Door controllers, badge readers, motion detectors and cameras record most physical intrusions as they happen, but those records usually live in a facilities system that the security operations team never sees. MITRE D3FEND models this group of controls as Physical Access Monitoring (D3-PHAM), a technique in the Detect tactic defined as "Monitoring the physical access of a specified environment through detection, recording, reviewing, and logging of who/what enters and exists areas." This guide treats D3-PHAM as one programme across its four child techniques: what each contributes, how to combine them for a server room or comms space, how to bring their events into security monitoring, how to measure coverage and where the programme fails. It does not repeat the child technique cards, which are linked below. It is written for security architects, SOC leads and the facilities and physical security teams they work with. For the wider physical security programme see the Physical Security Guide for Security Teams.
Key takeaways
- Physical Access Monitoring has four children. D3FEND lists Electronic Lock Monitoring, Motion Sensor Monitoring, Proximity Sensor Monitoring and Video Surveillance under D3-PHAM.
- Each child sees a different part of an entry. Lock and reader events say which credential opened which door, motion sensors say someone is in the room, and video shows who it was.
- Correlation is the point. A door forced alarm, motion with no badge read and a camera clip of the same minute together make a confirmed incident; any one alone is often noise.
- ATT&CK coverage is thin by design. D3FEND relates only Video Capture (T1125) to the family, inferred through the camera artefact; physical entry is mostly outside enterprise ATT&CK.
- The monitoring system is itself an attack surface. Controllers, cameras and video management servers are networked devices with their own accounts, firmware and logs.
What D3FEND means by Physical Access Monitoring
In the D3FEND ontology (knowledge graph 1.6.0, checked November 2026) D3-PHAM is a defensive technique under the Detect tactic, with NIST SP 800-53 Rev. 5 as its reference. The parent has no digital artefact of its own; the artefacts sit on the children: Proximity Sensor, Electronic Combination Lock, Digital Camera and Motion Detector. The definition has four verbs: detection, recording, reviewing and logging. That matches the structure of NIST control PE-6 Monitoring Physical Access, whose enhancements include intrusion alarms and surveillance equipment, automated intrusion recognition and responses, video surveillance, and monitoring physical access to systems.
D3-PHAM is the detection counterpart to Physical Access Mediation (D3-PAM), which D3FEND places under Access Mediation in the Isolate tactic. Mediation decides whether a door opens; monitoring records what happened and raises the alarm when the decision was bypassed. See the MITRE D3FEND Access Mediation Implementation Guide.
The child techniques at a glance
Definitions are D3FEND's own, shortened where marked; the remaining columns summarise the linked cards.
| D3FEND technique | What it monitors | Typical events | Main blind spot |
|---|---|---|---|
| D3-ELM Electronic Lock Monitoring | Electronic lock and door hardware states and access events (shortened) | Access granted or denied, door forced, door held open, tamper | Someone following an authorised person through (tailgating) produces one valid event |
| D3-MSM Motion Sensor Monitoring | Events from motion detectors such as passive infrared, microwave and dual-technology sensors | Presence or movement in a protected area | Says something moved, not who; masking and slow movement can defeat some sensor types |
| D3-PSM Proximity Sensor Monitoring | A credential or tagged asset within a sensor's read range or zone, using RFID, BLE or UWB | Card reads, tag presence, anti-passback violations, asset leaving a zone | A cloned or relayed credential reads as the genuine holder |
| D3-VS Video Surveillance | Physical areas via camera video feeds, to deter, detect and investigate | Recorded footage, analytics alerts, camera offline or tamper | Footage is only useful if it is retained, time-synchronised and reviewed |
D3FEND lists no grandchildren under these four, and no separate child for visitor logs or guard patrols, which NIST treats under PE-8 Visitor Access Records and PE-6.
How to combine the children
No single child confirms an intrusion. Design each protected space so that at least two independent children observe an entry, and decide in advance which combinations raise which priority. The table is an NHI Mgmt Group example, not a standard.
| Event combination | Likely meaning | Example response |
|---|---|---|
| Door forced (ELM) plus motion inside (MSM) | Unauthorised entry in progress | Highest priority: guard dispatch, live video review, SOC notified |
| Motion inside (MSM) with no badge read in the window (PSM, ELM) | Tailgating, propped door or someone remaining after hours | Review video for the window; check the door held events |
| Valid badge read (PSM) for a holder who is elsewhere or has left | Cloned, shared or unrevoked credential | Suspend the credential; review video; check HR status |
| Door held open (ELM) for longer than the configured limit | Propped door or equipment delivery | Lower priority unless combined with other signals |
| Camera offline or tamper (VS) on a sensitive space | Fault or deliberate blinding | Treat as a security event until a fault is confirmed |
| Any physical event in a server room followed by new USB device or console login on a host there | Physical access used for a cyber action | Correlate with endpoint telemetry; preserve video and logs |
Choosing coverage by space
- Data centres, server rooms and comms cabinets: all four children, with lock and reader events and camera health sent to the SOC. These are the spaces where physical access turns directly into console, port and media access.
- Office floors: D3-PSM and D3-ELM at perimeter doors, D3-VS at entrances. Motion sensing usually stays with the intruder alarm for out-of-hours use.
- Small organisations with a single comms cupboard: a lock with event logging and one camera covering the cabinet often gives most of the value; the essential step is that someone reviews the events.
Bringing physical events into security operations
- Inventory the systems. List access control panels, alarm panels, video management systems and their owners. Record which events each can export and how (syslog, API, database export).
- Synchronise time. Point every panel, reader controller, recorder and camera at the same time source as the rest of the estate. Correlation fails when the door log and the video are minutes apart.
- Forward a defined event set. Start with door forced, door held, tamper, access denied in sensitive spaces, alarm activation and camera offline. Avoid forwarding every granted read on day one.
- Join identities. Map badge holder IDs to directory identities so that a badge event and a login event for the same person can be linked, and so that leavers' badges are revoked with their accounts.
- Write correlation rules. Implement the combinations above, starting with forced entry plus motion and physical access to server rooms followed by host events.
- Test and keep testing. Walk tests for motion coverage, forced and held door tests, tamper tests on readers and cameras, and a check that each test event arrives in the SIEM with the right time. Record results. See the Physical Security Site Assessment Checklist.
Rollback here is low risk: forwarding and correlation can be paused without changing door behaviour. Keep changes to lock behaviour, such as alarm thresholds, in the facilities change process.
ATT&CK relationship
D3FEND relates one offensive technique to the family: T1125 Video Capture (Collection), inferred through the Digital Camera artefact that D3-VS monitors and T1125 accesses, and labelled "inferred, experimental". The practical reading, explained on the D3-VS card, is that surveillance cameras are themselves devices an adversary can access, so the monitoring system must be protected. D3FEND lists no ATT&CK techniques for D3-ELM, D3-MSM or D3-PSM.
The physical events matter as precursors to techniques that need presence, such as MITRE ATT&CK T1200 Hardware Additions and MITRE ATT&CK T1052 Exfiltration Over Physical Medium. These are NHI Mgmt Group pointers for correlation, not D3FEND mappings.
Where identity fits
Physical access monitoring is also a machine identity problem. Door controllers, readers, cameras and recorders authenticate to their management servers with device credentials and service accounts, often with long-lived passwords set at installation. Inventory those accounts, change installer defaults, put the management network behind access controls and log administrative sign-ins to the video and access control systems. Badge credentials are identities too: revoke them in the same leaver process as directory accounts. See the Physical and Environmental Security Policy Template.
Detection and measurement
Metrics we suggest at NHI Mgmt Group (example measures, not standards):
- Sensitive space coverage: percentage of server rooms and comms spaces observed by at least two D3-PHAM children.
- Event forwarding: percentage of access control, alarm and video systems sending defined events to the SIEM.
- Test pass rate: percentage of walk, forced door and tamper tests that produced the expected event in the SIEM with correct time.
- Camera availability: percentage of sensitive space cameras online and recording over the period.
- Badge revocation lag: time from a leaver's account disablement to badge revocation.
- Alarm review time: median time from a high-priority physical alarm to acknowledgement.
Framework mapping
| Framework | Reference | Link to D3-PHAM |
|---|---|---|
| NIST SP 800-53 Rev. 5 | PE-6 Monitoring Physical Access; PE-6(1) Intrusion Alarms and Surveillance Equipment; PE-6(2) Automated Intrusion Recognition and Responses; PE-6(3) Video Surveillance; PE-6(4) Monitoring Physical Access to Systems | The control family D3FEND cites as its reference |
| NIST SP 800-53 Rev. 5 | PE-3 Physical Access Control, PE-8 Visitor Access Records | The mediation and visitor controls monitoring depends on |
| NIST CSF 2.0 | DE.CM-02 | The physical environment is monitored to find potentially adverse events |
| ISO/IEC 27001:2022 | Annex A 7.4 Physical security monitoring | Premises continuously monitored for unauthorised physical access |
Common failure patterns
- Events that never leave facilities. Door forced alarms go to a reception console out of hours and are cleared without review.
- Unsynchronised clocks. Video and access logs disagree by minutes, so investigators cannot match a badge to a face.
- Leaver badges still active. Directory accounts are disabled on time but physical credentials are not.
- Retention shorter than detection time. Footage is overwritten before an insider incident is discovered. See the Insider Data Theft Guide.
- The monitoring estate left unmanaged. Cameras and controllers on flat networks with installer passwords and no firmware updates become a route in rather than a control.
Practitioner checklist
- Inventory access control, alarm and video systems with owners and export methods.
- Cover every server room and comms space with at least two D3-PHAM children.
- Synchronise all physical security devices to the estate time source.
- Forward door forced, held, tamper, sensitive denials, alarms and camera offline events to the SIEM.
- Map badge IDs to directory identities and revoke badges in the leaver process.
- Correlate physical events in technology spaces with host events such as USB insertion and console logins.
- Run and record walk, forced door and tamper tests on a schedule.
- Manage device and service accounts, firmware and network access for the monitoring systems themselves.
Standards and references
- MITRE D3FEND: Physical Access Monitoring
- MITRE D3FEND: Electronic Lock Monitoring
- MITRE D3FEND: Motion Sensor Monitoring
- MITRE D3FEND: Proximity Sensor Monitoring
- MITRE D3FEND: Video Surveillance
- NIST: SP 800-53 Rev. 5
- NIST: Cybersecurity Framework 2.0
- MITRE ATT&CK: Video Capture
Related NHI Mgmt Group resources: MITRE D3FEND Guide · Physical Security Guide for Security Teams · Social Engineering and Physical Penetration Testing Guide · MITRE D3FEND Access Mediation Implementation Guide · MITRE ATT&CK T1125 Video Capture