PE.L2-3.10.5
Manage Physical Access [CUI Data]
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee PE.L2-3.10.5 in the reference catalog with its NIST cross-references
Official requirement
Control and manage physical access devices.
Assessment objectives
a. physical access devices are identified;
b. physical access devices are controlled; and
c. physical access devices are managed.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Control and manage physical access devices.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are a facility manager. A team member retired today and returns their company keys to you. The project on which they were working requires access to areas that contain equipment with CUI. You receive the keys, check your electronic records against the seria l numbers on the keys to ensure all have been returned, and mark each key returned [c].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Physical and environmental protection policy; procedures addressing physical access control; system security plan; physical access control logs or records; inventory records of physical access control devices; system entry and exit points; records of key and lock combination changes; storage locations for physical access control devices; physical access control devices; list of security safeguards controlling access to designated publicly accessible areas within facility; other relevant documents or records
Common mistakes
Failing to recover, revoke, inventory, or replace keys and badges as circumstances change.