PE.L2-3.10.1 Limit physical access: evidence and audit

What PE.L2-3.10.1 requires to limit physical access

PE.L2-3.10.1 requires you to limit physical access to your systems, equipment and operating environments to individuals you have authorized. For a defense contractor preparing for a Level 2 assessment, that means you must be able to name who is allowed into each space where CUI can be seen, printed, typed or stored, and show that the doors, locks and badge settings actually enforce that list. The requirement is the Level 2 form of the Level 1 safeguard PE.L1-b.1.viii, which applies to federal contract information. It is worth 5 points under the CMMC Scoring Methodology and must be MET, because it cannot be carried on a POA&M. A missing or unenforced access decision here can therefore hold back your Conditional or Final Level 2 status even when your logical controls are strong.

The risk is straightforward. Someone without a need to know can reach CUI through a server cabinet, a workstation left logged in, a networked printer that outputs controlled drawings, or a test bench where engineering data sits on a device. It is a basic requirement because physical access bypasses most logical controls: an attacker in a room with a console does not need your passwords. Two things usually make it hard. First, authorization lists are unclear or stale, so no one can say who is supposed to be inside a lab or a server closet. Second, spaces that hold CUI are not recognized as such, so they are left out of the access scope. Machine shops, test cells and rooms with specialized equipment are common examples.

Start with an inventory of physical locations that touch CUI, including offices, equipment rooms, testing environments and any area with output devices. For each one, record who is authorized, how entry is controlled (badge, electronic lock or physical key) and where the approval record lives. Then check that the list matches what the doors actually allow, and confirm that the list is reviewed on a schedule you define. Assessors test the authorization list, the credentials issued against it and the process for granting and removing access, so treat those as the evidence you will need to produce. Confirm with your assessor or your C3PAO how they expect you to show the review cycle and the termination of access for departed staff, since those details shape what counts as final evidence.

Which rooms, systems and people fall under physical access limits

Before you can limit access, you have to decide which physical spaces hold CUI systems, equipment and operating environments. The cards below cover the scope decisions assessors expect you to make and document, and each one changes who must appear on your authorization list.

Offices and workspaces with CUI systems

Any office where a workstation, laptop docking station or local server handles CUI falls within the requirement, whether the space is a dedicated room or part of a shared floor. A shared floor usually needs controlled entry at the building or floor level plus protection of the specific workstations, since badge access alone does not stop a visitor from reading a screen. Check which employees, contractors and cleaning crews enter after hours, and confirm that each has an authorization entry tied to their role.

Equipment rooms and server closets

Server rooms, network closets and wiring cabinets are the most common places where CUI infrastructure sits without the same attention as the main office. Treat each closet that holds a firewall, switch, storage array or backup device as in scope, even if it is a converted supply room. Confirm the lock type, who holds keys or codes, and whether the room is listed in your access records. Cleaning and maintenance vendors often need access here, so each one belongs on the list with a documented reason.

Testing environments and lab areas

Test benches, development labs and staging systems can hold copies of CUI or live connections to production, which places them within scope. Engineers who rotate between lab and production work may appear on several lists, so review both. Lab spaces often have looser entry habits, including shared doors, loaned badges and equipment left on open benches. Ask whether any test system contains real CUI, because a test copy of CUI is still CUI.

Output devices such as printers and scanners

Printers, scanners, copiers and multifunction devices can retain CUI in memory or leave printed pages in output trays where unauthorized people can read them. The requirement covers placing these devices where they do not expose data, so their location is the control to document. Decide whether each device sits inside a controlled area or needs a secured print release. Maintenance technicians who service these devices should be added to the authorization list while on site.

Colocation cages and cloud-adjacent spaces

If your CUI systems sit in a colocation cage, a data center suite or a rack provided by a hosting partner, the operator's staff and other tenants' personnel affect your access picture. Request the provider's visitor and access records and confirm how your own authorized individuals are enrolled and removed. Remember that cloud platforms handle their own data center controls, so your responsibility is the physical space you control and the devices you own. Confirm the division of responsibility in writing before you rely on it.

How an assessor tests physical access limits

This table compares the four NIST SP 800-171A assessment objectives for PE.L2-3.10.1 with the process test an assessor runs on authorizations. Read each row as a question the assessor asks, the evidence they request, and where organizations usually fail. A requirement is MET only when every applicable objective is satisfied with evidence in final form.

Assessment objective	Test approach	Evidence requested	Common finding
Individuals authorized for physical access are identified	Compare the authorized list against the people and roles the organization says need access to the facility	Authorized personnel access list with approval dates and the owner who signed it off	List exists but is undated, unsigned or omits contractors and cleaning staff
Physical access to systems is limited to authorized individuals	Walk the server room, network closet and workstation areas and check who can enter and how	Badge or key configuration for system spaces, and a sample reconciliation of entries to the authorized list	Doors left propped open or shared codes that cannot be tied to one person
Physical access to equipment is limited to authorized individuals	Check locks and enclosures on racks, printers, test equipment and removable media storage	Lock inventory, rack or cabinet access records and output device placement diagrams	Printers in open corridors or equipment cabinets with keys held by many staff
Physical access to operating environments is limited to authorized individuals	Confirm that offices, testing environments and equipment rooms carry the same controls as the systems inside them	Floor plans marking CUI spaces, access control settings for each room and entry sample	Testing labs or engineering areas handling CUI left outside the access boundary
Authorization process is performed: grant, review and terminate	Test the process by sampling new hires, role changes and departures and tracing each through the access list	Authorization credentials issued, access list review records, and physical access termination records	Reviews are not performed on a set schedule and leavers keep badges for weeks

Why a missing physical access control blocks Level 2 status

PE.L2-3.10.1 is worth 5 points, and it cannot be left on a plan of action and milestones (POA&M). Under the CMMC Scoring Methodology in 32 CFR 170.24, a requirement that is NOT MET is subtracted from the maximum score of 110. Because this requirement carries more than 1 point, 32 CFR 170.21(a)(2) does not allow it on a POA&M. In practical terms, the organization cannot promise to add limited physical access later and still reach Conditional or Final Level 2 status. The requirement has to be MET when the assessment is performed, which means the physical controls must already be operating, with evidence in final form.

That changes the work before any assessment. Physical access authorizations, badge or key-lock configurations, and access list reviews need to exist and run on their own, not appear as a plan. Teams should walk through the offices, testing environments and equipment rooms that hold CUI or the systems that process it, confirm who holds credentials for each space, and pull the access list and its most recent review. A useful internal check is to ask whether a reviewer could trace one named person from the authorized list to a current badge or key and back to a documented termination record. If that trace breaks, the requirement is not yet MET, whatever the intent.

The same rules apply to a Level 2 self-assessment and a certification assessment, so an organization should not plan around a lighter standard for either path. The program schedule has changed recently, and the status of Phase II and the assessment types in use should be confirmed on the DoW CIO About CMMC page and in the current eCFR text of 32 CFR Part 170 before any planning decision. Whatever the schedule, the scoring consequence for this requirement is the same: an unmet physical access control costs 5 points and removes the option to carry it forward.

How to implement physical access limits step by step

This sequence turns the PE.L2-3.10.1 requirement into a documented, enforced and reviewed set of physical access limits that an assessor can trace from scope to evidence.

Define protected spaces and devices from scope
Start from the system security boundary in your System Security Plan and list every room, rack, cabinet, test bench and workstation area where CUI systems, equipment or their operating environments sit. Include offices, testing environments and equipment rooms, since the Level 2 assessment guidance covers all of them. The output is a scoped room and device inventory that matches the boundary, and you know it is done when someone outside the project can point to each location and confirm it is in or out of scope.
Name an accountable owner for physical access
Assign one named person, usually a facilities or security lead, to own physical access limits for the scoped spaces. That owner approves access requests, maintains the access list and answers assessor questions. The output is a written role assignment, signed off by the organization's leadership, that states who decides who gets in. Your organization owns the control; an implementation partner or consultant can help document it but cannot take on the accountability.
Build the authorized access list
Identify each individual who needs physical access to each scoped space, record the business reason and approver, and capture the list as a controlled document. The assessment objectives call for identifying authorized individuals first, so this list is the central artifact an assessor will request. The output is an approved access list tied to specific spaces, with a version date. You know it is done when every person on the list maps to a documented need and no one on the badge system is missing from it.
Select access mechanisms for each space
Choose how each scoped space is controlled, whether by badge readers, electronic locks or physical key locks, and record which mechanism protects which door. Where a space is shared with non-authorized staff, confirm that the mechanism stops entry to equipment and not just to the room. Confirm with your facilities vendor and building management which capabilities your existing hardware supports before you buy anything. The output is a mechanism map that links each space to its lock or reader and to the access list it draws from.
Restrict output devices and terminals
Place printers, displays and other output devices so that people without authorization cannot see or retrieve CUI from them. Move shared printers into controlled areas, angle screens away from public corridors and lock unattended terminals in scoped spaces. The Level 2 guidance treats output placement as part of this requirement, so an assessor will walk the space to check. The output is a short floor-plan or photo record showing where each device sits and how it is protected, and you know it is done when a visitor standing in an open corridor cannot read a screen or collect a printout.
Document the authorization and termination workflow
Write the steps for granting access, changing access when roles change and removing access when someone leaves, including who submits each request, who approves it and how the mechanism is updated. Termination records matter as much as grants, because assessors test whether access is revoked promptly. Link this workflow to your personnel security and offboarding procedures so HR events trigger physical access changes. The output is a written procedure with a sample of completed grant and removal records, which shows the process runs in practice.
Run the first access list review
Compare the approved access list against the live badge, lock and key records for every scoped space, then remove anyone who no longer needs access and document each exception. Record the reviewer, date and findings, and set the next review date according to the period your own policy defines. The output is a signed review record that shows the list was tested against the physical reality. You know it is done when the review produces a dated record with corrections applied, since an assessor will expect evidence that the list was checked and not only written.

Evidence that passes a physical access assessment

An assessor testing PE.L2-3.10.1 looks for records that show who is authorized, who was actually given access, and that access was removed when it should be. The six artifacts below connect those points, and each one must be final and dated, because a draft does not satisfy a requirement that is scored as MET or NOT MET.

Authorized personnel access list

This is the list of individuals authorized to enter offices, equipment rooms and testing environments that hold CUI or support systems that handle it. The assessor checks that every name has an owner-approved entry, that the list covers each protected space, and that it matches what the badge or lock system actually grants. Keep it current by tying every addition to an approval record and reviewing it on a schedule the organization defines. Illustrative check: a contractor who appears on the list but has no approval record will raise a question at the first sample.

Credential issuance records

These records show when each badge, key or electronic credential was issued, to whom, by whom, and against which authorization. Assessors use them to confirm that access was granted through the documented process rather than informally. Record the credential identifier, issue date and the approver's sign-off in one place. Confirm with your access control vendor which fields its issuance reports can export, since gaps in those fields are often where assessors ask follow-up questions.

Periodic access review records

A review record shows that someone accountable for each protected space re-checked the access list and confirmed or removed entries. The assessor looks for a named owner, a review date, the list version reviewed, and the decisions taken. A signature block that is blank, or a review dated before the list it covers was last changed, will not satisfy the assessor. Set the review interval in your system security plan and retain each signed review as the evidence of performance.

Termination and role-change records

These records prove that access was removed when someone left or changed roles. Assessors compare the departure or transfer date against the date the badge was deactivated, the key was returned or the lock code was changed. A gap of several weeks between the HR event and the access change is a finding waiting to happen. Build a single workflow where HR notifies facilities or security on the same day, and keep the ticket, the deactivation log and the key return receipt together.

Floor plans and protected space identification

Floor plans or dated photographs identify which rooms, cages and equipment areas are protected and where each access point sits. The assessor uses them to confirm that the access list covers every space that holds systems, equipment or operating environments in scope, including testing areas and equipment rooms. Mark the boundary of each protected space, label doors and readers, and update the drawing after any move or renovation. A plan that shows a room the access list omits is a common reason an assessment stalls.

Badge and lock system configuration exports

Configuration exports from badge readers, electronic locks or access controllers show the access rules currently in force. The assessor compares them with the authorized list to confirm that the system enforces what the paperwork says. Export the configuration on a schedule and after each change, store it with a timestamp, and record who made the change. Where the platform is self-hosted, confirm that exports can be generated without vendor involvement and that the export itself is protected from unauthorized edits.

What meeting physical access limits costs in money and effort

This table compares the cost components of limiting physical access to CUI systems and their operating environments, showing who is paid for each, whether it is one-time or recurring, and what pushes it up. Read it as a checklist for requesting line-item quotes, and ask each provider which items are one-time and which recur every year.

Cost component	One-time or recurring	What drives it up and how to keep it down
Locks, badge readers and key hardware	One-time purchase, with replacement cost over time	Number of doors and rooms in scope drives cost up. Scope only spaces that hold CUI systems, equipment or output devices, and reuse working locks where they meet the requirement.
Access control software or licenses	Usually recurring (subscription or annual license), plus one-time setup	Per-door or per-user pricing and integration work raise cost. Ask whether a self-hosted open-source access system can run on existing hardware, and confirm its badge and lock compatibility before relying on it.
Facility modifications such as added readers or rekeying	One-time labor and materials	Retrofitting wiring, separating zones and rekeying a whole building are the largest one-time items. Plan changes in a single phase and group rekeying with other planned work.
Engineering and facilities staff time	One-time for setup, recurring for administration	Custom integration and documentation drive hours up. Ask the implementer to name who does each task (internal staff, a partner or a vendor) and how many hours each task is expected to take.
Recurring access list reviews	Recurring, at the frequency the organization defines	Large or fast-changing staff lists increase review effort. Keep access lists tied to HR and role changes so reviews compare current records instead of rebuilding them.
Evidence upkeep	Recurring	Retaining access lists, authorization records, review sign-offs and termination records adds storage and staff time. Automate exports and set one retention schedule for all physical access records.
External review or pre-assessment support	Often one-time per cycle, may recur	Scope size and the number of gaps found drive the bill. Ask whether the quote covers only readiness review and whether the independent assessor's fees are separate. Assessors cannot be the same firm that prepared the controls.

Who owns physical access limits and what a partner can prepare

Your organization owns PE.L2-3.10.1. The requirement asks that physical access to systems, equipment and operating environments be limited to authorized individuals, and only your organization can decide who those individuals are. Leadership, security and facilities staff must agree on the authorization criteria, approve each person on the access list, and sign off on periodic access reviews. Those signatures are part of the evidence an assessor will examine, so they must be made by named people with the authority to grant access.

Authorization decisions: Name the roles, such as system administrators, engineers and cleared personnel, that may enter the controlled areas, and record who approved each individual.
Access list ownership: Assign one accountable owner for the authorized personnel list and define how often it is reviewed.
Review sign-off: Have a responsible manager review the list, remove people who no longer need access, and sign the review with a date.
Operating environment scope: Decide which offices, server rooms, testing areas and equipment rooms fall inside the CUI boundary.
Policy approval: Leadership approves the physical access procedure so that it is an organizational rule, not a team habit.

Before any partner begins work, confirm that these owners and decisions exist in writing, because nothing else in the evidence set can substitute for them.

Where physical access controls usually fall short

Most assessors find the same weaknesses in physical access control: the access list no longer matches reality, keys and badges are shared, and the scope leaves out rooms where CUI is actually handled. Each card below pairs one gap with the fix that closes it before an assessor arrives.

Access lists keep people who have left

The first assessment objective requires identifying the individuals authorized for physical access, and the second requires limiting access to them. A list that still carries former employees, contractors whose engagements ended, or staff who moved to roles without CUI access fails both in practice. Check the list against HR separation and role-change records, and confirm that each name has a documented business reason. Termination records should show when each physical credential was actually retired.

Shared or unrecorded keys

A key or badge passed between staff cannot show who entered a room, and it undermines the limit on access that 3.10.1 requires. Shared combinations, spare keys in unlocked drawers and badges left at reception are common findings. Inventory every physical key, lock and badge that controls CUI areas, record who holds each one, and confirm that lock combinations change when a holder leaves. Ask the assessor what evidence they expect for the inventory before you build it.

Output devices visible from public corridors

Printers, monitors and consoles that display CUI can expose data even when the room door is locked. The Level 2 assessment guide expects output devices to be placed where they do not expose data, so this is a physical access question as well as a display question. Walk the route a visitor or cleaner would take past each screen and printer during working hours. Move devices, add privacy filters or relocate the output path, then record the change in the scope documentation.

Test rooms and lab spaces left out of scope

Testing environments, equipment rooms and engineering labs often hold systems that process CUI but sit outside the documented boundary. The CMMC assessment guide names offices, testing environments and equipment rooms as covered spaces. Compare the physical access scope against the network diagram and asset inventory, including temporary setups and spare hardware storage. Any room that holds a CUI system, a backup or a reachable network port belongs in the access control design and the access list.

Access list reviews never performed or signed

The access authorization objective is tested through the physical access list, the review of that list and the termination records. A list that was created once and never reviewed shows no evidence of ongoing authorization. Set a documented review cadence for each access list, have the responsible owner sign each review, and keep the signed copies with the change records. Assessors look for final, signed evidence rather than a draft spreadsheet, so store the approved version in the system security documentation.

Undocumented exceptions for vendors and cleaning staff

Cleaning crews, maintenance vendors and building contractors often receive standing access that nobody approved in writing. Such exceptions are rarely on the access list, so the list does not reflect who actually entered. Require a written request for each vendor or cleaning role, state the areas and hours permitted, and set an end date that matches the contract. Compare building management access logs against your own list each quarter so that exceptions do not quietly become permanent.

Questions buyers ask about PE.L2-3.10.1

How much effort does limiting physical access under PE.L2-3.10.1 take?

The effort depends mostly on how many physical spaces hold CUI, systems or equipment, and how many people need access to them. A small office with one controlled room is a different job from a facility with several offices, a testing lab and an equipment room. The work falls into three parts: defining which spaces are in scope, building and documenting an access list of authorized individuals, and putting locks, badges or electronic controls on each space. Ongoing effort comes from reviewing the access list and removing people who leave or change roles. Ask any quote to break effort down by space, by access method and by recurring review.

Can an organization implement PE.L2-3.10.1 without outside help?

Yes, an organization can implement this requirement with its own staff, and many do. The requirement is a 5-point item in the CMMC scoring methodology, so it has to be MET to reach Conditional or Final Level 2 status, but the work itself is mostly about facilities and access records rather than specialized tooling. Internal teams usually need a clear scope, a written list of authorized individuals, and evidence that the list is reviewed. Outside help is most useful when the environment is unusual, such as shared buildings, third-party data centers or specialized test equipment, where the boundary of the physical environment is hard to draw.

How long does the physical access work usually take, and what does it depend on?

No duration is fixed for this requirement, and any timeline should come from a written scope. The main drivers are the number of physical locations, whether locks and badge readers already exist, how far the facility is shared with other tenants or employers, and whether the organization already keeps an access list. Facilities with existing badge systems mostly need configuration and documentation. Facilities that rely on shared keys often need the most time, because keys must be inventoried and access reassigned. Ask a provider to name the spaces in scope and the existing controls before agreeing any date.

What does the requirement need from the internal team?

The internal team must own the decisions that an assessor will test. Someone has to name the individuals authorized for each physical space, approve additions and removals, and keep the list current. Facilities or operations staff usually manage locks, badges and keys, and security or IT staff must confirm that electronic systems and output devices such as printers sit in controlled areas. Leadership needs to accept the access rules in writing. A partner can document the process and prepare the records, but the organization must run the access reviews afterward.

Can a partner sign off on PE.L2-3.10.1 as met?

No. A partner such as DeployOpen can prepare the access controls, documentation and evidence, but only the organization can decide its controls are in place, and only an independent assessor can judge them. For Level 2 certification, the assessment is performed by a C3PAO authorized or accredited by the CMMC Accreditation Body, currently The Cyber AB. For a self-assessment, the organization's affirming official makes the attestation. Ask any provider to state its role in writing so that the assessor's independence is preserved.

How does PE.L2-3.10.1 relate to PE.L1-b.1.viii and NIST SP 800-53 controls PE-2 and PE-6?

PE.L2-3.10.1 is the Level 2 form of the Level 1 requirement PE.L1-b.1.viii, which comes from FAR 52.204-21. A Level 1 assessment checks the same SP 800-171A objectives for 3.10.1, with Federal contract information in place of CUI, so work done for Level 1 carries forward. In NIST SP 800-171 Rev. 2, the basic physical protection requirements map to SP 800-53 Rev. 4 controls PE-2 (Physical Access Authorizations) and PE-6 (Monitoring Physical Access), among others. Those mappings are useful for planning, but organizations should confirm the mapping against the NIST documents and their own assessor's expectations before relying on it.

Can PE.L2-3.10.1 be placed on a POA&M?

No. Because the requirement is worth more than 1 point, the CMMC rule does not allow it on a plan of action and milestones, so it must be fully MET before the organization can reach Conditional or Final Level 2 status. This makes early scoping important. Confirm the physical locations, access lists and lock or badge controls well before any assessment date. Check the current CMMC rule and the Department of War's latest guidance on phase timing, since those timelines have changed recently.

How DeployOpen prepares physical access evidence for assessment

DeployOpen helps organizations prepare the systems, controls and evidence behind PE.L2-3.10.1 Limit physical access, which the organization owns and an independent assessor tests. DeployOpen does not issue assessment results, and it works inside the client's own facilities and infrastructure.

How we scope

We confirm which offices, testing environments, equipment rooms and output devices fall inside the CUI boundary for PE.L2-3.10.1.
We list the access points, badge or lock systems and personnel roles that the written scope will cover.
Engagements are fixed-scope, so scope, deliverables and timelines are agreed in writing before any work starts.

How we build

We help configure badge, electronic lock or key-based access so that only authorized individuals reach protected areas.
We place output devices such as printers where they do not expose CUI to unauthorized visitors or staff.
We test each access control as a working mechanism and record the results so the client can show it operating.

How we hand over

We prepare the authorized personnel access list, authorization records and access list review records the assessor will ask for.
We document the physical access procedures and the evidence each one produces, written for the client's own staff.
We hand over the final documents, configurations and test results, and the client decides what it submits to the assessor.

How we support

Ongoing support, upgrades and periodic re-testing of access controls are available as a retainer after handover.
We can update access lists and records when roles change or staff leave, so evidence stays current between assessments.
Ask us to confirm in writing which parts of the work the retainer covers before you sign a scope.