Mapped to NIST 800-171 Requirement: 3.10.9
CMMC Assessment Objective: PE.L2-3.10.9
What This Control Means
You must actively track and control who has access to physical access devices—and how those devices are issued, monitored, replaced, or deactivated. This includes:
• Keycards and badges
• Keys and lock combinations
• Biometrics (fingerprint, facial recognition)
• Any hardware granting physical access to secure areas
The goal is to prevent unauthorized individuals from using or duplicating access devices.
Why It Matters
Uncontrolled access devices = uncontrolled physical access. If devices are:
• Lost or stolen without being deactivated
• Shared between employees
• Duplicated or untracked
…your secure facility could be breached without your knowledge.
This control ensures you maintain a tight grip on the tools that control entry.
How to Implement It
1. Maintain a Device Inventory
• Track who has what: badges, keys, fobs, or biometric credentials
• Note issue date, access level, and expiration (if applicable)
2. Issue Access Devices Based on Role
• Only provide access to those with legitimate business need
• Assign devices individually—no shared badges or keys
3. Revoke or Update Devices Promptly
• Upon termination, role change, or lost/stolen status
• Immediately disable deactivated credentials in your access control system
4. Secure Device Storage
• Keep backup devices, unassigned badges, or key templates in a locked, restricted area
5. Review Device Records Periodically
• Confirm that active device assignments match current personnel
• Audit for unused, expired, or duplicate credentials
Evidence the Assessor Will Look For
• Access control device inventory with user assignments
• Documentation of issuance and revocation procedures
• Badge or key logs (issue/return history)
• Screenshots from access control systems showing real-time device status
• Logs confirming prompt revocation of terminated personnel credentials
Common Gaps
• No tracking of who has access cards, keys, or biometrics
• Former employees’ access devices remain active
• Shared or generic badges used to bypass tracking
• Physical access devices stored insecurely or left unmonitored
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Maintaining a real-time inventory of access control devices and assignees
• Enforcing device issuance and revocation policies
• Integrating with access control systems to disable credentials on role changes or terminations
• Generating audit reports on badge/key usage and review history
• Ensuring full lifecycle tracking of the tools that enable entry into CUI-protected areas
With Cuick Trac, your physical access devices are always secured, assigned, and monitored.
Final CTA
The key to your secure space shouldn’t be a mystery.
Schedule a Cuick Trac demo to take control of the devices that grant access to your CUI zones.