CM.L2-3.4.5
Access Restrictions for Change
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee CM.L2-3.4.5 in the reference catalog with its NIST cross-references
Official requirement
Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
Assessment objectives
a. physical access restrictions associated with changes to the system are defined;
b. physical access restrictions associated with changes to the system are documented;
c. physical access restrictions associated with changes to the system are approved;
d. physical access restrictions associated with changes to the system are enforced;
e. logical access restrictions associated with changes to the system are defined;
f. logical access restrictions associated with changes to the system are documented;
g. logical access restrictions associated with changes to the system are approved; and
h. logical access restrictions associated with changes to the system are enforced.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Define and enforce physical and logical access restrictions associated with system changes.
Implementation example
Example from the source assessment guide (not a mandatory implementation): Your datacenter requires expanded storage capacity in a server. The change has been approved, and security is planning to allow an external technician to access the building at a specific date and time under the supervision of a manager [a,b,c,d]. A system administrator creates a temporary privileged account that can be used to log into the server ’s operating system and update storage settings [e,f,g]. On the appointed day , the technician is escorted 89 NIST SP 800-171 Rev. 2, p. 22. into the datacenter, upgrades the hardware, expands the storage in the operating system (OS), and departs. The manager verifies the upgrade and disables the privileged account [h].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Configuration management policy; procedures addressing access restrictions for changes to the system; system security plan; configuration management plan; system design documentation; system architecture and configuration documentation; system configuration settings and associated documentation; logical access approvals; physical access approvals; access credentials; change control records; system audit logs and records; other relevant documents or records
Common mistakes
Approving a change while leaving unrestricted access to implement it.