[Autogenerated] where the previous requirement was concerned with
distinguishing between visitors on on site personnel.
Requirement 9.3 just deals with on site personnel,
and it's the physical equivalent of requirements.
Seven.
In the any access to sensitive locations where card all the data is stored,
processed or transmitted must be based on need and control through the
organizations joined US Moves and Levers process.
There's quite a number of parts wrapped up in here,
which was separate when we talk about logical access control.
They were separate sub requirements,
so you need to look at depth into this requirement
because there's a lot in there.
So firstly that there's role based access on that,
that access is explicitly authorized.
Secondly, that when someone leaves or changes role,
the physical access is revoked.
And then, thirdly,
that any physical access tokens such as badges or access cards or even physical
keys have been given to people are returned when they leave.
The testing procedures equally dense wants to check all of these elements,
so the QoS is probably first going to look a documented
policies and processes to see what should happen,
although actually that's not part of testing procedure officially.
Then we'll talk to people who've got access to sensitive barriers,
find out why they've been given access and then match that up
with the access control and approval lists.
Finally,
they're going to check to see that terminated
personnel have had their access removed.
And remember, this covers on site personnel,
so its employees, contractors and consultants.