PE.L2-3.10.2 Monitor facility: requirements and evidence

What PE.L2-3.10.2 monitor facility asks you to watch beyond the server room door

PE.L2-3.10.2 asks an organization to protect and monitor the physical facility where its CUI systems reside, along with the support infrastructure those systems depend on, such as power feeds and network cabling. The risk it addresses is tampering, sabotage or unnoticed intrusion into the places an attacker could reach without ever touching a server: a cable run in a ceiling tray, an unlocked electrical room, or a telecom closet on another floor. It is a 5-point requirement, so if an assessor scores it NOT MET, the organization loses those points and cannot carry the gap on a POA&M. It must be MET outright to reach Conditional or Final Level 2 status. The requirement is harder than it looks because the scope is the whole building's support infrastructure, not just the racks. A locked server room with a badge reader does little if the power distribution panel sits in an unmonitored corridor or the fiber enters through an unsecured utility room. Start by drawing the facility: every room or path that holds a CUI system, its power source, its network entry points and its cable routes. Then decide which of those areas need guards, cameras, door or motion sensors, or alarms, and document why each choice fits the risk. Assessors look for that reasoning as much as the devices themselves. PE.L2-3.10.2 is distinct from its siblings. PE.L2-3.10.1 limits who may enter, PE.L2-3.10.4 keeps the record of who did enter, and PE.L2-3.10.3 covers escorting visitors. PE.L2-3.10.2 is about watching the facility and its infrastructure continuously, including when nobody is authorized to be there. Confirm with your assessor how they expect to test the monitoring mechanisms and the review of their output, since NIST SP 800-171A lists monitoring records and log reviews as possible evidence, and confirm which of your cameras and sensors feed alerts that someone actually reviews.

Which facilities, infrastructure and third parties fall under monitoring

PE.L2-3.10.2 applies to the physical locations and support infrastructure that hold or serve systems within the CUI boundary. The system security plan sets that boundary, so the organization must confirm which facility elements it includes before deciding who monitors what.

On-premises server rooms and closets

Server rooms, wiring closets and any cabinet holding systems that process or store CUI fall inside the requirement. Confirm whether each room is a dedicated space or a shared storage closet, because shared spaces often lack a monitored door, a camera or an alarm contact. Record every such location in the system security plan so the assessor can trace monitoring to a named room.

Office space housing CUI systems

Any office where engineers, administrators or staff use workstations that access CUI is part of the facility. The question is whether the organization can show that people entering and moving through the floor are monitored, through guards, cameras, sensors or alarms, outside business hours as well as during them. Floors shared with tenants or other businesses need a documented decision on which areas the organization controls.

Power distribution and UPS equipment

Power panels, uninterruptible power supplies, generators and their feeds support organizational systems, and the CMMC Assessment Guide expects cables and supporting infrastructure inside a facility to be protected and monitored. Ask whether these units sit in a locked room, whether alarms report on battery faults or unauthorized opening, and whether the building operator or the organization is responsible for each element.

Network cabling and telecom rooms

Patch panels, demarcation points, riser closets and exposed cable runs can be tapped or disrupted without touching a server. Confirm which telecom rooms serve CUI systems, who holds keys or badges to them, and whether sensors or cameras cover them. Cabling that leaves the controlled space or passes through common areas needs an explicit scoping decision and a documented protection method.

Colocation and hosted facilities

When a colocation provider or hosting company houses hardware that stores or processes CUI, the organization must establish what the provider monitors and what it does not. Request the provider's physical security description, the cage or suite arrangement, and any access logs or monitoring reports the organization can review. Contract terms should state who maintains the monitoring records and how the organization receives them for its own assessment evidence.

Cloud providers and inherited physical controls

Cloud providers operate the data center floors, so most physical monitoring for cloud-hosted CUI systems is inherited rather than run directly by the organization. Identify which provider controls the organization relies on, obtain the provider's documentation for them, and record in the system security plan how each inherited control is covered. The organization remains responsible for confirming that the inherited controls exist, apply to its environment and are current.

How an assessor tests PE.L2-3.10.2 and what they ask to see

This table walks through the four SP 800-171A assessment objectives for PE.L2-3.10.2, showing how an assessor tests each area, which evidence they request and where organizations usually fall short. Read each row as a question the assessor will ask, then check whether your records answer it in final form. A requirement is MET only when every applicable objective is satisfied, so a gap in any single row can cost the full 5 points.

Assessment area	How the assessor tests it	Evidence requested	Common findings
Physical access monitoring procedures	Reads the documented procedures and asks staff to explain how facility access is watched during and outside business hours.	Written monitoring procedure, roles, shift coverage plan and the date it was last approved.	Procedure exists but does not match what staff actually do, or it was never approved.
Physical access logs and records	Samples entries and checks that logs capture who entered, when and into which protected area.	Guard logs, badge reader exports or visitor records covering a sampled period.	Logs are incomplete for after-hours entries or drafts are presented instead of final records.
Monitoring records	Checks that cameras, sensors or alarms produced records for the sampled period and that gaps are explained.	Camera retention settings, alarm event history and sensor alert records for the same sample.	Retention is shorter than the period the organization claims, or alarm events were not recorded.
Log and record review	Asks who reviews monitoring records, how often, and how anomalies are escalated and closed.	Signed review records, ticket or case history showing follow-up on flagged events.	Reviews are described verbally but no signed or dated review record exists.
Tests of monitoring mechanisms	Asks to walk the facility, observe guards, cameras, sensors and alarms, and trigger or inspect them while the assessor watches.	Device inventory, placement diagrams, maintenance and test records, and a demonstration that alerts reach a responder.	Cameras cover a corridor but not the room housing network cabling, or alarms are installed but not tested.

How to implement facility monitoring in a sequence that produces evidence

This sequence turns the PE.L2-3.10.2 requirement into a set of documented boundaries, mechanisms, procedures, alert settings, review records and test results that an assessor can examine. Each step ends with a named artifact so you can see what is final before the assessment begins.

Define the facility boundary and support infrastructure
Start by naming the physical locations where CUI systems reside, including server rooms, wiring closets, workstation areas and any data center space you lease. Then list the support infrastructure inside those locations that the requirement covers, such as power distribution, network cabling, patch panels and environmental controls. The facility lead and the system owner should sign off on this list. The output is a scoped facility boundary document that matches the system security plan, and you know it is done when every CUI asset maps to a named location.
Inventory monitoring mechanisms and their coverage
Record every mechanism that watches the boundary: staffed guards, video cameras, door and motion sensors, intrusion alarms and environmental alarms. For each one, note the location it covers, what it detects, who receives its output and where the output is stored. Gaps are most often found in this step, such as a cable run that no camera sees or an alarm that reports only to a mailbox nobody reads. The output is a coverage inventory with a blind-spot list, and it is complete when every boundary location appears against at least one mechanism or a documented compensating control.
Document the monitoring procedure and alert responders
Write the procedure that explains how monitoring is watched, what counts as an event, who responds to each alert type and how responses are recorded. Name the responder roles and their backups, and state what happens outside business hours. Link the procedure to the incident response process so that a suspected physical intrusion can be escalated. The output is an approved monitoring procedure with a responder roster, and it is done when someone outside the security team can follow it without asking questions.
Configure alerting and log retention
Set up alerts for the events defined in the procedure, such as door forced open, camera offline, sensor tamper or power loss to a network closet. If you use open-source tooling, Grafana Alerting can build rules from queries across several data sources and show alerts in one view, and Prometheus can collect metrics from instrumented sensor exporters. Confirm with your platform team that each feed is supported in your environment. Set the retention period for camera footage, badge events and alarm logs according to the period your organization defines. The output is an alert rule set and a retention schedule, and you know it is done when a test event produces a notification to the named responder.
Run and record log reviews on a defined cadence
Assign a reviewer and set a review frequency in the procedure, then review monitoring records, alarm histories and camera availability on that schedule. Each review should note what was checked, any anomalies found, the follow-up taken and the reviewer's name and date. Keep the records in a location with restricted write access so they cannot be altered after the fact. The output is a dated review log that shows the process ran as written, and you know it is done when a sample of entries can be traced back to a specific alert or a clean review result.
Test mechanisms and keep the test records
Test each mechanism on a schedule you define, for example by triggering a door sensor, checking camera feeds at night, or simulating a power alarm. Record the test date, the mechanism tested, the expected result, the actual result and any corrective action. Include a test of the alert path from sensor to responder, since a working sensor with a broken notification route does not monitor anything. Your assessor will look for final test records, so drafts and unsigned notes should be replaced before the review. The output is a test register with completed entries, and it is done when each mechanism in the inventory has at least one recorded test.

Which evidence passes for physical facility monitoring

SP 800-171A names the kinds of evidence an assessor expects for facility monitoring, and each artifact below answers one part of the question: is the facility protected, is it monitored, and is someone reviewing what the monitoring shows. An assessor needs every applicable objective satisfied with evidence in final form, not drafts, so the cards focus on what makes each artifact current and credible.

Documented monitoring procedures

The written procedure states what is monitored (facility, power, network cabling), by which mechanism (guards, cameras, sensors or alarms), who responds, and how alerts are escalated. Assessors test whether the procedure matches what staff actually do on a walkthrough. Check that the document carries an owner, an approval date and a version history, and that it is reviewed on a schedule the organization sets and records.

Facility coverage diagrams

A current floor plan or site diagram should show where cameras, motion sensors, door alarms and guard posts sit, and which power panels, cable runs, and network closets fall inside their coverage. Assessors use it to confirm the infrastructure called out in the CMMC Assessment Guide is actually covered. Update the diagram whenever coverage changes and keep dated revisions so the auditor can see the layout in effect during the assessment period.

Physical access monitoring records

Records of camera footage reviews, badge-reader events, and door or sensor activity show that monitoring happens in practice, not only on paper. Assessors sample dates and check that monitoring covers the areas in the diagram. Decide and document the retention period for these records, configure storage to meet it, and confirm that exported copies are protected like other CUI-adjacent records.

Alarm and alert histories

Alarm histories record intrusion, sensor, power and camera-offline events along with the time, the response, and the closure. Assessors test whether alarms were acted on and whether failures of monitoring equipment were noticed. Keep the history exportable, record each acknowledgment and resolution, and document changes to alarm thresholds or notification recipients as change records.

Guard logs and patrol records

Where guards or staff patrol, signed shift logs and patrol checkpoints show that rounds occurred, what was observed, and what was escalated. Assessors compare these logs with the procedure and with alarm histories to check consistency. Make the log entries contemporaneous, prevent after-the-fact edits, and retain the logs for the period the organization defines.

Signed log review records

A signed review record shows that a named person examined monitoring records on a defined cadence, identified anomalies, and documented follow-up. Assessors use these to test the log review element of SP 800-171A, so a review that never happened or lacks a signature will not satisfy them. Set a review cadence, assign reviewers, keep the signed records in final form, and file a change record whenever the review scope or reviewer changes.

How Prometheus and Grafana can produce monitoring evidence for infrastructure sensors

Prometheus and Grafana can produce useful evidence for the infrastructure side of PE.L2-3.10.2, but only for the sensors you actually connect to them. *Prometheus*, licensed under Apache-2.0, collects metrics from instrumented jobs through a pull model over HTTP and stores them as time series identified by metric name and labels. If your UPS units, power distribution units, rack temperature probes or network switches expose metrics through an exporter, Prometheus can scrape them on a schedule and keep a history you can query with PromQL. That history is the kind of monitoring record an assessor will ask to see: proof that power and network cabling conditions were watched over time, not just at the moment of a review.

*Grafana Alerting*, licensed under AGPL-3.0-only, builds alert rules from queries and expressions across multiple data sources, so a single rule can combine a Prometheus metric with a log stream. Teams can create, manage and act on those alerts from one view, which makes it easier to show who was notified about a power loss or a cabinet temperature excursion and what was done. Confirm the AGPL-3.0-only terms with counsel before you modify Grafana and offer it to others as a network service, because that scenario can trigger source disclosure obligations. Using it internally for your own compliance monitoring is a different position that your counsel should also confirm.

Cameras, badge readers and guard systems usually come from separate products, and Prometheus and Grafana will not see them unless you export their logs or events into a data source. Before you commit to a design, confirm which sensors can feed the platform, which exporters or integrations they need, and whether each one records the access and alarm events you must retain. Then confirm that your alert history and log retention match the retention period your organization has defined for physical monitoring records. The platform only produces evidence for what it receives, so treat the sensor inventory as the first deliverable.

What meeting PE.L2-3.10.2 costs in money and effort

This table breaks the cost of monitoring the facility and its support infrastructure into its components, showing who gets paid, whether each cost is one-time or recurring, and what moves it up or down. Use it to build a written scope before requesting quotes, since no dollar figures or durations are published for this requirement. The main takeaway is that guard staffing and evidence upkeep usually drive the recurring spend, while open-source monitoring software shifts the cost toward engineering time.

Cost component	One-time or recurring	What drives cost up or down and how to keep it down
Monitoring hardware and sensors (cameras, door and cabinet sensors, environmental and power sensors)	One-time purchase, then recurring replacement and refresh	Cost rises with the number of entry points, server rooms, and cable runs to protect. Keep it down by scoping sensors to areas that house CUI systems and support infrastructure, and ask the quote to state replacement cycles and warranty terms.
Camera and alarm systems and their monitoring service	One-time installation, recurring monitoring and storage	Monitoring service fees and video retention drive recurring spend. Keep it down by setting a retention period based on your own log review cadence and confirming whether alarms route to in-house staff or a contracted monitoring center.
Guard staffing, if used	Recurring, usually the largest line item	Hours of coverage, shift count, and whether guards are contracted or employed drive cost. Keep it down by matching coverage to actual risk and combining guard rounds with camera and sensor alerts. Ask for hourly rates, minimum billing, and overtime terms in writing.
Open-source monitoring software (Grafana Alerting, Prometheus)	No license spend for these tools, but one-time integration and recurring maintenance	Cost comes from engineering time to connect sensor and alarm feeds as data sources, write alert rules, and keep them patched. Keep it down by reusing existing monitoring infrastructure and documenting alert rules as configuration. Confirm the sensor and camera vendors support the integration you need.
Evidence upkeep (alert reviews, monitoring records, log reviews)	Recurring staff time	Frequency of reviews and the number of locations drive effort. SP 800-171A expects records of monitoring and log review, so budget for a named owner and a fixed review cadence. Keep it down by automating alert records and retaining reviews in a single system of record.
External testing or review of physical controls	Recurring or per engagement	Scope of the site walk, number of facilities, and whether testers attempt physical access drive cost. Ask for a written scope listing locations, test methods, and deliverables before agreeing to a fixed price.
Assessor time	Per assessment	Assessor effort depends on how well evidence is organized and whether it is in final form. Only an independent C3PAO or other authorized assessor can perform the assessment. Ask your assessor for its fee structure and the evidence list before scheduling, and prepare records so the test of monitoring mechanisms can be completed in one visit.

Who owns facility monitoring, what partners can prepare, and what the auditor decides

The organization owns the facility, the monitoring decisions and the compliance position for PE.L2-3.10.2. Its security and facilities staff decide which areas, power and network infrastructure need protection, whether guards, cameras, sensors or alarms are the right mechanism, and what happens when an alarm fires. Those people also own the day-to-day work that produces evidence: reviewing monitoring records, responding to alerts and keeping the records in final form.

Monitoring decisions: Define which spaces, cable runs, power distribution points and network closets are in the protected boundary, and which mechanism covers each.
Alert response: Staff who receive camera, sensor or alarm events must act on them and record what they did.
Log and record reviews: Someone accountable must review monitoring records on a defined schedule and sign off on exceptions.
Outsourced guard services: A contracted guard firm may patrol or staff the site, but the organization still sets the post orders and reviews the reports.
Retained evidence: Keep the final versions of procedures, camera coverage maps and review records, since draft material does not count toward a MET finding.

Confirm internally which person signs off on the monitoring procedure and who answers when a sensor fails at night, because assessors ask both questions.

Where facility monitoring usually fails an assessment and how to close each gap

Facility monitoring rarely fails because the organization has no cameras or guards. It fails because the boundary, the alerts, the records and the evidence do not line up. The cards below cover the gaps assessors most often find under PE.L2-3.10.2 and the fix for each.

Cabling and power rooms outside the boundary

Telecom closets, power distribution rooms and cable runs are often treated as building infrastructure rather than part of the environment where CUI systems reside. The assessor will check whether the support infrastructure that serves organizational systems is protected and monitored. Define the boundary in the system security plan to include these rooms, then confirm that each one has a lock, a documented access list and camera or sensor coverage on its entrance.

Cameras with no documented review

Video recording exists, but nobody can show who reviews it, how often, or what they look for. Assessors test the mechanisms that monitor physical access and look for records of review. Write a short procedure that names the reviewer, the cadence and the event types to flag, then keep a signed or ticketed log of each review so that the footage is tied to an accountable person.

Alarms that alert no one

Door-forced and motion alarms are wired to a panel or a mailbox that nobody watches, or they go to a personal phone of someone who has left the organization. The assessor will ask who receives an alarm, how quickly it is acknowledged and what happened after the last one. Route alerts to a monitored queue with named responders, test the path with a scheduled trigger, and record each test and response.

Monitoring records that are drafts or missing

Review logs are kept in a spreadsheet that was started for the assessment, or entries for past months were filled in later. Under the CMMC scoring rules, evidence must be in final form, and a gap in the monitoring history leaves the requirement unmet. Store review records in a controlled system with timestamps, keep them in final form as each review happens, and do not backfill periods that were not reviewed.

Sensors not integrated into any log

Environmental sensors, badge readers and camera analytics produce data, but the data stays on the vendor device and never reaches a central record. Assessors look for evidence that monitoring produces records they can sample. Forward sensor and access events to a central time-series or log store, set alert thresholds for power, temperature and door state, and keep dashboards and alert history for the retention period the organization defines.

Relying on provider physical controls without evidence

A colocation facility or cloud provider runs the data hall, and the organization assumes that covers its requirement. The assessor will still expect the organization to show how it satisfies the requirement, which usually means collecting the provider's physical security evidence and reviewing it. Request the provider's current audit reports and facility access procedures, map them to the CUI systems hosted there, and record that review in the system security plan.

Questions buyers ask about PE.L2-3.10.2 cost, effort and outside help

Can we implement PE.L2-3.10.2 in-house without an outside partner?

Yes, in most organizations the facility monitoring work can be run by your own facilities, security and IT staff, because the requirement is about your building and its support infrastructure, not about a specialist product. Your team owns the decisions: which areas hold systems that process CUI, how power and network cabling are protected, which guards, cameras, sensors or alarms cover them, and who reviews the alerts. An outside partner is optional. Where internal staff lack time or experience with assessment evidence, a partner can help prepare the monitoring records and the documentation an assessor will ask for. Confirm the ownership split with your assessor before you start.

How much effort does monitoring the facility take, and what drives it?

Effort depends mainly on the size and layout of the facility, how many areas hold CUI systems, and whether monitoring already exists for other purposes. Costs are usually split between one-time work (mapping the facility, selecting and installing guards, cameras, sensors or alarms, and writing procedures) and recurring work (guard staffing, camera maintenance, alarm monitoring contracts, and periodic log and alert review). Shared spaces, cable runs that cross tenant areas, and remote or unmanned sites all raise effort. Ask any vendor or integrator for a written quote that lists each component, who installs it, and what maintenance is included.

Do we have to install guards or cameras to meet 3.10.2?

No. The requirement asks you to protect and monitor the physical facility and its support infrastructure, and the CMMC Assessment Guide lists security guards, video cameras, sensors or alarms as examples of how that monitoring can be done. An assessor will look for a mechanism that fits your environment and for evidence that it works, such as recorded monitoring, alarm records or guard logs. A small office with a locked room and an alarm tied to a monitored service may satisfy the objective, while a larger facility may need several layers. Document your choice and the reasoning behind it so the assessor can test it.

How long does preparing for 3.10.2 usually take?

Preparation time depends on how much monitoring you already have, how complex the facility is, and how quickly procurement and installation can happen. Timelines typically stretch when physical changes need building work, when cable routes must be surveyed, or when alarm monitoring contracts take time to sign. Evidence collection also takes time, because the assessor expects records that show monitoring operating over a period, not a single snapshot. Ask your assessor and any partner for a written schedule tied to the specific scope, and confirm what the current CMMC timeline requires for your contracts, since implementation phases have been changing.

What does the day-to-day work look like after the monitoring is installed?

Once monitoring is in place, the ongoing work is operational rather than project-based. Someone must review camera footage or alarm events, respond to alerts, check that sensors and cameras still function, and keep records of those reviews. Access logs and monitoring records should be retained and reviewed on a schedule you define in your procedures. Staff also need to know what to do when an alarm trips or a guard reports a problem, and those actions should be recorded. Build these tasks into an existing security or facilities calendar so they do not depend on one person.

Can an outside partner take over facility monitoring for us?

A partner can take on defined parts of the work, such as designing the monitoring approach, configuring alerting, preparing procedures and assembling evidence packages, under a written scope. DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure, so any monitoring dashboards or alerting it builds stay in your environment. It does not issue assessment reports or certifications, and it does not replace your organization's responsibility for the controls. Physical guarding and building monitoring services are normally contracted from specialist providers. Agree in writing who owns each deliverable and who signs off on the evidence.

Can PE.L2-3.10.2 go on a POA&M if we are not ready?

No. Under the CMMC Scoring Methodology, PE.L2-3.10.2 is a 5-point requirement, and the rules in 32 CFR 170.21 do not allow a requirement worth more than 1 point to sit on a plan of action and milestones. It must be MET to reach Conditional or Final Level 2 status. Because the CMMC phasing has changed recently, confirm your current status and what your contracts require with your assessor and the contracting officer, and check the official CMMC pages for the latest guidance before you plan your schedule.

How do we confirm the specifics of our monitoring requirements?

Start by asking your assessor which objectives they will test and what evidence they expect, since the assessment objectives in NIST SP 800-171A describe procedures, mechanism tests and log reviews. Then ask your contracting officer or program office which CMMC level and status apply to your contracts. Read the current CMMC rule and the DoW CIO pages to confirm the latest status. Finally, request written quotes from integrators or partners that itemize installation, maintenance and monitoring services, so you can compare the recurring costs against your own budget.

How DeployOpen scopes, implements and prepares facility monitoring evidence

DeployOpen plans, implements and documents the technical side of facility monitoring for PE.L2-3.10.2 inside your own infrastructure, so the systems that record monitoring activity are configured, tested and ready for review. Your organization owns the physical protection controls, and an independent assessor decides whether the requirement is met.

How we scope

Agree in writing which facilities, server rooms, network closets and support infrastructure fall inside the monitoring boundary.
Record which guards, cameras, sensors and alarms already exist, and which monitoring gaps the written scope will address.
Confirm with your team who owns each monitoring source, who reviews alerts and how long monitoring records are retained.

How we build

Deploy or integrate open-source monitoring, such as Prometheus for metrics and Grafana Alerting for alert rules, with sources from your sensors and alarm systems.
Configure alert rules for facility events such as power loss, environmental thresholds and unexpected network equipment changes, then test each rule end to end.
Document the configuration, data flows and access controls so an assessor can test the monitoring mechanisms directly.

How we hand over

Deliver a written record of the monitoring design, alert logic, test results and the review procedure your staff will follow.
Provide sample monitoring records and review logs that show the mechanisms operating over time, in final form rather than drafts.
Walk your operations and security staff through the dashboards, alert handling and evidence collection before the engagement closes.

How we support

Ongoing support, upgrades and monitoring tests are available as a retainer, once the initial written scope is complete.
Any changes to facility layout, sensors or monitoring tools can be reflected in updated configuration and documentation under the agreed scope.
Confirm with your assessor and your C3PAO or DCMA DIBCAC contact which evidence formats they accept before the assessment date.