PE.L2-3.10.4 Physical access logs: evidence and audit

What PE.L2-3.10.4 physical access logs requires and why it cannot wait

PE.L2-3.10.4 is one point, and it can never be left on a POA&M. For a compliance lead, that combination is what makes it dangerous to defer. Most of the physical protection requirements carry more weight or offer more room to plan, but this one must be fully met before a contractor can reach Conditional or Final Level 2 status. Under 32 CFR 170.21, it sits among the six requirements that cannot be carried as open items, so a gap here blocks the whole status rather than shaving a few points off a score.

In plain terms, the requirement asks the organization to keep audit logs of physical access to the places where CUI lives or where systems that process it sit. A physical access log can be a paper sign-in sheet that records who entered, when, and when they left, or it can be the electronic record from a badge reader that identifies the credential and the door. The control ID corresponds to NIST SP 800-171 Rev. 2 requirement 3.10.4, and the assessment objective in NIST SP 800-171A is narrow: the organization must show that audit logs of physical access are maintained. An unexplained entry into a server room, engineering area or document store is exactly the gap that log is meant to close, because it is the only record that lets someone reconstruct who was physically present when a question about data handling or tampering arises.

Readiness usually stalls for one of three reasons. Logs exist for some areas but not others, the sign-in sheets are kept by reception while the server room is unlogged, or badge data is retained for a few days by a building vendor and never reaches the company. Before the assessment, confirm the list of physical areas in scope, the medium used for each, and the retention period the organization has defined, then pull a sample of records and check that they are complete and in final form. A retention period that is written down but not followed is a finding waiting to happen. Ask your facilities provider, building management company or colocation operator now for their log export format and retention settings, since those records often sit outside your control.

Which rooms, systems, logs and teams fall under the physical access log requirement

The physical access log only works if it covers the places where CUI systems actually sit. Each decision below changes who gets logged, which rooms are in scope, and who owns the record, and each must match the system security plan boundary.

Entry points that reach CUI systems

Start by mapping every door, gate and turnstile that leads to a room, rack, cage or closet holding a system that stores, processes or transmits CUI. Include server rooms, network closets, wiring panels, print and scan areas, and shared offices where workstations sit. A log that covers the main lobby but not the server closet will not show who touched the equipment. Confirm each entry point against the floor plan and the system inventory before you write the log procedure.

Employees, visitors and contractors

Decide whether the log records all three populations or only some. Employees are the baseline, but cleaning crews, facilities vendors, auditors and maintenance technicians often reach the same racks. Visitors who sign in on paper and contractors who badge in through a third-party system both need an entry in the record. Write the rule down so that an assessor does not find a population with physical access and no log entry.

Who keeps the log

Facilities, IT, security or a third-party building operator may hold the badge system or sign-in book. Name one owner for the record, and document how the other team gets access to it when an assessor or incident responder asks. If a landlord or building operator controls the badge reader, get written confirmation of what it logs, how long it keeps the data, and how you can export it. Split ownership without a written handoff is a common gap.

Alignment with the SSP boundary

The system security plan defines what is in the assessment boundary, and the access log must cover the same physical scope. If the SSP lists a secure room, the log must include that room. If a system is outside the boundary, its room may fall outside the log, but the SSP must say so. Mismatches between the SSP and the physical scope are easy for an assessor to spot, so review both documents together and record the reasoning for any exclusion.

Badge and sign-in systems in scope

Electronic badge readers, door controllers, visitor management software and paper sign-in sheets each produce a different record. List every system that generates an access event, including any cloud-hosted badge platform, and state which ones are the official record. Assessors check that the records they sample are complete and trace back to the controlled space. Confirm what each system exports and whether timestamps and identities can be pulled without the vendor's help.

Retention period the organization sets

The assessment guidance says logs must be kept for the period the company defines, so the number is a company decision, not a fixed value taken from the standard. Set the period in a written procedure, align it with contract and regulatory obligations, and make sure the badge or paper records are not overwritten sooner. Ask your badge vendor for the default retention and whether the period can be extended without a custom build.

How an assessor tests 3.10.4 against SP 800-171A

This table walks through how an assessor breaks PE.L2-3.10.4 into its one assessment objective, the objects they examine, the test methods they apply, and the evidence they request. Read it as a checklist of what to have ready before an assessment, and note the common findings that cause a requirement to fall short.

Assessment element	What the assessor looks for	Evidence to have ready
Assessment objective	Audit logs of physical access are maintained, as the single objective in NIST SP 800-171A for requirement 3.10.4	A written statement of how physical access is logged for each facility in scope
Log or record objects	Physical access control logs or records covering employees, contractors and visitors who enter areas holding CUI systems	Sign-in sheets, visitor logs or badge reader exports for the assessment period, in final form
Entry and exit point objects	Whether every entry point to a CUI area is covered by the log, including doors without readers and loading or service access	A list of entry and exit points with the logging method used at each one
Access control device objects	Whether badge readers or sign-in processes are configured and working, and whether device records match the log	Reader configuration or device list, and a sample of badge or sign-in records tied to named individuals
Examine method	Review logs for completeness, consistent entries, dates and times, and the retention period the organization has defined	Log files with a retention rule showing how long records are kept and where they are stored
Interview method	The custodian of the logs explains how they are kept, reviewed and archived, and who can change them	Named log custodian, a written procedure and records of who reviewed the logs
Observe method	The assessor watches the sign-in or badge process in use, including what happens when a visitor arrives without an escort	Working sign-in station or reader, with staff able to demonstrate the step-by-step process
Common finding: date gaps	Blank days or missing shifts in the log, which suggest the process was not followed consistently	Continuous logs with a documented reason for any exceptions or outages
Common finding: no retention rule	The organization has logs but has not defined how long to keep them, so the test cannot confirm the requirement	A written retention period, approved by the organization, and proof that records are kept for that period
Common finding: logs do not match badge data	Badge reader records show entries that are not in the sign-in or visitor log, or the reverse	Reconciliation between badge exports and manual logs, with explanations for differences

How to set up physical access logging that passes an assessment

This sequence turns PE.L2-3.10.4 from an idea into a documented, operating log that an assessor can sample, with each step producing a named artifact you can show as final evidence.

Define the covered entry points
Walk every location where CUI-bearing systems, equipment or their operating environments are physically reachable, including server rooms, network closets, office doors used by staff handling CUI, and any shared building entrances those spaces depend on. Record each point in a physical access inventory that names the door or entry, its purpose and the systems it protects. The step is done when the inventory matches the system boundary in your system security plan and a second person has reviewed it for gaps.
Choose a sign-in or badge method
Select how access is recorded at each entry point: a paper sign-in sheet for employees and visitors, or electronic badge readers that write time-stamped entries to a log. The CMMC Assessment Guide for Level 2 accepts either written or electronic records. Record the choice, the people responsible for maintaining it, and where the records are stored. The output is a configured log source, such as a badge system export location or a controlled sign-in binder, with a test entry confirming it captures who entered and when.
Set and document the retention period
Decide how long physical access records are kept. The requirement says to retain them for the period the organization defines, so the period is your decision, but it must be written down and followed. Put the retention period in the physical security procedure, and align it with any contract or records policy that applies to the same facility. The output is an approved procedure that states the period, the storage location, who may read the records and how old records are disposed of.
Configure regular review of the log
Assign an owner to review physical access records on a schedule you define, and check entries against the access list and any visitor escort records. Reviews should flag entries outside authorized hours, unknown names and gaps where a badge or sheet should exist. Record each review with the date, reviewer, scope and any follow-up. The output is a review record template and at least one completed review entry that an assessor can trace back to the log.
Protect the log from unauthorized change
Store paper sheets in a locked location with restricted access, and export electronic badge data to a location where edits are not permitted by the people whose access is being logged. Keep the badge administrator separate from the person who reviews the log where your staffing allows. The output is a documented storage control and an access list for the log itself, so the record remains credible if challenged.
Collect a first sample of records
Pull a sample of entries from each covered entry point for a recent period and confirm that each one shows identity, date, time and the entry point. Include visitor entries and any entries that were later reviewed. Keep the sample, the review record and the procedure together in a single evidence folder. The output is a retained sample that proves the logging operates in practice, not only on paper. Note that the assessment objective for 3.10.4 is that audit logs of physical access are maintained, so the sample should show a working log rather than a planned one.
Confirm assessor expectations before you rely on them
Ask your C3PAO or self-assessment lead which assessment objects they will sample, such as physical access control logs, entry and exit points and access control devices, and how they expect the records to be presented. Confirm the current scoring and assessment path with the Department of War CIO guidance, because the implementation schedule has changed. The output is a short written note from the assessor or your lead recording what evidence will be requested, which you then check against your evidence folder.

Choosing between sign-in sheets and electronic badge readers

The CMMC Assessment Guide for Level 2 accepts either form of physical access record for PE.L2-3.10.4: written sign-in and sign-out records, with employees and visitors signing in and out, or electronic records produced by badge readers. Neither method is required. The assessor's question is whether the organization maintains audit logs of physical access that cover the facilities, equipment and operating environments holding CUI, and whether those logs can be produced in final form when the assessment happens. The choice of method is therefore a design decision the organization owns, and it should be made before the assessment rather than explained afterward.

The two methods differ mainly in completeness, tamper resistance and review effort. A sign-in sheet depends on people remembering to sign, so gaps are common unless a receptionist or escort enforces it, and an entry can be altered or backdated without a trace. A badge reader records every credential swipe with a timestamp and door identifier, so it is more complete for the doors it covers, but it only sees people who use a badge. Tailgating, propped doors and shared credentials go unrecorded. Electronic logs also need someone to pull and review them, and the logs are only as trustworthy as the access to the reader's database. Paper is cheap to start and slow to audit by sampling; electronic logs cost more up front and make reviews faster.

Whichever method is chosen, document it in the system security plan, listing the locations covered, who maintains the records, how entries are reviewed, and the retention period the organization has defined in writing. Ask your assessor, or your C3PAO during preparation, how they expect a retention period to be shown, and confirm with your own counsel or contracting officer whether any contract requires a longer period. If you run badge readers, confirm with your vendor where log data is stored, how long the reader retains it on its own, and whether exports can be time-stamped and protected from edit. An implementation partner can help configure exports and retention, but the organization must own the policy and the records.

Evidence that satisfies the physical access log requirement

An assessor testing PE.L2-3.10.4 looks for a log that exists, is complete, is kept for the period the organization defined, and is reviewed by someone accountable. The cards below cover the artifacts that prove each of those points, and the habits that keep them current between assessments.

Dated physical access log

This is the core artifact: either a sign-in sheet for employees and visitors or an export from electronic badge readers covering entry and exit at the controlled spaces that hold CUI systems. Each entry should carry a name or badge holder, date, time in, time out where applicable, and the area entered. Check that the export covers the full assessment period, not only the most recent week, and that the badge system clock is synchronized so timestamps are reliable.

Written log retention period

The CMMC Assessment Guide says records must be kept for the period the company defines, so the organization must write that period down. Record it in the physical security procedure or the system security plan, and confirm it with your counsel or contracting officer where contract or records rules apply. An assessor will compare the stated period with the logs you actually hold, so an undefined or unstated period leaves the requirement open to interpretation.

Log review procedure and cadence

A procedure names the role that reviews the physical access log, the review frequency, what a reviewer looks for (unknown names, access outside working hours, unescorted visitors, missing exit times), and how exceptions are escalated. The review record itself, such as an initialed log or a ticket showing the review date and findings, is what proves the procedure runs. Keep the procedure and at least one signed review in the evidence set.

Completeness samples

Assessors commonly select sample dates and check that every person who entered a controlled space appears in the log, with signatures or badge events present and exit times recorded where the procedure requires them. Pull samples yourself before the assessment, across several months and across days when visitors or contractors were on site. Gaps found in your own sampling are far easier to fix than gaps an assessor finds.

Retained logs for the defined period

Retention is shown by the logs themselves. Keep the original paper sheets or the badge system export in a controlled location with restricted access, and keep a record of disposal dates for logs that have passed the retention period. Badge platforms often purge events on their own schedule, so confirm the vendor's default and export logs before they age out. An export that proves old records still exist is strong evidence.

Final-form records, not drafts

A requirement is met only when the evidence is in final form. A draft procedure, an unsigned review, or a log template with no entries does not count. Version each controlled document, mark its approval date and approver, and store the approved version separately from working copies. Confirm with your assessor or C3PAO which artifacts they accept before you rely on them, because acceptance details can vary by assessment.

How self-hosted open-source platforms produce audit trails for access events

Application and service audit logs record actions taken inside a system: who signed in, what they changed, and when. They are useful for the wider CMMC audit and accountability family and for showing that a CUI system was monitored. They do not record anything that happens at a door, a turnstile or a server cabinet. Requirement PE.L2-3.10.4 asks for audit logs of physical access, so the assessor will look for records created at the facility level. Platform logs can support a narrative about system access, but they cannot stand in for the physical record.

Logical versus physical events: A login to a file server is a logical access event. A person entering the server room is a physical access event, and only the facility's own records document it.
Retention is set by you: Platform logs are kept only as long as your configuration and storage allow, so the retention period you define must be applied to them too.
Log integrity: Logs stored on the same host they describe are easier to alter. Forward copies to a separate store where administrators cannot edit them.
Clock alignment: Platform timestamps should match the time source used by badge readers or sign-in records so events can be correlated.
Scope statement: Document which platform logs you rely on, so the assessor sees they are supporting evidence and not the physical access log itself.

Confirm with your assessor how they expect platform logs to be presented alongside facility records.

Nextcloud is licensed under AGPL-3.0-only. Its admin_audit app writes additional event information to an audit log file in the data directory by default, or to a different path if you set the logfile_audit key. This gives administrators a record of administrative and file-related actions on the platform. Because the app is a logical access source, it belongs in the evidence set for system access controls, not in the physical access log. Enabling and configuring it is a platform task that your team or an implementation partner can carry out and document.

Enable the app: Confirm that admin_audit is installed and active in your instance before you rely on it.
Log location: Records go to audit.log in the data directory unless logfile_audit points elsewhere. Choose a path that is covered by your backup and access controls.
Separate storage: Ship the file to a protected log store so that users with administrative rights cannot delete their own activity.
Retention handling: Rotate and archive the file according to the period your organization defines, and record where archives are kept.
Verification: Test a known administrative action and confirm it appears with the expected user and timestamp.

Check the current Nextcloud logging documentation for your version before you finalize the configuration.

What meeting 3.10.4 costs in money and effort

This table lists the cost components of keeping physical access logs for PE.L2-3.10.4, who is paid for each, whether it is one-time or recurring, and what drives it up. Read the drivers column to see which choices, such as door count and retention length, move your quote most. No fees or durations are given because no researched figures were supplied, so ask each provider for a written scope.

Cost component	Who is paid or who bears it	One-time or recurring	What drives it
Badge or sign-in system licenses	Software or hardware vendor, or reseller	Often the largest one-time item, with recurring renewals	Number of doors and readers, and whether you choose electronic badges or paper sign-in sheets
Installation and configuration	Integrator or implementation partner, plus your facilities staff	One-time	Number of entry points, wiring at each reader, and integration with existing access control
Staff time to review and retain logs	Your facilities, security or IT staff	Recurring	Visitor volume, number of sites, and how often someone reviews the records
Log storage and retention	Your IT team or hosting provider	Recurring	Retention length the organization defines, and the storage format and backup approach
Evidence upkeep	Your compliance lead, with support from an implementation partner if retained	Recurring	How often logs are sampled for the SSP and how many assessment objects are in scope
External review or readiness check	Independent consultant or assessor, where you choose to buy one	One-time or periodic	Number of sites in scope, the state of existing records, and the level of detail requested
Assessor sampling time	Your staff during the assessment, and the C3PAO or assessor as time is billed	Periodic, at each assessment	Size of the sample they choose, number of sites, and how quickly records can be produced

Who owns the physical access log, who prepares it, and who assesses it

The organization that holds the CUI is accountable for PE.L2-3.10.4. Only the organization can decide which entry points are covered, who is authorized to enter, how long records are kept, and who reviews them. Those decisions are management decisions, and they must be written into the organization's own procedures and System Security Plan. An outside partner can advise on them, but the organization signs off and operates the process every day. The log itself is an organizational record, so it stays under the organization's custody even when a third party helps produce it.

Scope decisions: Name the facilities, server rooms, wiring closets and work areas where CUI-bearing systems sit.
Retention period: Set and document the period the company defines for keeping access records.
Accountability: Assign a named owner who reviews entries and follows up on anomalies.
Custody: Keep the original sign-in sheets or badge-system exports in organization-controlled storage.
Policy alignment: Ensure the logging procedure matches the System Security Plan description of the environment.

Before any engagement, confirm internally who signs the physical security procedure and who answers an assessor's questions about it.

Where physical access logging usually fails an assessment

Physical access logs look simple, which is why they often fail on review. The gaps below share one root cause: the organization has a log but cannot show that it is complete, controlled, retained and actually used. Each card names a failure pattern and the fix an assessor would expect to see.

No written retention period

The assessment guidance expects logs to be kept for a period the company defines, so an undefined period is a gap before anyone looks at a single page. Teams often keep sign-in sheets in a drawer with no rule for how long they stay. Write the retention period into the physical security procedure, state it in the system security plan, and show that old logs are retained or disposed of according to that rule. Ask the assessor what evidence of the period they will accept.

Logs held only by a building vendor

When the landlord or building management company runs the badge system, the organization may not be able to export, review or produce its own access records. An assessor will ask how the company reviews who entered its space and when. Confirm contractually that the organization can obtain copies of its access data on request, and document who holds the records, where they are stored and how they are retrieved. A log the organization cannot reach does not count as the organization's evidence.

Visitors missing from sign-in records

Visitor entries are the most common hole. A receptionist signs in a few guests while contractors, couriers and vendor technicians enter through a side door or follow an employee through a badge reader. The fix is to define which entry points require a visitor record, require the same name, company, time in and time out for every non-badged person, and check that the visitor log matches badge activity for the same period. Illustrative example: a vendor technician badged in at 08:10 but has no visitor entry, and the gap surfaces only during an assessment.

Badge data nobody reviews

Electronic readers generate records, but a log that is written and never read does not show that access is monitored. Assessors look for evidence that someone reviews entries at a stated frequency, investigates unusual times or repeated denials, and records the outcome. Assign a named reviewer, set a review cadence, and keep signed or ticketed review records. Tell the reviewer what counts as an exception, such as access after hours to a room that holds CUI systems.

Drafts presented as final evidence

A log exported last week, a spreadsheet with unsaved edits or a procedure marked draft will not carry a requirement to MET. The assessment method requires evidence in final form, so the team should freeze the log format, version the procedure, and record who approved each document and when. Remove working copies from the evidence folder and keep a dated export from the badge system rather than a hand-edited copy. Confirm with the assessor which format and version they will accept before the assessment.

Log clocks and entries that cannot be trusted

Badge systems and paper logs drift apart when the clock on the reader is wrong, or when staff write times from memory. Time mismatches make reviews of events and incidents unreliable. Check that reader clocks sync to a reference source, note whether paper entries are written at the time of entry, and reconcile both sources on a set schedule. Ask the badge vendor to describe how it handles clock synchronization and whether entries can be edited after the fact.

Physical access log questions buyers ask before hiring help

Can a sign-in sheet satisfy PE.L2-3.10.4 on its own?

Yes, a paper sign-in log can satisfy the requirement when it records who entered the controlled areas, when, and when they left, and the company keeps it. The CMMC Assessment Guide Level 2 accepts written sign-in and sign-out records as well as electronic badge reader logs. The assessor will look for completeness and consistency, so the sheet must cover employees and visitors, be kept in one controlled location, and be easy to pull for review. A sheet that people fill in only when they remember will fail the single assessment objective, which is that audit logs of physical access are maintained. Badge readers reduce manual error and make gaps easier to spot, but they add hardware, configuration and a process for reviewing the data. Confirm the format with your assessor before you commit to one approach.

How long must physical access logs be kept for CMMC?

The requirement does not set a fixed period. Level 2 expects you to retain physical access records for the period your organization defines, and the assessor will test whether that period is written down and followed. Set the retention period in your policy with input from your contracts, legal counsel and the system security plan, then apply it to paper sheets and badge system exports alike. Retention also affects storage cost, because logs kept on a badge server or in a document store need backup, access control and disposal rules of their own. Ask your assessor to confirm how they will test the retention period you choose.

Can PE.L2-3.10.4 be left on a POA&M?

No. PE.L2-3.10.4 is one of the requirements that cannot be placed on a Plan of Action and Milestones under 32 CFR 170.21, so it must be MET before the organization can reach Conditional or Final Level 2 status. The requirement is worth 1 point under the scoring rules in 32 CFR 170.24, which makes the point value small but the status consequence large. A gap here blocks the whole assessment outcome, so treat logging as a go-live item rather than a later improvement. Plan to demonstrate working logs with several months of entries if your existing process is new.

How much does it cost to put physical access logging in place?

No researched figure is available for this work, so treat any number you see from a vendor or consultant as unverified until you have a written scope. Cost depends on what you already have. A facility with a working badge system and a documented sign-in process has a small gap to close. A site that relies on informal records and has no badge hardware may need equipment, installation, integration with identity systems and staff time to run reviews. Ongoing costs include reviewing logs, storing them, and keeping the process current when people, doors or visitor practices change. Ask any provider to split one-time work from recurring work and to state which items your own staff will perform.

What do facilities and IT teams need to provide for this work?

Facilities teams own the physical environment, so they must identify every door, entry point and room that holds systems or equipment that process CUI, confirm who has access, and agree on how sign-in or badge data will be collected. IT teams own any electronic badge integration, log storage, user accounts for the logging tools and backup of the records. Both teams need to agree on who reviews the logs, how often, and where review evidence is kept. Without that agreement the logs exist but no one can show they were maintained as a control. A partner can draft the procedures and configure the technical pieces, but your facilities and IT staff must participate because they hold the building and identity knowledge.

How long does it take to start maintaining physical access logs?

The timeline depends on whether you are starting from a paper process or from a badge system that already exists. A sign-in process can be defined and put into use quickly, but an assessor will expect a record of consistent entries over a period before the control looks mature, so the logs need time to build up. Badge integration takes longer because hardware procurement, installation, testing and staff training have their own lead times. Ask any implementation partner to state the duration in a written scope with the tasks listed, and check whether the schedule assumes your facilities and IT teams are available on the dates given. No researched duration is available here, so confirm timing with the people who will do the work.

Can a partner handle physical access logging by itself?

A partner can design the procedures, prepare the logging configuration, document the evidence and help test that the process works. It cannot own the control, because the organization must run the process, review the logs and keep the records. A partner also cannot issue a finding that the requirement is MET, since only an independent assessor makes that determination for certification, and DeployOpen does not issue assessment reports or certifications. Your own staff must perform the physical access work, and your facility must provide the access points and personnel. Define those split responsibilities in the written scope before work starts so that nothing is assumed.

Can open-source tools produce physical access log evidence?

Open-source software can record events that support physical access evidence, but it does not record door events by itself. Badge readers and access control panels generate the physical events, and their vendor software or an integration layer must export them. Once exported, a self-hosted platform can store records with controlled access and retention rules. For example, Nextcloud's admin_audit app writes additional event information to audit.log in the data directory or to a path set with logfile_audit, which helps with logging of administrative actions on that platform, but it is not a physical access log. Confirm with your assessor which records they will accept and how they will verify that the records are complete and protected.

How DeployOpen works on this

DeployOpen helps organizations prepare the physical access log records that a CMMC assessor will ask to see for PE.L2-3.10.4. We scope the logging method, set up the systems and sign-in processes that produce the records, and hand over documented evidence, while the organization owns its controls and an independent assessor makes the determination.

How we scope

We agree in writing which facilities, server rooms and entry points fall within the logging scope
We confirm whether the organization logs access by paper sign-in sheets, electronic badge readers or both
We document the retention period the organization defines and the owner responsible for each log

How we build

We configure electronic badge reader or sign-in processes so each entry and exit produces a dated, attributable record
We set up the logging and storage of records so they are kept in a controlled location with restricted access
We test that logs capture real entries and exits at the defined entry points before work is accepted

How we hand over

We deliver a written procedure describing how logs are created, reviewed, retained and disposed of
We provide sample log extracts and a mapping of each record to the assessment objective for 3.10.4
We train the staff who maintain the logs and document the handover so the organization can run them independently

How we support

Ongoing support, upgrades and periodic log reviews are available as a retainer after handover
We help the organization prepare for its assessment by checking that records are complete and in final form
The organization decides when to engage an independent assessor, since DeployOpen does not issue assessment results