Control and manage physical access devices
📖 What This Means
This control requires organizations to properly manage physical access devices like key cards, badges, and biometric scanners that protect areas where Controlled Unclassified Information (CUI) is stored or processed. It means ensuring only authorized personnel have access, tracking who enters secure areas, and regularly reviewing access permissions. For example, a defense contractor might use badge readers at server room entrances and maintain logs of all badge swipes. Another example would be deactivating a lost key card within 24 hours to prevent unauthorized access. The goal is to prevent physical breaches that could compromise sensitive data.
🎯 Why It Matters
Uncontrolled physical access devices create significant security risks. A 2021 Verizon report found that 21% of data breaches involved physical security failures. In one real incident, an unauthorized individual gained access to a defense contractor's facility using a stolen badge, resulting in $500,000 in equipment theft and CUI exposure. The DoD prioritizes this control because physical access breaches can bypass all digital security measures. Proper management of access devices prevents tailgating, unauthorized entry, and makes it easier to investigate security incidents. The average cost of a physical security breach in the defense sector exceeds $300,000 when considering investigation, remediation, and potential contract impacts.
✅ How to Implement
- 1. For cloud data centers: Require your CSP to provide SOC 2 Type II reports showing their physical access controls
- 2. Implement multi-factor authentication for physical access to any on-premise equipment connecting to cloud systems
- 3. Maintain an access control matrix showing which personnel can enter server rooms with cloud access points
- 4. Configure cloud monitoring tools (like AWS GuardDuty) to alert when physical access patterns change
- 5. Document all physical access points to cloud-connected infrastructure in your system security plan
📋 Evidence Examples
Physical Access Control Policy
Badge Inventory Report
Access Log Samples
Badge Deactivation Records
Access Control System Configuration
📝 SSP Guidance
Use this guidance when writing the System Security Plan (SSP) narrative for this control.
How to Write the SSP Narrative
For PE.L2-3.10.5 ("Control and manage physical access devices"), your SSP narrative should specifically describe: (1) the tools and technologies you use to implement this control, (2) the configuration or process that enforces it, (3) who is responsible for maintaining it, and (4) what evidence proves it's working. Describe the physical security controls protecting CUI systems, including badge access, visitor management, physical access logging, and alternate work site requirements. Be specific -- name your actual products, settings, and responsible personnel.
Example SSP Narratives
"PE.L2-3.10.5 is implemented using cloud-native controls. [Organization] uses [specific cloud service/feature] to control and manage physical access devices. The configuration is managed through [Azure Policy/AWS Config/Terraform] and monitored via [SIEM tool]. Responsible party: [IT Security Manager]. Evidence: [specific artifact, e.g., 'Azure AD Conditional Access policy screenshot, CloudTrail logs']."
"PE.L2-3.10.5 is implemented through on-premise infrastructure controls. [Organization] uses [Active Directory/Group Policy/specific tool] to control and manage physical access devices. Configuration is documented in [location] and audited [frequency]. Responsible party: [System Administrator]. Evidence: [specific artifact, e.g., 'Group Policy export, Windows Event logs']."
"PE.L2-3.10.5 is implemented across both cloud and on-premise environments. [Organization] uses [Azure AD Connect/hybrid tool] to ensure consistent enforcement. Cloud resources are managed via [cloud tool] and on-premise systems via [on-prem tool]. Both environments report to [centralized SIEM]. Responsible party: [IT Director]. Evidence: [artifacts from both environments]."
System Boundary Considerations
- • Identify all physical locations where CUI is processed or stored
- • Document physical access control mechanisms (badge readers, locks, cameras)
- • Specify CUI area boundaries within each facility
- • Ensure this control covers all systems within your defined CUI boundary where control and manage physical access devices applies
- • Document any systems where this control is not applicable and explain why
Key Documentation to Reference in SSP
- 📄 Physical Protection Policy
- 📄 Badge access logs
- 📄 Visitor logs
- 📄 Alternate work site approval forms
- 📄 Evidence artifacts specific to PE.L2-3.10.5
- 📄 POA&M entry if control is not fully implemented
What the Assessor Looks For
The assessor will physically inspect CUI areas, test badge access controls, review visitor logs, and verify that terminated employees' badges are deactivated promptly.
💬 Self-Assessment Questions
Use these questions to assess your compliance. Each "NO" answer provides specific remediation guidance.
Question 1: Do we maintain a complete inventory of all physical access devices?
Question 2: Is there a documented process to deactivate lost/stolen badges within 4 business hours?
Question 3: Are access logs retained for at least 90 days and reviewed quarterly?
Question 4: Are visitor access records maintained for all CUI areas?
Question 5: Have all physical access controls been tested within the last 6 months?
⚠️ Common Mistakes (What Auditors Flag)
1. Failing to document visitor access
2. Not testing badge deactivation
3. Inconsistent access reviews
4. Poor badge custody tracking
5. Inadequate log retention
📚 Parent Policy
This practice is governed by the Physical Protection Policy