Mapped to NIST 800-171 Requirement: 3.10.6
CMMC Assessment Objective: PE.L2-3.10.6[a]
What This Control Means
You must maintain a list or inventory of all physical access control devices, including:
• What they are (type/model)
• Where they’re located
• What they protect
• Who manages or maintains them
This includes any mechanism used to physically restrict entry to secure areas (e.g., CUI server rooms, media storage closets).
Why It Matters
Without visibility into what devices are protecting CUI:
• You can’t ensure proper maintenance, monitoring, or updates
• Unauthorized devices may go unnoticed
• Devices may fail silently without detection
• Compliance documentation may be incomplete or inaccurate
Inventorying these devices supports risk management, maintenance planning, and compliance visibility.
How to Implement It
1. Inventory All Access Devices Include:
• Badge readers
• Smart locks
• Keypads or PIN systems
• Physical keys and lockboxes
• Surveillance systems tied to access control
• Mantraps or turnstiles (if used)
2. Map Devices to Locations
• Note which rooms, buildings, or CUI storage zones each device protects
3. Track Key Details For each device:
• Make/model or system name
• Location
• Purpose (e.g., restrict access to CUI cabinet)
• Owner or manager (individual or department)
• Maintenance or support contact
4. Document in Security Plans
• Add this information to your:
◦ System Security Plan (SSP)
◦ Physical Security Plan
◦ Facility Access Control Procedures
Evidence the Assessor Will Look For
• A list or inventory of physical access control devices
• Facility diagrams showing devices and their protected zones
• Documentation outlining device ownership and maintenance responsibilities
• Access logs tied to specific hardware
• Asset management entries for security-related physical devices
Common Gaps
• No inventory of locks, badge systems, or keypads
• Devices installed without records of what they protect
• Responsibility for devices unclear or undocumented
• Legacy equipment still in use but forgotten
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Maintaining a centralized inventory of physical access devices by location and type
• Linking devices to the CUI zones they protect
• Assigning ownership and maintenance responsibilities
• Integrating access logs with devices for accountability
• Ensuring device data is available for audits and physical security reviews
With Cuick Trac, your physical access environment is fully mapped, controlled, and compliant.
Final CTA
You can’t secure what you can’t see.
Schedule a Cuick Trac demo to identify and document the physical access devices that protect your most sensitive systems.