NIST 800-53 REV 5 • PHYSICAL AND ENVIRONMENTAL PROTECTION
PE-6(2) — Automated Intrusion Recognition and Responses
Recognize {{ insert: param, pe-06.02_odp.01 }} and initiate {{ insert: param, pe-06.02_odp.02 }} using {{ insert: param, pe-06.02_odp.03 }}.
CMMC Practice Mapping
No direct CMMC mapping
NIST 800-171 Mapping
No direct NIST 800-171 mapping
Related Controls
Supplemental Guidance
Response actions can include notifying selected organizational personnel or law enforcement personnel. Automated mechanisms implemented to initiate response actions include system alert notifications, email and text messages, and activating door locking mechanisms. Physical access monitoring can be coordinated with intrusion detection systems and system monitoring capabilities to provide integrated threat coverage for the organization.
Practitioner Notes
This enhancement calls for automated systems that can recognize intrusion attempts and initiate responses automatically — like locking doors, activating alarms, or notifying security when specific events are detected.
Example 1: Configure your intrusion detection system to automatically lock down areas when a forced entry is detected. For example, if a door contact sensor registers an unauthorized opening, automatically lock adjacent doors, activate audible alarms, and notify security via text message.
Example 2: Use a video analytics platform that can detect tailgating, loitering, or unauthorized access patterns on camera feeds. When the system detects suspicious behavior, it triggers a real-time alert to security personnel with a video clip of the event for immediate assessment.