PE.L1-b.1.ix
Manage Visitors & Physical Access [FCI Data]
Source and approval
CMMC Assessment Guide — Level 1 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee PE.L1-b.1.ix in the reference catalog with its NIST cross-references
Official requirement
Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.
Assessment objectives
a. visitors are escorted;
b. visitor activity is monitored;
c. audit logs of physical access are maintained;
d. physical access devices are identified;
e. physical access devices are controlled; and
f. physical access devices are managed.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Escort visitors, record physical access, and manage the keys, badges, and other devices that grant access.
Implementation example
Example from the source assessment guide (not a mandatory implementation): Coming back from a meeting, you see the friend of a coworker walking down the hallway near your office where FCI is stored. You know this person well and trust them, but are not sure why they are in the building. You stop to talk, and the person explains that they are meeting a coworker for lunch, but cannot remember where the lunchroom is. You walk the person back to the reception area to get a visitor badge and wait until someone can escort them to the lunchroom [a]. You report this incident, and the company decides to install a badge reader at the main door so visitors cannot enter without an escort [a]. Example 2 You and your coworkers like to have friends and family join you for lunch at the office on Fridays. Your small company has just signed a contract with the DoD in which your company will receive FCI and you now need to document who enters and leaves your facility. You work with the reception staff to ensure that all non-employees sign in at the reception area and sign out when they leave [c]. You retain those paper sign-in sheets in a locked filing cabinet for one year. Employees receive badges or key cards that enable tracking and logging access to company facilities. Example 3 You are a facility manager. A team member retired today and returns their company keys to you. The project on which they were working requires access to areas that contain equipment with FCI . You receive the keys, check your electronic records against the serial numbers on the keys to ensure all have been returned, and mark each key returned [f].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Physical and environmental protection policy; procedures addressing physical access control; system security plan; physical access control logs or records; inventory records of physical access control devices; system entry and exit points; records of key and lock combination changes; storage locations for physical access control devices; physical access control devices; list of security safeguards controlling access to designated publicly accessible areas within facility; other relevant documents or records
Common mistakes
Keeping a visitor book without controlling visitor activity or recovering keys and badges.