physical action

A category of security control behavior in which compliance depends on deliberate, in-the-world conduct by a user — handling, carrying, locking away, or otherwise manipulating a tangible object or device — rather than on an automated or purely logical mechanism. NIST SP 800-171r3 uses the phrase in the context that "protection and control of mobile devices are behavior- or policy-based and require users to take physical action to protect and control such devices when outside of controlled areas." This distinguishes it from technical or administrative controls that operate without user involvement: the safeguard only fires if a person acts in the physical world (e.g., securing a device, locking a case, removing media). It is used in standards and compliance frameworks to flag control requirements that cannot be automated and therefore depend on training, policy, and human follow-through for their effectiveness.