Requirements 3.10
3.10 Physical Protection: the NIST SP 800-171 requirements
The 6 requirements of family 3.10, Physical Protection, in NIST SP 800-171 Rev 2, worth 14 points of a SPRS score under 32 CFR 170.24. For each: NIST's text, what it costs when not met, the objectives an assessor determines under NIST SP 800-171A, and how to meet it. To mark each one and work out your score, use the free calculator.
3.10.1 Physical Access Limitation
Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.
Points: 5 points.
Assessment objectives (NIST SP 800-171A)
- [a]authorized individuals allowed physical access are identified.
- [b]physical access to organizational systems is limited to authorized individuals.
- [c]physical access to equipment is limited to authorized individuals.
- [d]physical access to operating environments is limited to authorized individuals.
How to meet it
Limit physical access to areas housing CUI systems (server rooms, network closets, work areas with CUI) to a named list of authorized personnel enforced by locks, badge readers, or keyed access. Move any exposed network gear (switches in open areas) into locked enclosures. Evidence: the authorized access list, photos of the physical controls, and badge system permission exports.
3.10.2 Physical Facility Protection
Protect and monitor the physical facility and support infrastructure for organizational systems.
Points: 5 points.
Assessment objectives (NIST SP 800-171A)
- [a]the physical facility where organizational systems reside is protected.
- [b]the support infrastructure for organizational systems is protected.
- [c]the physical facility where organizational systems reside is monitored.
- [d]the support infrastructure for organizational systems is monitored.
How to meet it
Protect and monitor the facility: alarm system or monitored cameras covering entrances and the server room, documented after-hours protection, and periodic checks that monitoring works. A small camera/alarm package from a commercial provider typically satisfies this for a single-site contractor. Evidence: monitoring system documentation, camera placement diagram, and sample footage retention settings.
3.10.3 Visitor Escorts
Escort visitors and monitor visitor activity.
Points: 1 point.
A plan of action (POA&M) may never hold this requirement: a CMMC Level 2 status needs it met, whatever the score.
Assessment objectives (NIST SP 800-171A)
- [a]visitors are escorted.
- [b]visitor activity is monitored.
How to meet it
Require all visitors to sign in, wear a visitor badge, and be escorted while in areas containing CUI or CUI systems: no unescorted vendor or guest movement. Print a one-page escort policy and brief the staff who receive visitors. Evidence: the visitor policy, completed sign-in logs, and visitor badge stock.
3.10.4 Physical Access Logs
Maintain audit logs of physical access.
Points: 1 point.
A plan of action (POA&M) may never hold this requirement: a CMMC Level 2 status needs it met, whatever the score.
Assessment objectives (NIST SP 800-171A)
- [a]audit logs of physical access are maintained.
How to meet it
Maintain physical access audit logs: badge system logs where deployed, and the visitor log plus a key/entry register for facilities on physical keys. Retain them for at least a year and review them if an incident occurs. Evidence: badge system log exports and the retained visitor logs.
3.10.5 Physical Access Devices
Control and manage physical access devices.
Points: 1 point.
A plan of action (POA&M) may never hold this requirement: a CMMC Level 2 status needs it met, whatever the score.
Assessment objectives (NIST SP 800-171A)
- [a]physical access devices are identified.
- [b]physical access devices are controlled.
- [c]physical access devices are managed.
How to meet it
Control and account for physical access devices: keep a register of who holds which keys, badges, and fobs; recover them at termination (tie into your 3.9.2 checklist); and rekey or deactivate promptly when devices are lost or unreturned. Evidence: the key/badge register with issue and return dates and records of deactivations.
3.10.6 Alternative Work Sites
Enforce safeguarding measures for CUI at alternate work sites.
Points: 1 point.
Assessment objectives (NIST SP 800-171A)
- [a]safeguarding measures for CUI are defined for alternate work sites.
- [b]safeguarding measures for CUI are enforced for alternate work sites.
How to meet it
Define safeguards for CUI at alternate work sites (home offices): company-managed encrypted laptops only, VPN for connectivity, locked storage or a clean-desk rule for any printed CUI, and a signed telework agreement acknowledging the rules. Prohibiting printed CUI at home entirely is a simplifying option. Evidence: the telework policy and signed agreements from remote workers.