PE.L2-3.10.1[b] – Examine documentation to confirm physical access controls protecting CUI systems are identified.

This objective ensures your organization has formally documented the physical access controls that protect systems storing, processing, or transmitting Controlled Unclassified Information (CUI). This includes doors, locks, access cards, guards, cameras, and any other mechanisms that restrict physical entry to sensitive areas.

PE.L2-3.10.2[a] – Identify physical access control systems.

This objective requires your organization to identify the systems used to control physical access to areas where Controlled Unclassified Information (CUI) is stored or processed. These may include electronic badge systems, keypads, locks, surveillance systems, or other security technologies.

PE.L2-3.10.5[b] – Examine documentation to confirm physical access records to be reviewed are identified.

This objective ensures your organization has formally documented which physical access records must be reviewed, how often they’re reviewed, and who is responsible. This supports your ability to detect unauthorized physical access to CUI systems or areas through a structured review process.

PE.L2-3.10.8 – Maintain audit logs of visitor activity.

This control requires your organization to log and retain records of all visitor activity in areas where Controlled Unclassified Information (CUI) is stored, processed, or transmitted. This includes details like names, entry/exit times, escort info, and purpose of visit.

PE.L2-3.10.4 – Maintain audit logs of physical access.

This control requires your organization to maintain audit logs of physical access to areas or systems that handle Controlled Unclassified Information (CUI). These logs must be complete, accurate, and retained long enough to support incident response, investigations, and compliance assessments.

PE.L2-3.10.7 – Escort visitors and monitor visitor activity.

This control requires your organization to escort all visitors in areas where Controlled Unclassified Information (CUI) is processed or stored, and to monitor their activity to prevent unauthorized access or mishandling of sensitive systems or data.

PE.L2-3.10.5[a] – Identify physical access records to be reviewed.

This objective requires your organization to identify which physical access records (e.g., badge logs, visitor sign-in sheets, video access logs) must be reviewed regularly to detect unauthorized access to areas containing Controlled Unclassified Information (CUI).

PE.L2-3.10.1[c] – Determine if physical access controls protecting CUI systems are implemented.

This objective confirms that the physical access controls identified and documented in PE.L2-3.10.1[a–b] are actually in place and functioning across your organization. It verifies that systems storing Controlled Unclassified Information (CUI) are physically protected as described in your policies and plans.

PE.L2-3.10.10 – Protect and monitor the physical facility and support infrastructure for organizational systems.

This control requires your organization to protect and actively monitor your facilities and infrastructure that support systems processing Controlled Unclassified Information (CUI). This includes physical buildings, wiring closets, server rooms, HVAC systems, power supplies, and other assets critical to your secure IT environment.

PE.L2-3.10.3[a] – Identify personnel access records.

This objective requires your organization to identify the records you use to track physical access to areas or systems that store, process, or transmit Controlled Unclassified Information (CUI). This includes logs from badge readers, sign-in sheets, visitor logs, or any mechanism that documents who accessed what and when.