Mapped to NIST 800-171 Requirement: 3.10.2
CMMC Assessment Objective: PE.L2-3.10.2[a]
What This Control Means
You must be able to describe what tools, platforms, and technologies are used to manage and enforce physical access to secure spaces—including:
• Rooms or buildings containing CUI
• Data closets or server racks
• Secure storage locations for removable media or backup devices
This control provides a baseline inventory of your access control mechanisms.
Why It Matters
Without clarity on what systems are in use:
• You can’t enforce or audit access to sensitive areas
• Equipment failures or misconfigurations may go unnoticed
• Physical access may be left unmanaged or under-protected
• CUI may be exposed due to outdated or incomplete access systems
This control is foundational for securing the perimeter around CUI assets.
How to Implement It
1. Inventory Your Access Control Systems Examples include:
• Electronic badge readers
• Keypads or combination locks
• Smart card access systems
• Biometric scanners
• Mantraps or physical security gates
• Manual locks or key cabinets
• Video surveillance systems (if tied to access control)
2. Identify Their Coverage Areas
• Map which rooms, buildings, or racks each system protects
• Cross-reference with your CUI system inventory
3. Document System Details
• Manufacturer, model, software version (if applicable)
• Who manages or maintains each system
• Integration with other systems (e.g., SIEM, HR, visitor management)
4. Link to Facility Security Policies
• Reference your physical security strategy in your SSP or Access Control Policy
Evidence the Assessor Will Look For
• Inventory or list of physical access control systems
• Facility security diagrams showing access-controlled zones
• Documentation describing how each system works and what it protects
• Assignment of personnel responsible for each system
• Integration logs (e.g., with logging or alerting platforms)
Common Gaps
• No inventory or list of physical access control systems
• Overlooked legacy or manual systems (e.g., keys still in use)
• No record of who maintains or monitors access systems
• Weak or outdated access protections not identified
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Helping identify and document all physical access control systems in your environment
• Mapping each system to specific CUI-protected spaces
• Supporting integration with badge, surveillance, or alarm systems
• Maintaining an up-to-date access control system inventory for audits
• Ensuring physical protection systems align with your CMMC security perimeter
With Cuick Trac, your physical control systems are visible, mapped, and well-managed.
Final CTA
Security starts with knowing what protects your perimeter.
Schedule a Cuick Trac demo to inventory and document your physical access control systems for total visibility and compliance.