Mapped to NIST 800-171 Requirement: 3.10.1
CMMC Assessment Objective: PE.L2-3.10.1[a]
What This Control Means
You must be able to identify and describe all physical controls that protect CUI systems, including:
• Entry restrictions
• Physical barriers
• Access control mechanisms
• Surveillance systems
• Visitor tracking procedures
These controls help ensure that only authorized personnel can access areas where CUI is processed or stored.
Why It Matters
Physical access is often overlooked in cybersecurity—but it’s a critical layer of defense. Without it:
• Unauthorized individuals could steal, tamper with, or destroy systems
• Sensitive data could be accessed without logging or detection
• Insider threats could bypass digital protections by walking into a server room
Identifying these protections is the first step in physical security compliance.
How to Implement It
1. Inventory All CUI Systems
• Identify servers, workstations, printers, removable media, and backup systems that store or access CUI
2. Identify Physical Protection Measures Examples include:
• Keycard or badge access doors
• Locked server racks or cabinets
• Fencing or locked doors to server rooms or data closets
• Security guards or monitored entrances
• Surveillance cameras (CCTV)
3. Map Access by Role
• List which personnel are allowed in CUI-protected areas
• Identify visitors, cleaning staff, or maintenance contractors who need supervision
4. Document Controls
• Include physical access controls in:
◦ Your System Security Plan (SSP)
◦ Facility Security Policy or Building Access Procedure
◦ Visitor Management Procedures
Evidence the Assessor Will Look For
• Facility diagrams showing physical security boundaries
• List of physical access controls (e.g., keypads, locks, guards)
• Documentation identifying access-controlled zones
• Descriptions of how physical access is managed and enforced
• Identification of which systems are physically protected and how
Common Gaps
• No physical restrictions to rooms housing CUI systems
• No records of physical access control measures
• Unlocked racks or exposed network equipment
• No formal awareness of which systems handle CUI or where they’re located
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Helping document physical security controls tied to each CUI system
• Mapping systems to secure zones, closets, or racks
• Tracking authorized personnel for physical access
• Providing audit-ready checklists for physical protection requirements
• Helping enforce separation between secure and general access areas
With Cuick Trac, your physical access plan is mapped, documented, and ready for inspection.
Final CTA
Digital security starts with physical control.
Schedule a Cuick Trac demo to document and enforce the physical protections guarding your CUI systems.