PE.L1-b.1.viii
Limit Physical Access [FCI Data]
Source and approval
CMMC Assessment Guide — Level 1 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee PE.L1-b.1.viii in the reference catalog with its NIST cross-references
Official requirement
Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.
Assessment objectives
a. authorized individuals allowed physical access are identified;
b. physical access to organizational systems is limited to authorized individuals;
c. physical access to equipment is limited to authorized individuals; and
d. physical access to operating environments is limited to authorized individuals.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Restrict physical access to systems, equipment, and their operating environments to authorized people.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You manage a DoD project that stores FCI on computers used only by project team members [b,c]. You work with the facilities manager to put locks on the doors to the areas where the computers are stored and used [b,c,d]. Project team members are the only individuals issued with keys to the space. This restricts access to only those employees who work on the DoD project and require access.
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Physical and environmental protection policy; procedures addressing physical access authorizations; system security plan; authorized personnel access list; authorization credentials; physical access list reviews; physical access termination records and associated documentation; other relevant documents or records
Common mistakes
Protecting the server room while leaving workstations or other in-scope equipment accessible.