Skip to content
ControlVerdict
Sign in
PE.L2-3.10.2CMMC Level 2Level 2

Monitor Facility

Submit your own example

Practice statement

Protect and monitor the physical facility and support infrastructure for organizational systems.

Quoted verbatim from NIST SP 800-171 Rev. 2 §3.10.2.Source

The source document’s non-normative “Discussion” section is not reproduced here. ControlVerdict quotes normative text verbatim or omits it — it never paraphrases a standard. Follow the source link above for the full context.

Assessment Objectives(4)

An assessor determines each objective separately. “Mostly implemented” is not a result — every objective below has to stand on its own.

  1. [a]

    the physical facility where organizational systems reside is protected;

    1 example covers this

  2. [b]

    the support infrastructure for organizational systems is protected;

    1 example covers this

  3. [c]

    the physical facility where organizational systems reside is monitored; and

    1 example covers this

  4. [d]

    the support infrastructure for organizational systems is monitored.

    No example covers this objective yet. Submit your own example.

Objective text quoted verbatim from NIST SP 800-171A via the CMMC Level 2 assessment guide.

Implementation examples(1)

Submit your own example
  • addresses
    PE.L2-3.10.2Monitor Facility
    Protect and monitor the physical facility and support infrastructure for organizational systems.

    • [a]

      the physical facility where organizational systems reside is protected;

    • [b]

      the support infrastructure for organizational systems is protected;

    • [c]

      the physical facility where organizational systems reside is monitored; and

    Cameras on the doors, sensors in the closet, alerts to the same on-call as IT

    ControlVerdict Corpus@cv-corpusOSCJul 31, 2026
    Community is just starting — add yours. No verdicts yet.

    Implementation

    AO coverage. Claims objectives [a], [b], and [c] — protecting the physical facility, protecting the support infrastructure, and monitoring the facility. Out of scope for this example: [d] (monitoring the support infrastructure). Our environmental and power telemetry today covers only the server closet; the building's main electrical service, the roof-top cooling units, and the telecom demarcation are not instrumented, so we cannot honestly claim they are monitored. Instrumenting them is an open plan-of-action item.

    Protecting the facility. Perimeter doors are on the badge system with door-forced and door-held-open contacts, and the two exterior doors that are not badge-controlled are alarmed exit-only with no outside hardware. Windows on the ground floor at the engineering end have security film. The server closet has a solid-core door, a badge reader, and walls that go to the deck rather than stopping at the drop ceiling — which is the detail most closet builds get wrong and ours originally did.

    Protecting the support infrastructure. The electrical panel serving the closet and the telecom demarcation point are behind locked doors on the facilities key list rather than in an open hallway. The closet has a dedicated cooling unit and a UPS sized to carry a graceful shutdown, and the UPS and network gear are on protected circuits. Cabling between the closet and the engineering floor runs in conduit above secured spaces, not through the shared tenant corridor.

    Monitoring the facility. Cameras cover the exterior doors, the suite entrance, the engineering floor entrance, and the server closet door, with 30-day retention. The alarm system covers perimeter doors and motion in the engineering and closet areas outside business hours, monitored by a service that calls the on-call rotation. Badge system events for door-forced and after-hours access generate an alert into the same paging tool IT uses for system alerts — one place to look at 2 a.m. rather than two.

    Review. Alarm and door-forced events are reviewed the next business day against the badge log and camera footage. Anything unexplained becomes an incident case.

    Maintenance. Monthly camera health check for offline or misaimed devices, quarterly alarm test with the monitoring service, annual UPS battery test, and a semi-annual walk to verify nothing new has been installed in the closet without a change ticket.

    Accepted gap. Retention is 30 days on camera footage, which is short if an incident is discovered late. Badge logs are retained a year, so we can usually establish who was present even when footage has rolled off; extending retention is budgeted for next fiscal year.

    What the evidence looks like

    • Camera coverage map with retention setting and the monthly health check record
    • Alarm system zone configuration and the monitoring service call list
    • Badge system alert configuration routing door-forced and after-hours events to the paging tool
    • Facilities key list covering the electrical panel and telecom demarcation
    • Next-business-day alarm review notes and the quarterly alarm test record

    Environment

    One owned building. The server closet holds the enclave file server and the network core; there is no guard force and nobody is on site overnight.

    Tools

Discussion(0)

No discussion on this control yet

Edge cases, scoping questions, and “would this pass?” scenarios belong here.

Sign in to start a thread.