UNCLASSIFIED risk management/proportionality principle, the physical entry controls in place must be commensurate with business and security requirements. Physical entry controls can help achieve the following mandated minimum-security outcomes. PH2 – Organisations must use appropriate entry controls to protect secure areas against physical security threats. As a minimum requirement, organisations must have: (b) baseline security controls such as guards, fencing and external monitoring; (b) access card systems to identify employees, log and manage access rights; (c) visitor management processes to enable visitor sign-in, badge allocation, escorting and pass verification; and, (d) employee management processes including requirement to wear identification and carry access cards and the control of equipment movements. To achieve the security outcomes mandated above, organisations must:  Ensure that all facilities have in place baseline physical access controls to safeguard information resources therein including an on-duty security guard force; fencing (i.e. fences, gates, turnstiles and mantraps) and external security guard patrols, outside Closed Circuit Television (CCTV) monitoring or a combination of both. In addition, organisations must mandate the use of access cards for access to buildings;  Ensure that all visitors report to the security reception and produce proof of identification before gaining access to sensitive facilities. The visitors must sign-in and sign-out and must wear an appropriate badge e.g. unescorted or escorted at all times;  Record the date and time of entry and departure for all visitors. In addition, visitors must only gain access to premises supporting critical infrastructure for specific and authorised purposes;  Visitors receive a briefing on the security procedures of the secure facility including emergency procedures;  Control and restrict access to areas designated for processing or storing sensitive information to authorised persons only;  Have in place appropriate authentication controls e.g. access control cards plus PIN to manage and validate access and securely maintain an audit trail of all access;  Require all staff and visitors to wear visible identification at all times. All staff at a facility have a duty to notify security personnel if they encounter unescorted visitors and anyone not wearing visible identification;  Grant third party support service personnel restricted access to secure areas or sensitive facilities when required only and monitor the access; and Review, update and revoke access rights to secure areas regularly.  48