PE.L2-3.10.4
Physical Access Logs [CUI Data]
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee PE.L2-3.10.4 in the reference catalog with its NIST cross-references
Official requirement
Maintain audit logs of physical access.
Assessment objectives
a. audit logs of physical access are maintained.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Maintain audit logs of physical access.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You and your cow orkers like to have friends and family join you for lunch at the office on Fridays. Your small company has just signed a contract with the DoD, however, and you now need to document who enters and leaves your facility. You work with the reception staff to ensure that all non-employees sign in at the reception area and sign out when they leave [a]. You retain those paper sign- in sheets in a locked filing cabinet for one year. Employees receive badges or key cards that enable tracking and logging access to company facilities.
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Physical and environmental protection policy; procedures addressing physical access control; system security plan; physical access control logs or records; inventory records of physical access control devices; system entry and exit points; records of key and lock combina tion changes; storage locations for physical access control devices; physical access control devices; list of security safeguards controlling access to designated publicly accessible areas within facility; other relevant documents or records
Common mistakes
Having access controls without records sufficient to review physical entry.