Mapped to NIST 800-171 Requirement: 3.10.3
CMMC Assessment Objective: PE.L2-3.10.3[a]
What This Control Means
Your organization must be able to identify:
• What records you maintain related to physical access
• Where those records are stored
• How they are reviewed and used to detect unauthorized access
These records apply to employees, contractors, and visitors who enter CUI-secured spaces.
Why It Matters
Tracking physical access provides:
• An audit trail for accountability
• Insight into potential security violations
• Support during investigations of lost/stolen data or suspicious activity
• Evidence of enforcement of access control policies
Without records, you can’t prove who had access, when, or why.
How to Implement It
1. Identify the Types of Access Records You Use Examples include:
• Electronic badge or keycard logs
• Manual sign-in/sign-out sheets
• Visitor logs with escort details
• Camera or motion-triggered access logs
• Room booking systems (if tied to secure zones)
2. Categorize Access by User Type
• Distinguish between:
◦ Internal personnel
◦ Contractors or vendors
◦ Visitors or escorted guests
3. Track Access to Specific Locations
• Associate logs with CUI-restricted rooms, closets, or buildings
• Know which areas require access tracking and why
4. Define Retention and Review Procedures
• Determine how long access logs are retained (e.g., 90 days, 1 year)
• Document who is responsible for reviewing them and how often
Evidence the Assessor Will Look For
• A list or description of all physical access record types
• System or logbook screenshots showing personnel entries
• Visitor log forms (physical or digital)
• Documentation outlining log retention and access
• Role assignment for reviewing or managing records
Common Gaps
• No recordkeeping for physical access
• Logs are kept, but not tied to CUI areas
• No visitor tracking for non-employee access
• Records exist but aren’t reviewed or retained properly
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Identifying and maintaining a list of physical access records by location and type
• Integrating access logs from badge systems and visitor management platforms
• Associating access logs with specific CUI systems and secure zones
• Supporting log retention policies and role-based access to records
• Helping you prepare evidence packages for audit and incident review
With Cuick Trac, access to CUI systems is always tracked—and never a mystery.
Final CTA
If you can’t track access, you can’t prove control.
Schedule a Cuick Trac demo to identify and manage the records that protect your CUI environments.