03.10.07 Physical access control: requirements and evidence

What 03.10.07 physical access control asks for and why it is new

03.10.07 requires the organization to enforce physical access at every facility entry and exit point that leads to systems holding CUI. In practice, that means checking each person's authorization before granting entry, controlling who can come in and go out, keeping audit records of physical access, escorting visitors and controlling their activity, and securing the keys, combinations and other access devices that open doors. It also requires controlling physical access to output devices, such as printers and displays, so that people without authorization cannot read or take CUI from them. A contractor preparing for a Rev. 3 assessment must be able to show that these controls operate at each door, not only that a policy describes them.

The risk behind the requirement is simple. If an unauthorized person can walk into a server room, a records office or a shared workspace, logical controls such as passwords and encryption have little value against someone who can plug into a console, pick up a printed page or copy a drive. The requirement treats physical entry as part of the boundary that protects CUI. An assessor will expect to see the entry points in the system security plan, the mechanisms that control them (card readers, locks, guards or a combination), and records that show the mechanisms were used and reviewed. Ask your facilities team to list every entry and exit point that serves an area holding CUI, and confirm which of them are enforced by a device, by a person, or by both.

Rev. 3 is harder to trace than Rev. 2 for a reason that affects CMMC Level 2 readers. Rev. 2 covered this ground in three separate requirements, 3.10.3, 3.10.4 and 3.10.5, which dealt with visitor escort and monitoring, physical access logs and keys or devices. Rev. 3 withdrew those three and folded their content into 03.10.07, and NIST maps no Rev. 2 requirement to it. CMMC Level 2 therefore has no matching identifier for the new requirement. Teams working toward a CMMC assessment should build a crosswalk by hand, so that each Rev. 2 practice's evidence is shown to satisfy a part of 03.10.07, and should confirm with their assessing body how that mapping will be accepted. The NIST change analysis spreadsheet is the place to start that trace.

Which facilities, systems and third parties fall under physical access control

Physical access control under 03.10.07 applies wherever the system or CUI physically sits and wherever someone can reach it. The decisions below determine which entry and exit points, visitors and vendors enter the assessment, so settle them before writing procedures or collecting logs.

Facilities that house the system

Start with every building, floor, room or cabinet where the in-scope system, its storage or its backups physically reside. Each location with an entry or exit point needs documented authorization checks, access logs and escort rules. Check whether a server room sits inside a larger office and whether the path to it passes through unmonitored doors. Record the boundary you define, because the assessor will test the points you list.

Shared buildings and colocation space

When the system sits in a multi-tenant building or colocation facility, the operator controls many of the entry points you must cover. Confirm in writing which access controls, logs and visitor procedures the facility provides and which you must add, such as a locked cage or cabinet under your own key control. Ask the facility for its access logs or reports covering your space, since you will need them to show the requirement is met.

Guards and access control vendors

Guards, badge system vendors and monitoring providers may perform parts of 03.10.07 for you, but accountability stays with your organization. Define who verifies authorizations, who holds the badge administration console and who reviews the logs. Review vendor contracts for log retention, personnel screening and notification of device failures or lost credentials. Keep the inventory of access control devices current, since assessors examine it.

Visitor populations and escorts

Contractors, auditors, delivery staff and vendor technicians each carry a different risk at the same door. Decide which groups need an escort, which may wait in a lobby and which must sign in with identification before entry. Write rules for controlling what visitors can see or touch, including screens, printers and whiteboards that display or output CUI. Confirm that escort procedures apply to after-hours and emergency visits too.

Alternate sites covered by 03.10.06

Remote and home-based work is governed by the alternate work site requirement, 03.10.06, not by 03.10.07. Decide which locations fall under each requirement so nothing is covered twice or missed. Corporate offices, data centers and facilities you control belong under 03.10.07, while employee homes and approved remote locations need the rules set in 03.10.06. Document the split in the system security plan so the assessor can trace each location to one requirement.

How an assessor tests 03.10.07 under SP 800-171A Rev. 3

This table maps the assessment objects SP 800-171A Rev. 3 names for 03.10.07 to the evidence an assessor asks for and the gaps that commonly appear. Read it as a preparation checklist: each row shows what the assessor examines, interviews or tests, and what you should have ready before the assessment begins. The main takeaway is that the policy, the logs and the device inventory must agree with each other, because an assessor will compare them.

Assessment object	What the assessor asks for	Common finding
Examine: physical protection policy and procedures	Written policy and procedures that define how physical access is enforced at entry and exit points, with owners and review dates	Procedures exist but do not name the entry points, the enforcement method or the people responsible
Examine: procedures for physical access control	Documented steps for verifying authorizations, issuing and collecting credentials, escorting visitors and handling key or combination changes	Steps describe intent only, so staff cannot show how a visitor is escorted or a lost badge is handled
Examine: physical access control logs or records	Entry and exit records covering the assessment period, with identity, time and point of access, reviewed as the organization defines	Logs are missing for doors, guard posts or visitor sign-ins, or cannot be tied to a named person
Examine: inventory records of physical access control devices	A current inventory of readers, locks, badges, keys and combination systems, with assigned custodians	Inventory omits keys, shared combinations or guard-controlled doors, so unmanaged access paths exist
Examine: system entry and exit points	Floor plans or a list identifying each point where access to the system's facility is controlled	Secondary doors, loading docks or server room doors are not listed, so the scope of control is unclear
Interview: personnel with physical access control responsibilities	Explanations of how authorizations are verified, how visitors are escorted and how output devices are protected, checked against the records	Staff describe a process that differs from the written procedure or the logs
Interview: personnel with information security responsibilities	Confirmation that physical access events are reported to security staff and that the controls cover the output devices holding CUI	Information security staff are unaware of physical access events or do not review them
Test: processes and mechanisms for physical access control	Observation or demonstration that a badge, lock, guard or escort control works as documented at a sample of entry and exit points	The mechanism exists but is bypassed, such as propped doors, shared badges or unescorted visitors

Implementing 03.10.07 in the order that produces evidence

This sequence turns the 03.10.07 physical access control requirement into a working, documented process, with each step leaving a record an assessor can examine. Work runs from the parameter decisions and procedure through the entry points, devices, logs, visitor and key rules, and output devices, and ends with a test that proves the controls operate.

Define the organization-defined parameter values
Start by settling the organization-defined parameter values that apply to the facility, because the requirement cannot be assessed until they are set. The organization owns this decision, usually through the security officer and the facilities lead, and must set them if the federal agency customer has not specified them. Record each value, the reason for it and the approver. The output is a short parameter register that the procedure, the system security plan and the test script all reference. Confirm with the contracting agency whether it has published values for your contract before choosing your own.
Document the physical access control procedure
Write the procedure that tells staff how entry and exit are enforced, who verifies authorizations, what happens when verification fails, and how exceptions are approved. The assessment procedure looks for procedures for physical access control and for the physical protection policy, so this document is examined directly. Owners are the facility security function with input from information security. The output is an approved, dated procedure version that points back to the parameter register and to the list of authorized personnel maintained under 03.10.01.
Inventory entry and exit points and devices
Build an inventory of every entry and exit point to the facility or to the areas that house systems with CUI, along with the access control devices, guard posts and mechanisms installed at each. Include doors, gates, loading docks and emergency exits, and note which ones are unmonitored or shared with other tenants. Assessors examine inventory records of physical access control devices and system entry and exit points, so this inventory is a required artifact. The output is a controlled list with an owner, a location and a last-verified date for each point.
Configure verification, ingress control and logging
For each inventoried point, configure how the organization verifies a person's authorization and controls ingress and egress, whether through badge readers, locks, turnstiles or staffed guards. Enable audit logging on the physical access control system so every grant, denial and door event is recorded with time, identity and point. Check that logs are retained and can be retrieved for review. The output is a configuration record per point and a sample log extract showing both allowed and denied events. Confirm vendor log fields and retention capabilities directly with the product supplier.
Set visitor escort and key control rules
Write and implement rules for visitors, who must be escorted and whose activity inside the controlled area must be controlled, and for keys, combinations and other access devices, which must be issued, tracked and changed when staff leave or a device is lost. Brief reception and guard staff on the rules and keep a visitor log that records the escort assigned. The output is a visitor sign-in and escort record, a key or combination issuance register, and signed acknowledgments from the staff who issue them.
Cover output devices in controlled areas
Identify printers, displays, scanners and other output devices in the areas where CUI is handled, then place them so that unauthorized people cannot view or retrieve output, or add physical controls where placement is not possible. The requirement covers physical access to output devices, so the record should show where each device sits and how access to it is restricted. The output is a device placement map and a note of any compensating controls, such as locked output trays or restricted rooms, with the owner of each device recorded.
Test the controls and collect the records
Run a scripted test that attempts entry with an authorized credential, an unauthorized credential, a tailgated entry and a visitor without an escort, then confirms the logs captured each event. Interview personnel with access control responsibilities to confirm they follow the procedure. Assessors use the examine, interview and test methods together, so keep the test results, the interview notes and the log extracts in one evidence folder mapped to the seven determination statements. The output is a signed test report, a gap list with owners and dates, and an evidence index ready for the system security plan.

How the parts of physical access control connect

The chain starts with a authorization record and ends with a periodic review, and 03.10.07 covers only the middle link: enforcing that record at each entry and exit point. Under 03.10.01, the organization keeps the approved list of people who may enter the facility where the system resides, issues credentials and removes people who no longer need access. Under 03.10.07, the organization verifies each person against that list at the door, through a physical access control system, a device or a guard, and controls ingress and egress accordingly. The enforcement point also covers escorted visitors, the keys, combinations and badges that open doors, and access to output devices such as printers in the same space. An organization can have a current list and still fail 03.10.07 if doors admit people the list does not cover, so the assessor will look at the door, not only the roster.

Each enforcement decision should leave a record. The physical access audit logs that 03.10.07 requires, and the inventory of access control devices and entry and exit points that SP 800-171A Rev. 3 names as examine objects, are the evidence an assessor samples. The logs are then read under 03.10.02, which covers monitoring physical access to detect and respond to incidents and reviewing logs at a defined frequency and after defined events. Practically, the control owner should confirm that badge reader logs, visitor sign-in records and key custody logs share a common identifier with the authorization list, so a reviewer can trace one person from approval to door event. Ask the facilities or building management provider whether logs can be exported in a form that a security team can retain and search.

Because the three sibling requirements are tested as one chain, gaps usually appear at the seams: a credential that is never revoked, a visitor who is escorted but not logged, or a log that nobody reviews. Map each seam to an owner and a check before the assessment. Any system that supports the logging side, including a self-hosted platform, should be treated as part of the evidence trail and documented in the system security plan. The organization owns the decisions. An implementation partner can help configure the log pipeline and assemble the evidence, but only the independent assessor determines whether the requirement is met.

Evidence that passes a 03.10.07 assessment

An assessor testing 03.10.07 looks for records that show access was enforced at entry and exit points, not only that a policy exists. The cards below cover the artifacts that connect those records to the seven determination statements in SP 800-171A Rev. 3, and how to keep each one current between assessments.

Physical access control logs

Entry and exit logs from badge readers, guard sign-in sheets or turnstile systems are the core evidence that access was verified and controlled. Check that each entry records who entered, the point used, the time and any denial. Review logs on a fixed schedule and keep a dated record of that review, because an assessor will ask who looked at the logs and what they did about exceptions.

Physical protection policy and procedures

The written procedures for verifying authorizations, issuing and retrieving credentials, escorting visitors and handling lost keys are the examine objects an assessor reads first. Keep each procedure tied to a named owner and a review date, and confirm that the people who operate the access control system follow the same steps described in the document.

Access device and key inventory

An inventory of badges, keys, combinations, cards and other access devices, with the holder, issue date and status of each item, shows that securing access devices is actually managed. Reconcile the inventory against separation records and against the access system's own list of active credentials, and record every deactivation or key recovery with its date.

Visitor escort records

Visitor logs showing name, sponsor, purpose, arrival and departure times, and the escort assigned for the visit demonstrate that visitors were escorted and their activity controlled. Ask whether the escort log matches the sign-in sheet and whether visitor badges were returned, since gaps in either point are common findings during interviews.

Output device control records

Records showing where printers, displays and other output devices that may show CUI are located, who can reach them, and how access is restricted are the evidence for controlling physical access to output devices. Keep a current location list and a dated check that screens and printers in shared areas are placed or shielded as documented.

Dated sample of enforcement tests

A dated set of tests in which staff attempt entry without a valid credential, use a revoked badge, or tailgate through a door shows the enforcement mechanism works, which is what the test method in SP 800-171A Rev. 3 checks. Run the tests on a schedule, record the result and any corrective action, and keep the results with the procedures they exercised.

What meeting 03.10.07 costs in money and effort

This table breaks down the cost components of enforcing physical access at entry and exit points under 03.10.07, who is paid for each, and whether it is one-time or recurring. No fee or duration figures were supplied for this requirement, so use the table to structure your quote requests and to see which drivers move cost up or down.

Cost component	Who is paid or who bears it	One-time or recurring	What drives it and what to ask for in a quote
Physical access control hardware and software	Hardware and software vendors, integrators installing readers, locks and controllers	One-time purchase and installation, with recurring licensing or maintenance	Number of entry and exit points and whether existing badge systems can be reused. Ask for itemized hardware, licensing terms and maintenance coverage.
Guards, if used to meet the requirement	Security contractor or in-house guard staff	Recurring, usually tied to staffed hours	Number of posts and hours of coverage at each entry point. Ask for staffing hours, post orders and rate basis.
Facilities and engineering time	Internal facilities, IT and security staff, or an implementation partner	One-time for design and installation, recurring for changes	Number of doors, zones and integrations with identity systems. Ask for the work breakdown and who holds each task.
Key, combination and access device management	Internal security or facilities staff	Recurring	Number of keys, cards and combinations in circulation and how often they change. Ask how inventory and rekeying are handled in the quote.
Visitor escort and logging procedures	Staff who escort visitors and maintain the logs	Recurring	Visitor volume and escort rules. Ask whether escort time is priced into the staffing estimate.
Evidence upkeep	Internal compliance staff or an implementation partner preparing logs and inventory records	Recurring, for example during log reviews and each assessment cycle	Log retention period, review frequency and the number of systems in scope. Ask how log export and inventory updates are scheduled.
External review and readiness support	Independent assessor for formal assessment, or a consultant for readiness work	Usually one-time per assessment, plus periodic re-review	Scope of the CUI environment and the assessment method used. Ask the assessor for its fee basis and what sampling it will perform.
Auditor sampling of physical access records	Independent assessor, who tests a sample of logs, inventories and visitor records	Recurring at each assessment	Number of facilities and sample sizes the assessor selects. Ask the assessor to explain its sampling approach before work starts.

Who owns physical access control and what a partner can take on

Your organization owns 03.10.07 in full. Under the requirement, you decide who may enter the facilities where systems with CUI reside, how entry and exit points are controlled, how visitors are escorted, and who holds keys, combinations and other access devices. Those decisions have to be made, approved and signed off by people accountable for the facility and the CUI, and the assessor will ask to see who made them. A partner can draft material for these decisions, but it cannot make them on your behalf.

Access decisions: Set the rules for who is authorized at each entry and exit point and who approves exceptions.
Physical controls: Choose and operate the badges, locks, guards, cameras or other mechanisms that enforce those rules.
Visitor and key handling: Assign escorts, define visitor conduct and own the key and combination register.
Output devices: Decide which printers, displays and other output devices sit in controlled areas.
Sign-off: Approve the procedures and accept the logs as the record of what happened.

Confirm that a named owner is accountable for each of these decisions and that the owner can show the approvals that were in place on the date of the assessment.

How self-hosted open-source tools support the access evidence

Can open-source tools produce physical access control evidence for 03.10.07?

Not the physical part. Badge readers, door controllers, turnstiles, locks, key cabinets and guard logs are physical access control systems, and the open-source tools in this section do not operate any of them. What they can supply is logical evidence tied to credential and access events, such as who was granted or changed an account or role, which is useful when a physical event has a digital counterpart. The assessor will still expect the physical access logs, visitor records and key inventories to come from the facility's own systems and procedures.

What does Nextcloud admin_audit record for access evidence?

The admin_audit app writes additional event information to an audit log, by default audit.log in the data directory, or to a path set with logfile_audit. For this requirement, that log can show administrative actions on user accounts, group membership and sharing settings, which can support questions about who was authorized to reach CUI held in the application. Confirm with the Nextcloud admin manual which events your version records, how the log is rotated, and whether it is forwarded to a protected central store. The log only reflects what happens inside Nextcloud, so it does not show someone walking through a door.

How does OpenBao audit logging protect sensitive values?

OpenBao audit devices keep a detailed JSON record of every API request and response, including errors. Most sensitive values in those records are hashed with HMAC-SHA256 rather than written in clear text, so the log can prove that a credential was requested or used without exposing the secret. This matters for evidence handling because the audit trail itself must not become a store of CUI or keys. Confirm which fields remain unhashed in your configuration, and restrict who can read the audit device output, since the file path and device settings are set by your administrators.

How do midPoint certification campaigns support periodic access review?

midPoint access certification campaigns assign designated reviewers who decide, within a set timeframe, whether to keep, change or revoke access items such as role assignments. The campaign record shows who reviewed each item and what they decided, which is the kind of evidence an assessor asks for when checking that authorizations are verified and removed when no longer needed. The same mechanism also helps counter access accumulation and supports segregation of duties. It covers identity and role decisions only, so it does not replace reviews of physical access lists or visitor logs.

Which licenses apply to Nextcloud, OpenBao and midPoint?

Nextcloud is licensed under AGPL-3.0-only, so modifications you distribute or make available to users over a network carry source-sharing obligations under that license. OpenBao is licensed under MPL-2.0, a file-level copyleft license that generally requires changes to covered files to be shared when distributed. midPoint is licensed under EUPL-1.2 or later. Have your legal team confirm how each license applies to your deployment, especially if you customize code, bundle components or offer the software to third parties. Licensing does not change the control obligations themselves.

Who sets up and runs these tools, and what does DeployOpen do?

Your organization owns its controls, its audit logs and its access decisions. DeployOpen can plan, implement, configure, harden, back up and document self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks, including audit logging settings and access certification workflows. DeployOpen prepares systems and evidence for an assessment, but it does not assess your environment or issue any report. Only an independent assessor can do that. Engagements are fixed-scope, so the systems, logs and campaigns to be configured are agreed in writing before work begins.

What should I ask for in a quote for logging and access review setup?

Ask for a written list of the systems in scope, the log sources to be configured and where they are stored, the retention and protection settings for audit data, and the access certification campaigns to be built, including reviewer roles and review cadence. Ask which work is one-time, such as initial configuration and documentation, and which recurs, such as log review, campaign runs, upgrades and retainer support. Confirm who holds administrator access to the log stores and whether the physical access logs from your facility systems will be connected or remain separate.

Where 03.10.07 assessments usually fail

Assessors testing 03.10.07 look for evidence that access is enforced at entry and exit points, not just written down. The gaps below recur because they sit in the handoffs between policy, facilities staff and the people who keep the logs. Check each one against your own facility before an assessor does.

Organization-defined parameters left unset

Rev. 3 expects the organization to assign values to any organization-defined parameters that the federal agency has not specified, and an assessor will check that those values are defined before testing the control. For 03.10.07, this means deciding in writing how access is verified, how long audit logs are kept and who may escort visitors. Confirm that each parameter has a value, an owner and an approval date, and that the system security plan states them.

Visitor logs without escort evidence

A visitor sign-in sheet shows who arrived, but not whether someone with authority escorted them or what they touched while inside. Assessors usually ask for the escort assignment, the visitor's path through the facility and proof that the escort stayed with the visitor. Illustrative check: pull five visitor entries at random and confirm each one links to a named escort and a badge or log event for exit.

Unmanaged keys and combinations

Keys, cards and door combinations often sit outside the access list, so a former employee may still hold a working credential. Assessors test whether an inventory exists, whether combinations change after staff leave and whether issued keys are returned and recorded. Ask facilities to reconcile the key inventory against the active personnel roster and record every combination change with a date and reason.

Output devices left uncontrolled

Printers, scanners and displays in a controlled area can expose CUI to anyone who walks past them. The requirement covers controlling physical access to output devices, so assessors look for placement decisions, locked output trays or badge-gated release, and a documented rule for who may stand near a screen showing CUI. Check the floor plan for printers near public corridors and confirm they are covered in the procedure.

Access logs that nobody reviews

Many organizations collect badge and door logs but never review them, so a tailgating event or a denied entry at 2 a.m. goes unnoticed. Assessors ask who reviews the logs, how often, and what they do with an anomaly. Keep a dated review record that names the reviewer, the period covered and any follow-up ticket, and make sure the log retention period is set as a defined parameter.

No Rev. 2 to Rev. 3 crosswalk for CMMC teams

Rev. 2 requirements 3.10.3, 3.10.4 and 3.10.5 covered visitor escort, physical access logs and access devices as separate items, and CMMC Level 2 still assesses those IDs. Rev. 3 folds them into 03.10.07, so the CMMC team and the Rev. 3 team can end up with different evidence sets. Build one crosswalk that points each Rev. 2 ID to the same evidence file, and confirm with the assessor which framework version applies to your contract.

Physical access control questions buyers ask before hiring help

How much effort does 03.10.07 physical access control take to implement?

Effort depends mainly on how many facilities hold systems that store or process CUI, how many entry and exit points each one has, and whether access control is already in place. Most of the work is documentation and process: a physical protection policy and procedures, a documented method for verifying authorizations at each entry point, visitor escort rules, and records for keys, combinations and access devices. The control also expects physical access control logs and an inventory of access control devices, so an organization with mature badge systems may need less build work than one relying on shared keys. Ask any partner to break its estimate down by facility, entry point and evidence artifact, because those are the units that change the quote.

Do we need an implementation partner for 03.10.07, or can we do it ourselves?

Many organizations can complete 03.10.07 internally if they already run facility security and have staff who can write procedures and maintain logs. A partner is most useful when the organization lacks someone who can map the requirement to its facilities, when several sites or a data center operator are involved, or when evidence must be assembled quickly for an assessment. Whichever path you choose, the organization owns the control. An implementation partner can prepare systems, procedures and evidence, but only an independent assessor issues the assessment results, and the Department of Defense's SPRS score is submitted by the organization itself.

How long does readiness for 03.10.07 take?

No supplied figure gives a duration for 03.10.07 readiness, so treat any number you hear as a claim to verify. The timeline depends on facility count, whether physical access badges and logs already exist, and how quickly facilities staff can approve procedures. Ask your assessor or the contracting officer which evidence they expect and how long they need to review it, then ask your partner to tie each deliverable to a written milestone in the statement of work. Fixed-scope engagements usually agree on dates before work starts, so the schedule should appear in the signed scope rather than in a verbal estimate.

What does 03.10.07 need from our facilities staff?

Facilities staff own most of the physical side of the control. They typically need to verify who is authorized at each entry and exit point, operate or review the access control system or guard post, collect and retain access logs, manage keys and combinations, and escort visitors. They also need to control physical access to output devices such as printers that may hold CUI. Plan time for facilities staff to review written procedures and walk through the evidence, because assessors interview the people who run these controls and compare what they say with the records.

Do security guards satisfy the 03.10.07 requirement on their own?

Guards can satisfy part of 03.10.07 because the requirement allows physical access control systems, devices or guards to enforce authorizations at entry and exit points. A guard alone is rarely enough, though. The organization must still verify authorizations, keep physical access audit logs, escort visitors and control their activity, secure keys and combinations, and control access to output devices. Document the guard's post orders, sign-in process, and log retention so an assessor can test them. Confirm with your assessor how they expect guard-based controls to be evidenced before you rely on them.

How do Rev. 2 and CMMC Level 2 treat the content of 03.10.07?

NIST withdrew Rev. 2 requirements 3.10.3, 3.10.4 and 3.10.5 and incorporated them into 03.10.07 in Rev. 3, so the content still exists but under a new requirement ID. NIST maps no Rev. 2 requirement directly to 03.10.07. CMMC Level 2 assesses the 110 Rev. 2 requirements, so it has no matching 03.10.07 identifier even though it covers the same subject through PE.L2-3.10.3, PE.L2-3.10.4 and PE.L2-3.10.5. Under 32 CFR 170.14(c)(3), CMMC Level 2 is identical to Rev. 2. Current DoD contract guidance also names Rev. 2 explicitly, so confirm which version your contract requires before you build evidence around one numbering scheme.

What should we ask for in a quote for 03.10.07 work?

Ask for a written scope that lists each facility in scope, the entry and exit points at each, the systems that store or process CUI, and the deliverables for each part of the control. Request separate line items for procedure writing, access control configuration, log set-up, evidence collection, staff training and any walkthrough support. Confirm whether the quote covers only preparation or also follow-up after the assessment. Ask who holds the artifacts at the end, because the organization must own its procedures and logs. Finally, check that the partner states it does not issue assessment results or certifications.

Where to read the requirement and assessment procedure

Start with the requirement itself. The NIST text for 03.10.07 Physical access control in SP 800-171 Rev. 3 is short, but it bundles five duties that Rev. 2 handled as separate requirements: verifying authorizations at entry and exit points, controlling ingress and egress, keeping physical access audit logs, escorting visitors, and securing keys, combinations and other access devices. It also covers controlling physical access to output devices. Read it alongside the NIST source controls it draws on, PE-3 and PE-5 in SP 800-53 Rev. 5, so your team understands the intent behind each duty before it writes a procedure.

Next, read the assessment procedure in SP 800-171A Rev. 3. It lists seven determination statements for 03.10.07 and names the examine, interview and test objects an assessor will look at, such as access control logs, inventories of access devices and entry and exit point records. Use that list as your evidence checklist. If a determination statement asks for something your facility cannot show, such as a log of visitor activity or a current inventory of keys and cards, that gap is the work to plan before any assessment.

Finally, confirm the organization-defined parameters before you rely on the text. Rev. 3 leaves certain values for the nonfederal organization to set when the federal agency does not specify them, and some of those values affect how often access lists are reviewed and how logs are checked. Ask the contracting agency in writing which ODP values it expects, and record your answers in the system security plan. Where the agency is silent, document the values you chose and the reason for them so an assessor can see the decision was deliberate.

How DeployOpen prepares physical access control evidence

DeployOpen plans, implements and documents the open-source platforms that record and enforce access in your own environment, and prepares the systems, logs and written procedures that 03.10.07 Physical access control asks an assessor to examine and test. DeployOpen does not assess your facilities or issue any assessment result; your organization owns the physical controls and an independent assessor reviews them.

How we scope

Engagements are fixed-scope, with the facilities, entry points and systems in scope agreed in writing before work starts.
The written scope lists which access logs, inventory records and output device controls fall under 03.10.07.
Scope names the people who hold physical access control responsibilities and who will be interviewed during assessment.

How we build

We configure audit logging for platforms that record access events, including the admin_audit app in Nextcloud where it is used.
We set up audit devices in OpenBao so that privileged access to systems tied to facility controls is logged with protected values.
We document the procedures for escorting visitors, securing keys and combinations, and controlling access to output devices.

How we hand over

Handover includes configuration records, log locations and retention settings so an assessor can examine them directly.
We deliver an inventory of physical access control devices and system entry and exit points, mapped to the requirement.
Documentation states which parts depend on your facility controls, such as badge systems or guards, and which are your responsibility to operate.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after handover.
Access reviews can be set up in midPoint as certification campaigns, with designated reviewers deciding to keep, change or revoke access.
Before any assessment, confirm with your assessor which evidence formats and sampling periods they will accept.