AO coverage. Addresses all Limit Physical Access objectives: identifying who is authorized, and limiting physical access to systems, to equipment, and to the operating environments that house them.

Identifying authorized individuals. A badge zone matrix maps each job role to the zones it may enter, and the authorization record for each person is the badge system's group membership, exported and reviewed as a list of names. Anyone not on the list for a zone is a visitor there and is escorted, including employees — an engineer is not authorized in the server room simply by being an engineer.

Zone 1, the suite. Badge required at the suite door during business hours and at all times outside them. All employees and badged long-term contractors are in this zone. The landlord's lobby access is a separate credential we do not control, which is why the suite door rather than the building door is our first boundary.

Zone 2, engineering and the CUI work area. A separate badge group covering the engineering floor where drawings are worked and printed. Membership matches the enclave roster plus a small facilities set. Reception, sales, and finance are not in this group.

Zone 3, the server room. Badge plus a keyed lock on the room itself, six people in the group, no exceptions granted at the door. Systems and network equipment that store or transmit CUI are all inside this room; there is no equipment in an open closet or under a desk, which took a cleanup project to achieve.

Equipment outside the zones. Endpoints in open areas are cable-locked and configured to lock the screen quickly; printers capable of producing CUI are inside zone 2. Network jacks in common areas and conference rooms are on a guest segment with no route to the enclave, so a physical port does not become a logical bypass of the zone model.

Provisioning and removal. Badge grants come from the same HR-driven workflow as logical access: the same request, the same approver, the same termination trigger. Badges are deactivated on the termination date, and the badge system is included in the offboarding checklist rather than remembered separately.

Maintenance. Quarterly review of each zone's membership against the roster, with the zone 3 list reviewed by the IT director personally. Annual walk to confirm no in-scope equipment has migrated outside its zone.

Accepted gap. The landlord's after-hours building access and the shared HVAC and electrical rooms are outside our control. The lease requires notification of contractor access, our suite door remains a controlled boundary regardless of building access, and the server room's separate key means building-level access alone reaches nothing in scope.

• Badge zone matrix mapping roles to zones
• Badge group membership export for all three zones with the quarterly review sign-off
• Offboarding checklist showing badge deactivation, and a completed example
• Network configuration showing common-area jacks on the guest segment
• Lease provisions covering landlord-controlled areas and contractor notification