
- Door health and alarms: check that door-forced-open and door-held-open alarms arrive at the monitoring desk and are answered.
- Authorised physical testing: include tailgating, badge cloning attempts and reception social engineering in scoped tests. See the Social Engineering and Physical Penetration Testing Guide and the Tailgating and Piggybacking Guide.
- Site walk: use the Physical Security Site Assessment Checklist to find propped doors, unlocked racks and unattended consoles.
| Metric | Example target (NHI Mgmt Group suggestion, not a standard) |
|---|---|
| Badges active for people who have left | Zero |
| Restricted rooms with a quarterly owner review completed | 100% |
| Door-held and forced-open alarms acknowledged within agreed time | Over 95% |
| Successful tailgates in authorised tests | Falling test on test |
| Readers still on unencrypted legacy links to restricted rooms | Falling to zero |
Limits, bypasses and failure patterns
- Tailgating and piggybacking: the door makes a correct decision for the first person and none for the second. Mantraps, turnstiles and staff challenge culture address this, not the reader.
- Cloneable credentials: low-frequency proximity cards and unencrypted reader links let an attacker copy or replay a badge, so the decision is made for the wrong person.
- Access that never ends: contractors and movers keep door access long after their need, because badge revocation is not tied to the joiner, mover and leaver process.
- Mechanical override keys: master keys and cylinder overrides bypass the electronic decision entirely and are often poorly tracked.
- Isolated in the building, exposed on the network: a locked room does not help if its out-of-band management interface is reachable remotely. Physical and logical mediation have to cover the same asset.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | PE-2 Physical Access Authorizations; PE-3 Physical Access Control with PE-3(1) System Access, PE-3(4) Lockable Casings and PE-3(5) Tamper Protection | Who may enter, enforcement at entry points, and protection of system components |
| NIST SP 800-53 Rev 5 | PE-4 Access Control for Transmission; PE-5 Access Control for Output Devices | Cabling and output devices inside the mediated space |
| NIST SP 800-53 Rev 5 | PE-6 Monitoring Physical Access; PE-8 Visitor Access Records | The monitoring half, D3-PHAM in D3FEND terms |
| NIST CSF 2.0 | PR.AA-06 | Physical access to assets is managed, monitored and enforced commensurate with risk |
| MITRE D3FEND | D3-AMED, D3-PAM, D3-EPL | Parent, technique and child |
The full PE family is explained in NIST SP 800-53 PE Physical and Environmental Protection, and payment card environments are covered in the PCI DSS Requirement 9 Guide.
Practitioner checklist
- Define restricted zones for data halls, comms rooms, network closets and OT cabinets, each with a named owner.
- Grant door access by role and schedule; review it quarterly with room owners.
- Connect badge provisioning and revocation to HR or identity governance events.
- Use two-factor at the door for the most sensitive rooms.
- Replace cloneable cards and move reader links to OSDP Secure Channel.
- Lock racks, cages and unused ports; control mechanical override keys.
- Monitor door alarms and keep visitor records; test with authorised physical assessments.
Standards and references
- MITRE D3FEND: Physical Access Mediation (D3-PAM)
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls (PE family)
- NIST: SP 800-116 Rev. 1 Guidelines for the Use of PIV Credentials in Facility Access
- NIST: FIPS 201-3 Personal Identity Verification of Federal Employees and Contractors
- Security Industry Association: Open Supervised Device Protocol (OSDP)
Related NHI Mgmt Group resources: MITRE D3FEND Access Mediation Implementation Guide · Physical Access Control Systems Security Guide · Physical Security Guide for Security Teams · MITRE D3FEND Guide