NIST 3.10.4: Maintain Audit Logs of Physical Access
NIST 800-171 requirement 3.10.4 mandates that organizations maintain audit logs documenting physical access to facilities and secure areas where Controlled Unclassified Information is processed, stored, or transmitted. These logs provide accountability, support incident investigations, and demonstrate compliance with physical security requirements under CMMC Level 2.
What This Requirement Means
Physical access audit logs create a documented record of who enters and exits secure areas within your facility. This requirement applies to both exterior entry points and interior access points to systems or system components requiring supplemental access controls. Organizations have flexibility in implementation approaches. Audit logs can be procedural, such as written sign-in sheets where individuals manually record their access. They can be automated, using badge readers or biometric systems that electronically capture entry events. Most organizations implement a combination of both methods to balance security needs with operational efficiency.
The logs serve multiple purposes beyond basic compliance. They establish accountability for physical access activities, provide forensic evidence for security investigations, support monitoring of visitor activity, and help detect unauthorized or suspicious access patterns. Physical access points subject to logging requirements include facility perimeter doors, server rooms, wiring closets, data centers, and areas where CUI is accessed or stored.
Why Physical Access Logging Matters
Physical security represents the first line of defense for protecting sensitive information. Technical controls such as firewalls, encryption, and access controls become ineffective if unauthorized individuals can physically access systems and equipment. Physical access logs provide visibility into who accessed sensitive areas and when those accesses occurred. This visibility enables organizations to detect anomalies, investigate incidents, verify that only authorized personnel entered restricted areas, and maintain the chain of custody for compliance purposes.
Without proper physical access logging, organizations cannot demonstrate accountability or identify security breaches that occur through physical means. Audit logs also support compliance verification during CMMC assessments, where assessors expect to review access records and confirm they align with authorization lists.
Implementation Requirements
Effective implementation requires organizations to identify all physical access points requiring logging, including both perimeter entry points and interior secure areas. Determine which logging method best fits each location based on sensitivity level, traffic volume, and available resources. For procedural logs, create standardized sign-in sheets that capture required information consistently. For automated systems, configure badge readers, keycard systems, or biometric scanners to record access events.
Physical access logs must capture specific data elements to meet compliance requirements. Required information includes the identity of individuals accessing the facility, entry and exit times, date of access, identification method used such as badge number or PIV card, and the specific access point or door used. For visitor access, logs should also document the host employee, purpose of visit, and areas accessed during the visit.
Establish retention policies that align with organizational requirements and regulatory mandates. Typical retention periods range from 90 days to one year, though some organizations maintain records longer to support historical analysis. Implement regular review procedures to examine logs for unauthorized access attempts, access outside normal business hours, repeated failed access attempts, or access by individuals whose authorization has been revoked.
| Log Type | Implementation Method | Best Use Case | Data Captured |
|---|---|---|---|
| Procedural | Written sign-in sheets | Low-traffic areas, visitor management | Manual entries with signatures |
| Automated | Badge readers, PIV cards | High-traffic areas, employee access | Electronic timestamps, card ID |
| Biometric | Fingerprint or retinal scanners | Highly sensitive areas | Biometric identifier, timestamp |
| Video Surveillance | Camera systems with recording | Supplemental monitoring | Visual record, motion detection |
Evidence Required for Assessment
During CMMC assessments, evaluators expect to see multiple forms of evidence demonstrating physical access logging practices. Organizations must provide samples of physical access logs from recent time periods showing actual access events. These samples should include both routine employee access and visitor entries. Documentation of the logging methodology used, including procedures for manual logs or system configurations for automated solutions, must be available for review.
Assessors verify that access logs align with authorized personnel lists. Organizations should maintain current authorization matrices identifying individuals permitted to access each secure area. Evidence of periodic log reviews should document who performed the review, when it occurred, and any findings or corrective actions taken. Retention policies must be documented and demonstrate that logs are preserved according to policy requirements. For automated systems, configuration screenshots showing logging settings, retention periods, and access controls protecting the logs themselves provide necessary verification.
Common Implementation Gaps
Organizations frequently encounter specific challenges when implementing physical access logging. A common gap involves logs that exist but lack completeness. Missing data elements such as exit times, identification methods, or specific access points used reduce the forensic value of the records. Another frequent issue is inadequate retention management where logs are overwritten prematurely or not archived according to policy.
Many organizations fail to implement regular log review procedures. Simply collecting access data without periodic examination means anomalies and unauthorized access go undetected. Access logs that are not adequately protected represent another vulnerability. If unauthorized personnel can view or modify access logs, the integrity of the audit trail is compromised. Organizations must apply appropriate access controls to logging systems and storage locations.
Inconsistent logging practices across different facility areas create gaps in visibility. All entry points to secure areas require consistent logging, not just primary entrances. Finally, visitor access often receives less rigorous logging than employee access, despite visitors presenting elevated security risks.
FAQ
What types of physical access logs are acceptable?
Organizations can use procedural logs such as written sign-in sheets, automated systems like badge readers or PIV cards, or a combination of both methods.
How often should physical access logs be reviewed?
Physical access logs should be reviewed periodically, typically on a quarterly basis, to identify unauthorized access or suspicious activity patterns.
What information must physical access logs capture?
Logs should record individual identity, entry and exit times, date of access, identification method used, and the specific access points used to enter or exit secure areas.
