03.10.02 Monitoring physical access: evidence and audit

What 03.10.02 monitoring physical access asks for and why assessors check it

03.10.02 requires the organization to monitor physical access to the facility where its systems holding CUI reside, so that physical security incidents are detected and responded to, and to review physical access logs at a frequency it defines and after events it defines. If a contract requires SP 800-171, the facility hosting those systems needs a monitoring practice that you can explain and show to an assessor. The risk this addresses is simple: someone enters a server room, a wiring closet or an office with a workstation or media holding CUI, and nobody notices until much later, if at all. Monitoring turns entry from an invisible event into one that can be spotted, questioned and investigated.

Two parts of the requirement are organization-defined parameters, so the organization must set them. The first is how often physical access logs are reviewed. The second is which events, or potential indications of events, trigger a review, such as a door alarm, a badge reader error pattern, a tailgating report or a visitor access outside normal hours. NIST does not set these values for you, and if the federal agency you contract with does not specify them, you must assign them yourself. Write both values into the physical protection policy and procedures so they are testable. The requirement maps to the PE-6 monitoring control in SP 800-53 Rev. 5, which is a useful cross-reference when your security team already works from that catalog. Confirm the exact mapping against the NIST sources before you cite it in an assessment package.

In practice this requirement is hard for two reasons. First, the logs often sit with someone else. A landlord, building management company or colocation provider may run the badge system, the cameras and the door controllers, so you need a written arrangement that gives you access to the records, the retention period and the review trigger you require. Second, logs are often collected and never reviewed. An assessor will ask for records of reviews, the people who performed them, what they found and what they did about it, and an unreviewed archive does not satisfy that request. Decide who reviews, how the review is recorded and how it links to incident response before the assessment begins.

Which facilities, logs and third parties fall under 03.10.02

Monitoring physical access only works when the assessed scope matches where the system actually sits. The decisions below determine which facilities, log sources and outside parties must be covered, and each one changes who holds the monitoring evidence and who must produce it on request.

The facility where the system resides

03.10.02 applies to the facility where the system resides, so the first scoping step is to name every physical location that houses CUI systems, backups, network closets and endpoints that process CUI. A single office floor, a server room and a remote rack each count as separate places to monitor. Confirm the boundary in the system security plan and make sure the monitoring design covers each named location, not only the headquarters.

Shared or colocated data centers

When systems sit in a colocation cage or a shared hall, the provider usually controls the doors, cameras and visitor logs. Your organization still needs to show that monitoring reaches its own cage or racks. Ask the provider for contractual access to its physical access logs, the review frequency it commits to, and how it notifies you of incidents affecting your space. Record which party performs each review step.

Office space owned by a landlord

In a leased office, the landlord or building management may run badge readers, lobby guards and camera systems that cover the floor where CUI is handled. Those logs may be outside your administrative control. Identify which building systems can show who entered your floor, agree on retrieval and retention with the landlord in writing, and decide whether your own badge logs fill any gap.

Guard and CCTV contractors

Outsourced guard services and monitored camera systems often generate the alerts and footage that show detection and response. Their contracts should define what they record, how quickly they escalate events to your staff, and how long footage is kept. Ask for their incident logs and confirm your team reviews them at the frequency you defined, because a contractor's log does not show your review.

Log review frequency and triggering events

03.10.02 leaves two parameters to the organization: how often physical access logs are reviewed, and which events require an immediate review. Examples of triggering events include an access badge used outside business hours, a lost credential, or a door alarm. Document both values in the plan, assign owners, and keep dated records of each review so an assessor can match actions to your own defined rules.

Remote and home workers

Employees who work from home do not have a facility log of their own, so monitoring usually shifts to the controls that apply to alternate sites. The detailed rules for which home or remote locations may be used belong to 03.10.06, which sets the security requirements for those sites. For 03.10.02, confirm which records, such as device logs or workplace badge data, show physical events at each location where CUI is accessed.

How an assessor tests physical access monitoring under SP 800-171A

This table compares the three assessment methods SP 800-171A uses for 03.10.02 and the objects an assessor examines, interviews or tests under each. Read it as a preparation checklist: each row names what the assessor will ask to see and where organizations most often fall short.

Method or check	What the assessor looks at	Evidence to have ready	Common findings
Examine: policy and procedures	Whether the physical protection policy and the physical access monitoring procedures exist, are approved and cover the facility where the system resides	Approved physical protection policy, written monitoring procedure, version and approval dates	Procedure describes monitoring in general terms and does not match what staff actually do
Examine: access logs and monitoring records	Physical access logs or records and monitoring records for the facility, checked against the defined review frequency	Log extracts for the review period, signed or ticketed review records, dated reviewer sign-off	Logs exist but no review record shows they were examined at the defined frequency
Interview: monitoring personnel	Whether staff who watch or review physical access understand their responsibilities and the defined review events	Named roles, duty rosters, short walkthrough of how an alert or badge anomaly is handled	Staff cannot describe the review events or say they assume a colleague reviews the logs
Interview: incident response personnel	Whether those who respond to physical security incidents know how a monitoring alert reaches them and what they do next	Escalation path, contact list, a sample record of a physical incident handled through the response process	Physical incidents are handled informally and never recorded in the incident process
Test: monitoring processes	Whether the monitoring process runs as written, including detection of physical access events and triggered reviews	Test results showing an access event is detected, reviewed and closed, with timestamps	Process exists on paper but a test event produces no review or alert
Test: monitoring mechanisms	Whether cameras, badge readers, alarms or logging systems that support monitoring are configured, retained and operating	Configuration exports, retention settings, time synchronization evidence, device health records	Mechanisms are installed but recording gaps or unsynchronized clocks make logs unusable
Check: ODP values defined	Whether the review frequency and the review events are set to specific values rather than left blank	Documented parameter values in the system security plan or monitoring procedure, with the approval record	Frequency is described as periodic or as needed, which cannot be tested

How to implement physical access monitoring in order

This sequence takes an organization from knowing which doors and monitoring points cover the system to a documented, repeatable review cycle that satisfies 03.10.02. Each step produces a record an assessor can examine, interview against and test.

Map facility and monitoring points
Identify every facility where the system that processes, stores or transmits CUI resides, then list each entry point, camera, badge reader, guard post and visitor sign-in location that covers those spaces. Walk the site or review floor plans with facilities and security staff, and note any gaps where access is not observed or recorded. The output is a monitoring coverage map tied to the system boundary in the system security plan. Confirm the map with the owner of each facility, because a space nobody lists is a space nobody reviews.
Set the review frequency and trigger events
Assign values to the two organization-defined parameters for 03.10.02: how often physical access logs are reviewed, and which events or potential indications of events require a review. Typical triggers include badge denials at restricted doors, access outside authorized hours, lost credentials and alarms, but the list should reflect your own facility. If a federal agency or contract has already specified these values, record them and confirm them in writing instead of setting your own. The output is a signed parameter record that names both values.
Assign log reviewers and alert recipients
Name the people who review physical access logs and the people who receive alerts when a trigger event occurs. Separate these roles where possible from the staff who grant access, so the reviewer is checking the work of others. Document backup reviewers for absences, and confirm that each person has the access needed to read the logs. The output is a responsibilities matrix that an assessor can interview against, showing who monitors, who reviews and who escalates.
Connect monitoring events to incident response
Define how a monitoring alert or log finding moves into the incident response process. Specify the intake point, the severity criteria, the point at which an event becomes a security incident under your incident handling procedure, and the escalation path to the incident response team. Align this with the incident tracking and reporting steps already in your plan so physical events are not handled in a separate silo. The output is a written escalation procedure and an example ticket showing a physical event moving through it, labeled as illustrative if it is not a real case.
Configure log collection and retention
Set up collection of access control events, camera alerts and visitor records into a location where reviewers can search them and where they cannot be altered by the people they describe. Set a retention period for access records that your legal, contractual and CUI obligations support, and confirm the period with counsel or the contracting officer where it matters. Test that logs from each monitoring point arrive with accurate time stamps. The output is a retention schedule and a configuration record for each source.
Run and document the first review cycle
Perform the first review using the frequency and triggers you set, and record who reviewed which logs, the date, the period covered, any anomalies found and what was done about each one. Where a trigger event occurred during the period, keep the review record alongside the incident record. Ask a reviewer outside the day-to-day process to check a sample of entries. The output is a signed review record that shows the procedure was run, not only written down.
Verify the cycle and maintain evidence
Check that the review cycle ran at the defined frequency, that trigger events produced reviews, and that the coverage map still matches the facility after any change in layout, tenants or equipment. Update the parameter record, the responsibilities matrix and the coverage map when they drift, and keep prior versions. Because the assessor will examine policy, procedures, logs and monitoring records, store them together so they can be produced on request. The output is a dated evidence package that an independent assessor can test against 03.10.02.

Which evidence shows that physical access is monitored and reviewed

An assessor testing 03.10.02 looks for proof on two fronts: that physical access to the facility is watched, and that the access logs are reviewed on a schedule and after defined events. The cards below cover the artifacts that prove both, and the routines that keep them current between assessments.

Physical protection procedure

This is the written procedure that says how physical access monitoring works: who watches the entry points, which tools they use, how often logs are pulled, and who is told when something looks wrong. Assessors examine it first, and the procedure must match what staff actually do. Check that it names the roles that interview well, such as the facility security lead and incident responders. Review it on a set cycle and record each approval with a date and version.

Documented ODP values

Requirement 03.10.02 has two organization-defined parameters: how often physical access logs are reviewed, and which events or potential indications of events trigger a review. NIST does not set these values, so the organization must. Write both values into the procedure and the system security plan, and make sure they are the values the review records actually follow. A review that happens monthly against a documented quarterly frequency will be a finding.

Access log exports and badge records

Badge readers, door controllers and visitor logs produce the raw record of who entered, when and through which door. Keep periodic exports from the access control system with timestamps intact, and confirm that the export covers the full review period. Check that the logs cannot be edited by facility staff without a trace. Assessors often ask for a sample of entries and then trace each one back to a badge holder and an authorization.

Signed review records

Each review should produce a record showing the date, the reviewer, the log period covered, the anomalies found and what was done about them. Use a standing template so every review captures the same fields, and require a signature or electronic approval from someone other than the reviewer where possible. Set up a review calendar so no scheduled review is missed. Missing or unsigned records are the most common gap assessors report for this requirement.

Incident tickets from monitoring events

When a review or an alarm flags a potential indication of an event, such as tailgating, access outside business hours, or a failed badge sequence, open a ticket and follow it to closure. The ticket should link to the log entries and record the decision and any corrective action. Tickets show that monitoring leads to response, which the requirement also asks for. Ask whether your ticketing tool can hold the physical events alongside cyber incidents so the record stays in one place.

CCTV and alarm configuration

Where cameras or intrusion alarms watch the facility, keep the configuration as evidence: camera coverage of entry points, alarm zones, notification recipients and retention settings for video and alarm events. Confirm the retention period matches what the procedure states, and that footage can be retrieved for a defined event. Screenshots of settings dated at the time of capture are more persuasive than verbal descriptions in an interview.

What meeting 03.10.02 costs in money and staff time

This table breaks down the cost components of monitoring physical access for 03.10.02, showing who is paid for each, whether it is one-time or recurring, and what pushes it up or down. No supplied figures exist for these costs, so use the drivers and quote questions to compare offers on the same written scope.

Cost component	Who is paid or who carries it	One-time or recurring	What drives it up or down
Badge, access control and visitor logging systems	Hardware and software vendors, integrator, or the facility owner	One-time install, recurring licenses and support	Number of entry points, number of doors logged, retention period, and whether the system is already in place
CCTV and alarm monitoring	Camera and alarm vendors, monitoring service provider, internal security staff	One-time install, recurring monitoring and storage	Camera count and coverage of entry points, monitoring hours, and whether live watch is outsourced
Staff time for scheduled log reviews	Internal staff or a managed security provider	Recurring	Review frequency set in the organization's defined parameters, log volume, and how many people share the duty
Staff time for event-driven reviews	Internal incident responders or a managed provider	Recurring, varies with incidents	Number of defined trigger events, false alarm rate, and how well alerts are filtered before review
Facility owner or colocation coordination	Landlord, colocation operator, or shared facility manager	Often recurring through contract terms	Whether the facility is shared, what the colocation agreement grants, and who controls the logs
Open-source logging and case tooling	Platform implementation partner for setup, the organization for operation	License spend is removed, but setup and hosting remain	Hosting capacity, integration with badge and camera feeds, and retention needs; confirm each platform's features in the environment
Evidence upkeep	Internal compliance or security staff	Recurring	How often logs are exported, how review records are kept, and how many systems must show the same evidence
External review and implementation support	Independent consultants or implementation partners	Often one-time readiness work, plus optional retainers	Scope of the written statement of work, number of facilities, and whether testing is included
Assessor sampling effort	Independent assessor, paid by the organization	Recurring at each assessment cycle	Number of log samples the assessor requests, number of facilities in scope, and how quickly records can be produced

How open-source platforms support the review record

None of the tools named here monitors a door, a badge reader or a camera. Physical access monitoring for 03.10.02 happens in the facility layer: badge systems, door controllers, visitor logs and video management. What the open-source platforms in a NIST SP 800-171 environment can do is hold the digital record of what happened after an event was detected, and show that the review of that record happened on the schedule your organization defined. Confirm with the vendor and your own environment exactly which physical access systems feed into your monitoring design, since that determines what the platforms ever see.

Nextcloud's admin_audit app writes additional event information to audit.log in the data directory, or to a path set with logfile_audit. If your facility team keeps access review notes, incident tickets or visitor records in Nextcloud, this log can show who changed or viewed those files and when. Check that the log path sits on storage covered by your retention and protection rules, and that someone is assigned to review it. OpenBao audit devices keep a detailed JSON log of every API request and response, including errors, with most sensitive values hashed with HMAC-SHA256. That can support a review of who requested access to secrets used by badge or monitoring integrations, without exposing the secret values themselves. Confirm which API paths your integrations call and whether the hashed fields meet your investigators' needs.

DFIR-IRIS is the most direct fit for the review step. It triages alerts from SIEM, EDR and REST sources into cases, keeps each case as a record of assets, IOCs, tasks and evidence with a full audit trail, builds an investigation timeline, and generates reports from case data. An illustrative workflow: a door-forced alert from the access control system arrives through a REST integration, becomes a case, and the timeline and tasks document who reviewed the logs and what they decided. Its license is LGPL-3.0-or-later. Your counsel should confirm how that license applies to your deployment and any modifications, and you should confirm with the vendor how physical access alerts are mapped into cases before you rely on it for 03.10.02.

Who does what for physical access monitoring: your team, a partner and the auditor

Your organization owns requirement 03.10.02. That means you decide how physical access to the facility where the system resides is watched, who reviews the logs, and whether the controls operate. The facility relationship sits with you as well, because landlords, building management and shared-tenant arrangements often control the cameras, badge systems and guard logs that you rely on. You also make the organization-defined parameter decisions: how often physical access logs are reviewed and which events or potential indications of events trigger a review. NIST does not assign those values, so if your federal sponsor has not specified them, you must set them.

Facility relationships: confirm who operates badge readers, cameras and guard services, and what they retain and export.
ODP decisions: set and document the review frequency and the triggering events, and record the rationale.
Review ownership: name the people who review logs and the sign-off authority for each review.
Incident linkage: decide which physical findings are escalated into your incident response process.
Evidence retention: keep signed review records and retained access logs under your own control.

Before assessment, check that every ODP value is written down, approved and actually followed in the review records.

Where organizations fail 03.10.02 and how to close each gap

Most failures against 03.10.02 come from a monitoring process that exists on paper but cannot show a defined frequency, defined triggers and a reviewed record. The cards below cover the gaps assessors most often find and the fix for each, so the organization can show the monitoring working during an assessment.

ODP values left undefined

Requirement 03.10.02 has two organization-defined parameters: how often physical access logs are reviewed, and which events or potential indications of events trigger a review. NIST does not assign these values, so if the federal agency does not specify them, the organization must. Check that the policy states a review frequency and a written trigger list, and that both match what the assessment procedure expects the organization to have defined.

Logs collected but never reviewed

Badge readers and door controllers often record every entry, yet nobody looks at the records until an incident forces the question. The requirement asks for review at the defined frequency, not just retention. Schedule the review as a recurring task with a named owner, and confirm that the logs the reviewer sees are the same logs the system generates.

Review records without dates or reviewers

A review that cannot be dated, attributed and tied to the log period it covers will not persuade an assessor, even if the review happened. Each review record should state the date, the reviewer, the log range examined, any anomalies and the follow-up taken. Store these records in the same place as the logs so an assessor can trace one to the other.

No defined triggering events

Reviews after a defined event, such as a forced door, a lost credential or an alarm, only work when the organization has written down which events count. Without that list, staff decide case by case and the review is missed on busy days. Agree the trigger list with facilities and security, then configure alerts so that each trigger starts a documented review.

Building-owner logs out of reach

In shared buildings, the landlord or property manager often operates the access control system. If the contract does not give the organization timely access to those logs, it cannot review them at its own frequency or show them to an assessor. Confirm log access, export formats and retention in the lease or service agreement before relying on them for 03.10.02.

Monitoring disconnected from incident response

A suspicious access pattern should reach the people who handle security incidents, not sit in a facilities inbox. Route physical access alerts into the same intake process used for cyber incidents, and confirm that responders know how to request the badge history for an investigation. Test this path during an exercise so the handoff is proven, not assumed.

Questions buyers ask about 03.10.02 cost, effort and outside help

Does a CCTV system alone satisfy 03.10.02 monitoring physical access?

No. A camera system helps, but 03.10.02 asks for two things: monitoring physical access to the facility where the system resides so that incidents are detected and answered, and reviewing physical access logs at a frequency and after events that the organization defines. Cameras with no defined review routine, no retained records and no response step leave the assessor with nothing to examine. The organization sets the review frequency and the triggering events itself, because 03.10.02 has two organization-defined parameters that NIST leaves to the organization when no federal agency supplies values. Evidence usually combines the monitoring procedure, access and camera records, review sign-offs and records of how alerts were handled. Confirm with your assessor which records they expect to see for your environment before you finalize the procedure.

What drives the effort to get ready for 03.10.02?

The main drivers are the number of facilities that hold systems with CUI, how many access points each facility has, what monitoring already exists, and how many people must be trained on the review routine. Organizations that already log badge access and retain camera footage need mainly to define the parameters, document the procedure and show that reviews happen. Organizations with unmonitored doors, shared credentials or records held by a third party need more work. Ask any provider for a written scope that lists each facility, the monitoring tools in place, the parameters to be defined and the evidence to be produced. A quote follows from that scope, and the scope is the right document to compare across bids.

What does the work need from our own staff?

Several decisions must come from the organization itself, because they reflect its risk tolerance and operations. Staff must name the owner of physical access monitoring, agree the review frequency and the events that trigger a log review, and confirm who responds to a suspected incident. Facilities or building management staff must explain how access is controlled at each site. Incident response staff must confirm how physical events feed into their process. These people must also be available to take part in interviews, since the assessment method for this requirement includes interviews with personnel who monitor access and personnel who handle incidents. Plan for their time before the work starts.

Can we use our landlord's or colocation provider's access logs?

Possibly, but only if the provider's records meet what your assessor will test and you can obtain them when needed. The organization remains responsible for 03.10.02 for the facility where its system resides, so a provider's logs do not transfer that responsibility. Before relying on them, ask the provider in writing whether it logs physical access to your area, how long it keeps the records, whether it will share them on request, who reviews them and how it notifies you of a suspected incident. Also confirm whether the contract covers review and retention of those records. Where the provider cannot give those answers, you will need your own monitoring for the areas you control.

Can a partner prepare the monitoring evidence while an independent assessor tests it?

Yes, that split is the usual arrangement. An implementation partner such as DeployOpen can help prepare systems, documentation and evidence, including procedures, log configuration and review records. The organization owns its controls and decides how they operate. An independent assessor examines the evidence, interviews staff and tests the mechanisms, then reaches its own conclusion. Only an independent auditor, assessor or certification body issues reports or certificates, and DeployOpen does not. Agree in writing what the partner delivers, who signs off each record and which evidence the assessor will need, so that preparation does not blur into validation.

Can we do the 03.10.02 work in-house instead of hiring outside help?

Often yes, if the organization has people who understand the facility, the monitoring tools and the assessment method, and if they have time to produce and keep records consistently. In-house teams usually handle the policy, the review schedule and the access log reviews well. Outside help is more useful when the team lacks experience with assessment evidence, when several facilities or cloud and colocation sites are involved, or when the organization needs an outside view before an assessment. Whichever route you choose, compare quotes against a written scope, ask what is one-time and what recurs, such as periodic reviews and log retention, and decide who will maintain the records after the work is complete.

How DeployOpen prepares physical access monitoring evidence

DeployOpen plans, implements and documents the logging and review setup that supports 03.10.02 Monitoring physical access inside the client's own infrastructure. The organization owns its physical security controls and its assessment results, and DeployOpen prepares the systems and evidence for review.

How we scope

Agree in writing which facility, systems and monitoring sources fall within the 03.10.02 scope.
Confirm with the organization the two ODP values: the log review frequency and the triggering events.
Identify who holds physical access monitoring and incident response responsibilities, so interview evidence is defined up front.

How we build

Configure self-hosted platforms to record access-relevant events and retain the resulting audit records.
Connect physical access monitoring outputs to case tracking so reviews and responses leave a traceable trail.
Document the review procedure, including the frequency and event triggers the organization has adopted.

How we hand over

Deliver a written evidence map that links each determination statement to a log, record, procedure or configuration.
Provide sample review records and case records that show logs were reviewed on schedule and after defined events.
Confirm with the organization's assessor which artifacts they will examine, interview on and test before fieldwork.

How we support

Offer ongoing support and upgrades as a retainer after handover, if the organization wants continued help.
Re-check logging and review evidence when the system, facility or monitoring tools change.
Support testing of the monitoring setup, with the organization deciding what remediation to accept.