Mapped to NIST 800-171 Requirement: 3.10.1
CMMC Assessment Objective: PE.L2-3.10.1[b]
What This Control Means
You must provide written documentation that describes the physical barriers and access controls protecting systems where CUI resides. These controls must:
• Be identified by type and location
• Be mapped to specific systems or rooms
• Align with your access policies and physical security procedures
This control confirms that physical security is defined, reviewed, and enforced.
Why It Matters
Even with firewalls and encryption, if someone can physically walk up to a CUI system, they may bypass your cybersecurity controls. Without documentation:
• Employees and assessors won’t know what protections are in place
• Physical risks may go unnoticed or unmitigated
• Assessments may fail for lack of evidence—even if controls exist
Documentation proves your protections aren’t just theoretical.
How to Implement It
1. Create or Update Facility Security Documentation Include:
• Which rooms, racks, or locations store/process CUI
• What physical access controls are in place
• Who has access and how that access is managed
2. Identify Controls by Type Examples:
• Locked server rooms
• Keycard or badge readers
• Security guards or monitored reception desks
• Security cameras
• Alarm systems
3. Map Systems to Locations
• Identify which CUI-bearing systems are located in which physically protected spaces
4. Include Access Authorization and Logging
• Describe how access is granted and logged (manual logbooks, badge swipes, visitor sign-in, etc.)
5. Review Regularly
• Update your documentation when systems or access controls change
Evidence the Assessor Will Look For
• System Security Plan (SSP) referencing physical access controls
• Facility security or building access policy
• Floorplans or diagrams identifying secure areas
• Photos or screenshots of access control mechanisms
• Visitor management procedures or access request logs
Common Gaps
• No written record of physical security measures
• Controls exist (e.g., locks, keycards) but are undocumented
• Physical access to CUI-bearing systems not differentiated from general office areas
• No formal authorization process for physical access
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Helping document every physical control used to protect CUI systems
• Linking CUI assets to their secured physical locations
• Generating audit-ready reports and access maps
• Supporting access approval tracking and visitor log integration
• Ensuring alignment with NIST and CMMC physical protection requirements
With Cuick Trac, your physical access controls are as documented as your digital ones.
Final CTA
If it’s not documented, it might as well not exist.
Schedule a Cuick Trac demo to document every lock, badge, and control protecting your CUI systems.