What PE.L2-3.10.5 requires and why it can never be deferred
PE.L2-3.10.5 is the physical access requirement you cannot put on a plan of action and milestones. If a Level 2 assessment is coming, every access badge, key and lock that still opens a door your CUI depends on has to be accounted for before the assessor arrives. The requirement asks for three things: identifying the physical access devices in your facility, controlling who holds them and what they open, and managing them through their life, including reissue, change and retrieval. Under 32 CFR 170.21, this requirement is one of the six that must be MET to reach Conditional or Final Level 2 status, and under 32 CFR 170.24 it carries 1 point. The low point value does not lower the bar. A single unmet objective blocks the status you need to win work. The risk is simple to describe and easy to underestimate. A key cut for a former contractor, a badge that still works after a reassignment, or a lock whose combination was shared and never changed gives someone a route into the room where CUI sits, and nobody notices because no record says the device exists. The Level 1 counterpart, PE.L1-b.1.ix, draws on the same underlying idea for Federal contract information, so a company that already handles FCI should have the basic inventory started. Level 2 raises the stakes by requiring that the organization can show the inventory, the storage of spare devices and the change history as evidence.
The hard part is usually not the policy. It is the inventory. Facilities accumulate keys in drawers, badges issued through several systems, and doors whose locks were installed by a landlord or a previous tenant. Many organizations cannot say, without digging, which devices exist, who holds them and whether a given lock was re-keyed after the last departure. Ask your facilities team and your HR offboarding owner to walk the process together, and confirm that a departing employee's badge and keys are tied to a documented step, not to memory. Confirm also whether your badge system is the record or a separate spreadsheet, because the assessor will test whichever one you name as the source of truth. The assessment guidance expects either a manual key assignment list or a badge access system that is updated when roles change. Whichever you choose, the records must match the physical devices and be current when the assessor tests them. Draft logs and a list that was built the week before the visit do not satisfy the objectives. Treat this requirement as a recurring operational control with an owner, a review cadence and dated evidence, and decide now who is accountable for reconciling devices against the roster each time someone joins, moves or leaves.
Which physical access devices and locations are in scope for managing physical access
Scoping PE.L2-3.10.5 starts with an inventory of every device that opens a door to a CUI area, every room that holds CUI systems, and every person or third party who holds a device. The cards below cover each of those, plus the scoping decisions that change how much work the requirement takes.
Mechanical keys and cabinet keys
Mechanical keys open office doors, server rack cabinets, equipment closets and file cabinets that hold CUI media or paper records. Each key type, including master and sub-master keys, belongs in the inventory with the name of the person or role holding it. Check whether any key can open a CUI room without being recorded, and whether spare or cut keys are kept in a controlled location. Keys that are not on a list are the usual gap an assessor finds first.
Combination locks and codes
Keypad and combination locks control access without a physical credential, so the question is who knows the code and when it last changed. The SP 800-171A objectives for 3.10.5 expect records of key and lock combination changes. Confirm that codes change when a person with knowledge leaves, and that the change is written down with a date and the person who made it.
Badges and key cards
Electronic badges and key cards are the devices most likely to live in a central system rather than a paper list. Each badge needs an owner, an access profile and a status, and inactive badges must be disabled or collected. Confirm whether badges for contractors and visitors expire automatically, since a badge that still works after a contract ends is a finding that assessors test directly.
Rooms and facilities holding CUI systems
Start from where CUI is processed, stored or transmitted, then include the rooms that hold the network closets, server racks, printers, backup media and the workstations of cleared or CUI-authorized staff. Shared spaces such as storage rooms or meeting rooms that connect to these areas also fall within scope if they provide a path to equipment. Document each room on a floor plan so the physical access list has a clear boundary.
Third parties who hold devices
Janitorial staff, building management, landlords, security guards, IT vendors and maintenance contractors often hold keys or badges to CUI areas. Build a register of each third party, the devices they hold, and the contract or sign-off that authorized them. Confirm how devices return when a vendor finishes work, and who is responsible for recovering them when a contract ends early.
Scoping decisions that change the work
Two decisions shape the effort most. In a shared multi-tenant building, the landlord or building operator may control master keys or the badge system, which changes what the organization can prove on its own. Whether the badge system is centrally administered, with one console and audit trail, or managed separately per floor or site, determines how quickly a departing person's access can be removed and how the list can be produced for an assessor. Ask the building operator in writing which devices they control.
How an assessor tests managing physical access devices
The first objective asks whether the organization knows which physical access devices exist. An assessor starts with the inventory: keys, lock cylinders, master keys, badge credentials, key cards and combination locks. They compare that inventory against the physical environment and against the access control records. A device that appears in no record is treated as an unmanaged risk, even if nobody has misused it.
- Device inventory: Assessors ask for a current list of keys, badges and locks, with the holder or location of each item and the areas it opens.
- Badge system export: For electronic credentials, they request the badge management export and check that active credentials map to current employees and contractors.
- Sampling: They pick several doors or cabinets and trace the physical device back to a record.
- Ownership fields: Each entry should name an accountable owner, so the assessor can see who answers for it.
- Retired devices: Lost, destroyed or replaced items should appear with a disposition, not disappear from the list.
Confirm that your inventory can be exported in a form an assessor can sample directly, and that someone can explain how every entry was created.
The second objective asks whether access to the devices is controlled. Assessors look for the rules that decide who receives a key or badge, who approves that issue, and where the devices are stored when not in use. They also test whether those rules are followed in practice. Controls that exist only on paper rarely pass a test, so assessors often ask staff to walk through a real issuance from start to finish.
- Issuance approval: Assessors request signed or system-recorded approvals for recent key and badge issues.
- Storage locations: They inspect where spare keys, master keys and unassigned badges are kept, and who can open that storage.
- Combination changes: They ask for records of key and lock combination changes and check that changes followed staff departures or lost items.
- Physical test: The assessor may ask a staff member to open a key cabinet, then compares what was opened against the log.
- Access scope: Approved access should match the role, not a general set of doors.
Ask the team to show one real issuance, one storage location and one combination change record before the assessment begins.
The third objective asks whether devices are kept accurate over time. Assessors test the lifecycle: role changes, transfers, terminations, lost items and contractor offboarding. Many findings come from this objective because the inventory is correct on the day it is created and drifts afterward. The assessor usually picks recent leavers or movers and traces whether their physical access was recovered or changed.
- Termination records: They compare HR separation lists against key returns and badge deactivations.
- Role changes: They check whether access was reduced when an employee moved to a different area.
- Lost device handling: They request reports of lost keys or cards and the actions taken, such as rekeying or deactivation.
- Interviews: Facilities and security staff are asked to explain the offboarding steps in their own words.
- Common finding: A key assignment list that does not match the keys actually held, or a badge still active for a former contractor, is a typical gap that can prevent the requirement from being MET.
Before the assessment, reconcile the key assignment list or badge export against the physical keys held and the current HR roster.
How to implement physical access device management step by step
This sequence turns keys, locks, badges and key cards from an informal collection into a tracked inventory with named owners, approval rules and recovery steps, producing the records an assessor needs to test PE.L2-3.10.5.
Build the inventory of devices and holders
List every physical access device in scope: keys, key cards, badges, combination locks, electronic lock controllers and the doors or cabinets they open. For each device, record a unique identifier, the door or area it controls, and the current holder. Include contractors and shared devices. Done means the inventory can be matched against the list of people who hold access, with no device left unassigned or unexplained. Assessors look for an inventory record of physical access control devices, which is the first kind of evidence named for this requirement in NIST SP 800-171A.
Define approval and revocation authority
Name the role that approves each issue of a device, the role that approves revocation, and the role that may change a lock or combination. Write these rules down and tie them to the system security plan so the owner of each decision is clear. Done means every device category has an approver, and the approver is not the same person who holds the device. Keep the approval record for each issue so it can be produced during an assessment.
Set storage and custody rules
Define where unissued and spare devices are stored, who can access that storage, and how a device moves from storage to a holder and back. A locked cabinet with a logged checkout is a common pattern, but the rule must match your facility. Create a signed custody record for each issued device, showing the holder, issue date and return terms. Done means no spare device sits in an unmonitored location, and every issued device has a signed record that names a person.
Document key and combination change triggers
Write the events that require a lock change or combination change, such as a lost key, a departed holder who had a key that was not returned, a compromised combination or a change to the area's risk. Assign the owner of each trigger and the method for recording the change. NIST SP 800-171A lists records of key and lock combination changes as evidence, so each change should leave a dated entry naming the trigger and the approver. Done means a written trigger list exists and the change log has been tested against it.
Connect role changes and departures to device recovery
Add device recovery to your joiner, mover and leaver procedures. When someone changes role or leaves, the holder's devices must be returned, reassigned or reprogrammed before the change takes effect. For electronic badges, update the access system so the old permissions stop working. Where identity lifecycle tooling is used, the trigger can start from the directory account change. Done means every role change or departure produces a recovery ticket with a closing date and a signed return or access removal record.
Run a reconciliation test
Compare the inventory against the records of actual holders and the badge system's active credentials. Record any device that is missing, unassigned, assigned to someone who no longer needs it, or still active in the access system after its holder left. Resolve each exception, then record the result with the date, the person who performed the check and the findings. Done means a dated reconciliation report exists with every exception closed or documented, and the process has been run as an ordinary business task, not only before an assessment.
Prepare the evidence package for assessment
Gather the final versions of the inventory, approval rules, custody records, change logs, leaver records and the most recent reconciliation report. Confirm that each document is complete and signed, since drafts do not count toward a MET result under the assessment rules. Confirm with your assessor which formats they accept. Done means the package can be walked through from a single device to its approval, custody record and current status, without gaps.
Evidence that passes an assessment for PE.L2-3.10.5
An assessor testing PE.L2-3.10.5 looks for records that show which physical access devices exist, who holds them, and what happens when that changes. The cards below cover the artifacts that usually satisfy the three assessment objectives in NIST SP 800-171A, and the upkeep each one needs between assessments. Every artifact must be in final form when it is reviewed, not a draft.
Physical access device inventory
This is the master list of every key, lock, badge reader, key card and combination lock that controls entry to CUI spaces, server rooms and equipment cabinets. Each record should carry a unique identifier, device type, location, and the date it was issued or installed. Assessors use it to confirm the organization knows what devices exist before they test anything else. Check that doors found on the floor plan all appear in the inventory, and that retired devices are marked as removed rather than deleted. For tracking hardware and racks, GLPI's Assets module can hold these records, though you should confirm whether it fits your access device types.
Key assignment list
For manually managed keys, this list shows which person holds which key, when it was issued, and the signed acknowledgment of receipt. The CMMC Assessment Guide notes that physical access devices protect only when the organization knows who has them and what access they allow, and a key assignment list is the usual way to show that. Review it at least when staff change roles, and reconcile it against the physical inventory. Missing signatures or assignments to people no longer employed are common findings.
Badge system export of active holders
For electronic access, export the badge management system's list of active credentials with holder name, access zones, and status. The export should match the HR roster for current employees and contractors, and show no active badges for anyone who has left. Assessors often ask for the export on the day of the assessment, so schedule a routine export and keep dated copies. Confirm that the export reflects zone permissions, not only card numbers, because a badge that opens the server room is a different risk from one that opens the lobby.
Records of key and lock combination changes
SP 800-171A lists records of key and lock combination changes as potential evidence for 3.10.5. These records show when a lock was rekeyed, when a combination was reset, and why, such as after a lost key or an employee departure. Each entry should name the person who authorized the change and the person who performed it. Without these records, an assessor cannot tell whether a lock that opens for a former employee was ever changed. Keep the change log with the physical inventory so the two can be compared during testing.
Storage location documentation
Spare keys, unassigned badges and combination cards need a documented, controlled storage location. Record where each storage point is, who can open it, and how access to it is logged. SP 800-171A names the storage locations of physical access devices as evidence in its own right, so an unlabeled key cabinet in an open office will draw questions. Include a photo or floor plan reference, and confirm that the storage container itself is covered by the same access controls it protects.
Records of recovery at departure
When someone leaves or changes roles, the record should show each key, badge and combination returned, the date, and the person who verified the return. This card connects the other artifacts, because a departure that is not recorded leaves the inventory and badge export wrong. Tie this record to the offboarding checklist used by HR and the personnel security process, and reconcile it within the same business day when possible. Ask your assessor early which departure form they expect, since the format is not fixed by the standard.
What meeting PE.L2-3.10.5 costs in money and effort
This table lists each cost component of managing physical access devices, who is paid for it, whether it is one-time or recurring, and what drives it up or down. Use it to structure a quote request, since no price figures are supplied for this requirement and each line depends on the facility and its badge and key systems.
| Cost component | Who is paid or who spends time | One-time or recurring | What drives it and what to ask for |
|---|---|---|---|
| Locks, keys and rekeying | Locksmith or facilities contractor, plus internal facilities staff | One-time for the initial rekey or replacement, recurring when people leave or roles change | Number of doors and locks in scope and whether keyed or combination locks are used. Ask for a line-item quote per door and a rekey policy price. |
| Badge system licenses or a self-hosted alternative | Badge vendor or software licensor, or an implementation partner for a self-hosted setup | Recurring for licenses and support, one-time for installation and integration | Badge system maturity, number of readers and cardholders, and whether it integrates with identity sources. Ask whether licenses are per reader, per cardholder or per site, and what support tier is included. |
| Inventory build and reconciliation | Internal staff, with optional help from an implementation partner | One-time to build the inventory of devices, then recurring to reconcile it | Number of physical access devices and the number of locations. Ask the partner to confirm which records and storage locations the inventory will cover. |
| Recurring reviews after role changes and departures | Internal HR, facilities and IT staff | Recurring, tied to joiner, mover and leaver events | Staff turnover and how quickly HR notifies facilities. Ask how the process links HR events to key and badge changes so the review is not manual each time. |
| Identity automation and deprovisioning | Internal engineering or an implementation partner for configuration | One-time for setup, recurring for maintenance and upgrades | Number of connected applications and the identity platform in use. Ask which account removals can be automated and which still require a physical step. |
| Assessor time | Independent assessor or certification body, not the implementation partner | Recurring at each assessment cycle | Scope and number of sites reviewed. Ask the assessor for its own fee basis and what evidence it will sample, since assessors issue reports and partners do not. |
Who owns, implements and audits this requirement
Your organization owns the requirement. Physical access devices such as keys, locks, badges and key cards belong to your facilities and security functions, and the decisions to issue, change or revoke them must be yours and documented as yours. An assessor will ask who approves each issuance, who holds custody of the devices and who verifies that a departing person's access was removed. None of those answers can come from an outside party.
- Ownership and approval: Name an accountable owner for the physical access device inventory and a named approver for every issuance and revocation.
- Physical custody: Staff inside your organization keep the keys, badges and combination records, store spares securely and record who holds each device.
- Role-change and separation processes: HR, facilities and the security owner agree on when access is adjusted for transfers and exits, and who confirms it was done.
- Periodic reconciliation: Your team compares the physical inventory against the records and resolves gaps, such as lost badges or unreturned keys.
- Operating records: Key and lock combination change records and storage locations are kept current by your staff, not by a consultant.
Check that each of these duties has a named person and that the people doing them can show the records without help.
An implementation partner helps you build the structure that makes the requirement provable. DeployOpen prepares systems, controls and evidence for compliance assessments, and it does not issue assessment results or certifications. For this requirement, the partner's work is typically the inventory design, the reconciliation procedure, the configuration of supporting tools and the evidence templates your staff will use.
- Inventory structure: Define the fields for each device, such as device type, location, holder, access granted and status, so the record shows who has what and what it allows.
- Reconciliation procedure: Write the step-by-step check of the inventory against physical devices and badge system records, with exceptions routed to the owner.
- Tool configuration: Set up inventory and identity tools so that asset records and user lifecycle changes can be reviewed, for example through GLPI for asset records or authentik for account deprovisioning in connected applications.
- Evidence templates: Provide forms for approvals, revocations, combination changes and reconciliation sign-offs that your staff complete as work happens.
- Training and handover: Walk your staff through operating the procedure so it continues after the engagement ends.
Confirm in the written scope which of these deliverables are included, and who maintains the records after handover.
Assessment is performed by an independent party. For Level 2 certification assessments, that is a C3PAO authorized or accredited by the CMMC Accreditation Body, currently The Cyber AB. Self-assessments are performed by the organization itself against the NIST SP 800-171A assessment objectives. Only an independent auditor, assessor or certification body issues reports or certificates, so the assessor is the only party whose conclusion counts for the requirement.
- Independent testing: The assessor examines the inventory, interviews custody holders and samples devices and records against the three objectives for identifying, controlling and managing physical access devices.
- Evidence in final form: The assessor expects finished records, not drafts. A requirement is MET only when all applicable objectives are satisfied with evidence in final form.
- Findings: Results, including any finding that the requirement is not met, come from the assessor. This requirement cannot be placed on a POA&M, so a gap must be closed before the assessment.
- Independence limits: The assessor cannot design the controls it then tests, and it cannot prepare the evidence it judges.
- Scope and dates: Confirm current assessment phase requirements with the Department of War or your contracting officer, because the schedule has changed.
Confirm who the assessor is, what it will sample, and how it will treat evidence prepared with outside help.
Organizations commonly outsource the parts that take specialist time, while keeping the decisions and custody in-house. Outsourcing preparation is allowed. Outsourcing the requirement itself, or the assessment conclusion, is not. The line is drawn at ownership: a partner can build the process and evidence, but your team must run it, and the assessor must test it independently.
- Usually outsourced: Inventory design, reconciliation procedure drafting, tool setup, evidence template design and readiness review before an assessment.
- Usually kept in-house: Approval of issuance and revocation, physical custody of keys and badges, combination changes and day-to-day reconciliation.
- Shared work: Testing your own readiness, sometimes with a partner, to find gaps before the assessor arrives.
- Never outsourced: The assessor's judgment and any report or certificate.
- Independence check: If the same firm designs your controls and also performs the assessment, the assessment is not independent.
Before signing, confirm in writing that your staff will operate the process and that no partner will attend as your assessor.
Common gaps that cause findings on physical access devices
Most PE.L2-3.10.5 findings do not come from missing locks or badge readers. They come from records that do not match the physical devices or from departures that never reached the device register. The cards below cover the gaps assessors most often find, with a closing action for each.
No complete key and combination inventory
An assessor will ask who holds each key, which doors each key opens and where every spare is kept. If the answer depends on memory or a partial spreadsheet, the inventory of physical access devices is incomplete, and the first objective for 3.10.5 is not met. Walk the facility against the register, door by door, and record each lock, cabinet and server rack that uses a key or combination. Close the gap by assigning an owner to the register and reconciling it on a fixed schedule.
Departures not linked to device recovery
Keys and badges often leave the organization with the person who held them, because the offboarding checklist covers accounts and laptops but not physical devices. Assessors look for evidence that a departing employee's badge was deactivated and keys were returned or reassigned, with dates that match the separation. Add a physical device step to the HR exit process, and require the register owner to sign off before the offboarding ticket closes.
Undocumented combination changes
Changing a lock combination or re-keying a door after a loss is a security action, but many teams make the change without a written record. SP 800-171A names records of key and lock combination changes as potential evidence for 3.10.5, so an assessor will ask for them. Log each change with the date, the reason, the person who authorized it and the doors affected. Set a rule that no combination changes without a ticket.
Badge holders who no longer work there
A badge system that still lists former staff, contractors or temporary workers gives those people access that the organization no longer intends. Assessors compare the badge holder list against the current personnel roster and look for active cards that belong to people who have left or changed roles. Pull the badge system user list, match it to HR records, and deactivate any card without a current owner. Repeat the comparison on a schedule rather than once before the assessment.
Spare keys stored without custody records
Spare keys kept in a drawer, lockbox or safe are physical access devices like any other, and they need a custody record showing where they are stored and who may take them out. Assessors check that the storage location is documented and that the devices in it match the register. Record each spare with its storage location, a named custodian and a sign-out log, and check the cabinet against that list at least once a quarter.
Evidence created after assessment began
Assessors test the process as it runs, and records created to fill a gap after the assessment starts will not show a working control over time. The assessment objectives expect evidence in final form, and a register rebuilt the week before the assessment will invite questions about the months before it. Start the device register and custody logs now, keep their history intact, and let each entry show the date it was made. Confirm with your assessor how far back the records must go.
Questions buyers ask about managing physical access for CMMC
Can we manage physical access for CMMC in-house?
Yes. The organization owns its physical access controls, and nothing in the requirement obliges you to hire outside help. The work is mostly administrative: knowing which keys, locks, badges and key cards exist, who holds them, what each one opens, and how changes are recorded. Small teams often handle this with a key assignment list and a badge administrator. Outside help is usually worth considering for the initial inventory and reconciliation, when the record set is large or spread across several sites, or when the assessor's expectations need translating into a working procedure. An implementation partner can prepare records and evidence, but the organization and an independent assessor make the determinations.
How much effort does the initial physical access inventory take?
Effort scales with the number of physical access devices, the number of locations and how many systems already hold records. The inventory has to cover keys, locks, badges, key cards and the access rules attached to each. Start with the spaces that house CUI systems, equipment and their operating environments, then work outward. Cost drivers include the number of doors and rooms in scope, whether records are kept on paper or in a badge system, how many people hold physical access devices, and whether the badge system must be reconciled against a separate key list. Ask any partner for a written scope that names the locations and record sets it will cover before work begins.
How long does reconciliation take between the access list and actual devices?
The duration depends on how far the records have drifted from reality, which you usually cannot know until the first reconciliation. Reconciliation compares the inventory against the physical devices and the badge system, then resolves every mismatch: a key that no one can account for, a badge still active for a former employee, or a lock whose combination was never recorded as changed. The effort is driven by the number of mismatches, not the size of the list alone. Plan for at least one full reconciliation before an assessment and a repeatable cadence afterward. Confirm the expected duration with any vendor or partner against your own record count rather than relying on a generic estimate.
Do we need a badge access system to meet PE.L2-3.10.5?
No. The requirement is met by controlling and managing the devices, and the CMMC Assessment Guide Level 2 recognizes two approaches: managing devices manually, for example with a key assignment list, or updating a badge access system. A manual process works for a small number of doors, but it must still show who holds each key, what it opens and when it changed. A badge system makes many of these records easier to produce and keep current, and its audit trail can support PE.L2-3.10.4. Choose based on the number of doors, the turnover rate and how often roles change. Confirm with your assessor that your chosen method produces the evidence they expect.
Can PE.L2-3.10.5 ever go on a POA&M?
No. Under 32 CFR 170.21(a)(2)(iii), PE.L2-3.10.5 is one of six requirements that may never be placed on a plan of action and milestones, so it must be MET for the organization to reach Conditional or Final Level 2 status. This makes the requirement a gating item. Before any assessment, confirm that the inventory, the change procedure and the reconciliation records exist and reflect current reality. A missing record cannot be deferred to a later date. Check the current status of the CMMC phase schedule with the Department of War's CMMC pages, since enforcement timing has changed, but the POA&M restriction is set in the rule text.
What must our team supply to produce the evidence?
Your team must own the facts that only you can supply. These include the list of physical access locations, the devices and badges issued, the names of the people who hold each device, records of key and lock combination changes, and the storage location of spare devices. NIST SP 800-171A lists inventory records of physical access control devices, records of key and lock combination changes, storage locations and the devices themselves as potential evidence, along with tests of the access control process. Expect to provide a named process owner, a documented procedure for role changes and departures, and proof that the procedure ran. Any partner can help format these records, but it cannot attest to them.
Can a partner produce the evidence for us, and what stays with us?
A partner can prepare systems, procedures and records so that the evidence exists and is organized, but it cannot issue findings or certify the result. For Level 2 certification, assessments are performed by authorized or accredited C3PAOs, and the organization remains accountable for the accuracy of its records. Ask a partner to define in writing which records it will build, which it will test and which the organization must keep current. Open-source tools such as GLPI can hold asset records for racks, equipment and peripherals, and identity tools such as authentik and FreeIPA can help deprovision access when people leave. Confirm each tool's capabilities against its documentation before relying on it.
How DeployOpen prepares physical access evidence for CMMC
DeployOpen prepares the systems and records that show how your organization identifies, controls and manages physical access devices for PE.L2-3.10.5. Your organization owns the controls and the access decisions, and an independent assessor reviews the evidence and makes the determination.
How we scope
- We agree in writing which access devices, locks, badge systems and facilities fall within PE.L2-3.10.5 before work starts.
- The written scope names the asset inventory sources, the people who own key and badge decisions, and the sites covered.
- Engagements are fixed-scope, and ongoing support is available as a retainer once the scope is delivered.
How we build
- We configure self-hosted inventory tools such as GLPI to record physical and logical asset records tied to owners and locations.
- We connect identity lifecycle tooling such as authentik SCIM and FreeIPA so role changes and departures update access records.
- We set up review workflows so key assignment lists and badge access changes are recorded and approved by named owners.
How we hand over
- We deliver the access device inventory, key and lock change records, and storage location records in a form your assessor can review.
- We document the physical access control procedures and the test steps your staff can repeat to show the controls operate.
- We walk your team through where each piece of evidence lives, who maintains it, and how it is kept current.
How we support
- We help your team run periodic checks that compare the device inventory against current staff roles and departures.
- We can review evidence before an assessment so gaps are found while there is still time to correct them.
- Ask your assessor and your organization to confirm the evidence form they accept for PE.L2-3.10.5 before scoping begins.
