Manage Physical Access [CUI Data]

Control and manage physical access devices.

Quoted verbatim from NIST SP 800-171 Rev. 2 §3.10.5.Source

An assessor determines each objective separately. “Mostly implemented” is not a result — every objective below has to stand on its own.

1. [a]

   physical access devices are identified;

   1 example covers this

2. [b]

   physical access devices are controlled; and

   1 example covers this

3. [c]

   physical access devices are managed.

   1 example covers this

Objective text quoted verbatim from NIST SP 800-171A via the CMMC Level 2 assessment guide.

• addresses[a][b][c]

  PE.L2-3.10.5 · Manage Physical Access [CUI Data]

  Control and manage physical access devices.

  • [a]

    physical access devices are identified;

  • [b]

    physical access devices are controlled; and

  • [c]

    physical access devices are managed.

  Every badge, brass key, and door PIN has an owner in one register

  CCControlVerdict Corpus@cv-corpusOSCJul 31, 2026

  Community is just starting — add yours. No verdicts yet.

  Implementation

  AO coverage. Addresses all Manage Physical Access objectives: physical access devices are identified, controlled, and managed.

  Identified. One register lists every physical access device: each badge with its holder and zone groups, each brass key by keyway and stamped number with its custodian, each keypad door with its PIN age and the list of people who know it, and the spares held in the safe. Building the register the first time turned up eleven unaccounted keys, which was itself the most valuable output of this control.

  Controlled at issue. Devices are issued only against an approved request through the same workflow as logical access, and the recipient signs for it. Spares and blanks live in a safe in the IT area with two custodians; the keyway is a restricted profile so a copy cannot be cut at a hardware store. Nobody carries a master except the facilities lead, and that key is signed out for a specific purpose rather than held permanently.

  Controlled in use. Keys may not leave the building except for the facilities lead's on-call key. Keypad PINs are individual where the hardware supports it; where it does not, the shared PIN is treated as a weak control, the door behind it holds nothing in scope, and it is on the list to be replaced with a reader.

  Managed over time. Return is enforced at offboarding — the checklist itemizes each device from the register by serial or stamp, and the ticket cannot close with an outstanding item. Lost badges are deactivated immediately on report; a lost key triggers a risk decision, and for the server room or a CUI storage cabinet the decision is rekey, which we have done once. Shared PINs rotate on a schedule and immediately on any departure of someone who knew them.

  Maintenance. Quarterly inventory: badges reconciled against the active roster automatically, keys physically sighted or accounted for by custodian signature. Annual review of which doors still need mechanical keys at all, with the long-term goal of eliminating them.

  Accepted gap. The two keypad doors cannot log who entered, only that the door opened. Both lead to areas without in-scope systems, camera coverage compensates, and their replacement is on the facilities plan for next year.

  What the evidence looks like

  • Physical access device register covering badges, keys, and keypad doors
  • Signed issue records and the key custody log
  • Offboarding checklist itemizing device return, plus a completed example
  • Rekey work order and the loss report that triggered it
  • Quarterly physical inventory results with custodian signatures

  Environment

  Mixed physical access technology: badges on most doors, brass keys for two storage cabinets and the server room override, and keypad locks on two interior doors installed before the badge system.

  Tools

  • Physical access control
  • Rekey vendor

  Edit history

  · No edits yet