Mapped to NIST 800-171 Requirement: 3.10.2
CMMC Assessment Objective: PE.L2-3.10.2[b]
What This Control Means
After identifying your physical access control systems (PE.L2-3.10.2[a]), you must ensure those systems are documented in your:
• Security policies
• System Security Plan (SSP)
• Facility security documentation
• Asset inventories or security system logs
This documentation provides evidence of what’s in place, how it’s used, and who manages it.
Why It Matters
Without formal documentation:
• You can’t prove physical protections exist
• Access control responsibilities may be unclear
• Security gaps or coverage gaps may go unnoticed
• You may fail an audit, even with working controls
Documenting systems supports clarity, consistency, and audit readiness.
How to Implement It
1. List All Physical Access Control Systems Include:
• Electronic badge systems
• Keypads, biometrics, smart locks
• Manual key-based systems (if still used)
• Video surveillance integrated with access management
2. Document Where and How They Are Used
• Link each system to the rooms, buildings, or equipment it protects
• Note who has access to manage or audit each system
3. Include Technical and Administrative Details
• Manufacturer, model/version
• System owner or facility security officer
• Maintenance schedules or support agreements
4. Store in Relevant Security Documentation
• Access Control Policy
• System Security Plan (SSP)
• Physical Security Procedures
• Facilities Management documentation
Evidence the Assessor Will Look For
• A written list or inventory of access control systems
• Facility diagrams referencing security zones and their protections
• Access Control Policy describing system usage and responsibilities
• SSP with sections referencing physical protection mechanisms
• Examples of signage, logs, or access records tied to documented systems
Common Gaps
• Systems in place but not documented anywhere
• No linkage between CUI systems and the physical controls that protect them
• Missing or outdated SSP entries for access control mechanisms
• Unclear ownership of physical security infrastructure
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Maintaining a centralized inventory of physical access control systems
• Mapping protections to specific rooms, racks, or CUI-handling systems
• Automatically generating documentation for SSP and audit readiness
• Supporting review and update workflows when systems are added or changed
• Aligning physical controls with your digital asset protection strategy
With Cuick Trac, your documentation is clear, current, and fully aligned with the protections in place.
Final CTA
Documentation is the evidence your controls are real.
Schedule a Cuick Trac demo to centralize and verify your physical access control documentation for CMMC success.