03.10.08 Access control for transmission: requirements

What 03.10.08 access control for transmission requires in plain terms

03.10.08 requires you to control physical access to the system distribution and transmission lines inside your facilities, such as the cabling, jacks and wiring closets that carry CUI-bearing traffic between systems. If a contract or assessment now asks for SP 800-171 Rev. 3, this requirement is new and has no Rev. 2 equivalent, so organizations that passed a Rev. 2 review cannot assume they already covered it. NIST's Rev. 3 discussion gives concrete examples of how to meet it: disconnected or locked spare jacks, locked wiring closets, cable conduit or trays, and sensors that detect wiretapping. The requirement is about who can physically reach the wire, not about the encryption running over it.

The risk is straightforward. Someone with brief physical access can tap a cable, splice in a monitoring device, or plug an unauthorized device into an active network segment in a wiring closet or an unused wall jack, and that activity may never appear in logs generated by the systems themselves. This is why the requirement is hard to satisfy in practice. Facility audits tend to focus on doors, badges and server rooms, while cabling runs through ceilings, risers and floors that nobody inventories. Ownership is split across IT networking, facilities management and whoever manages construction or tenant fit-outs, so no single team usually holds the full picture.

NIST lists PE-4 from SP 800-53 Rev. 5 as the source control for 03.10.08, which is a useful starting point for your own mapping work. Before an assessor arrives, confirm three things: where your distribution and transmission lines actually run within each in-scope facility, which spare jacks and closets are locked or disabled, and who is responsible for approving changes to cabling. Ask your facilities team and your network team to produce a single list of wiring closets and their locks, and check it against the physical access records you already keep for 03.10.01 and 03.10.07.

Which cabling, closets and facilities fall under 03.10.08

03.10.08 applies wherever distribution and transmission lines carry or connect system traffic inside your facilities. The cards below cover the scoping decisions that change the work, from the buildings and closets to the cabling and the parties who control access to them.

Facilities that house CUI systems

Start with every building, floor and room where a system that stores, processes or transmits CUI is located or where its cabling runs. The requirement applies within organizational facilities, so the first scoping decision is which sites count as organizational facilities for your CUI boundary. Document each site, its occupants and the systems inside it, and confirm the list against your system security plan and network diagrams before you define physical controls for the lines.

Data closets and wiring closets

Telecommunications rooms, data closets and wiring closets are where horizontal cabling terminates and patch panels concentrate traffic from many users. Treat each closet that serves a CUI system as in scope, and record who holds keys or badges to it. Confirm the locks, the door hardware and whether the closet is shared with other tenants or departments before you decide how access is restricted.

Spare jacks and unused ports

Unused wall jacks and open switch ports give an intruder a physical path onto the network even when no device is connected. NIST's discussion of 03.10.08 names disconnected or locked spare jacks as one way to control access to distribution lines. Inventory every active and spare jack in CUI areas, decide which will be disconnected, and confirm that the process for re-enabling a port requires an approved change.

Conduit, cable trays and riser paths

Much of the cabling you need to protect sits above ceilings, under raised floors or in shared risers, where it is not visible to people who only use the workspace. Map the routes from CUI systems to their closets and to the building entry points, then decide how each segment is protected, whether by locked conduit, enclosed trays or restricted ceiling access. Note any segment that leaves your control, because those routes need a different answer.

Shared and landlord-controlled buildings

In multi-tenant office buildings, the landlord or building manager often controls riser rooms, the main distribution frame and common ceilings. Your organization can only commit to controls it can enforce, so review your lease, facility agreements and building rules to see who holds keys and who approves access. Where the landlord holds control, record that arrangement and the controls it provides, and decide what you will verify yourself.

Colocation providers and building managers

When CUI systems sit in a colocation facility or a managed data center, the provider controls the physical layer and the cage or suite boundary. Ask the provider for its documented physical access procedures, its visitor and escort rules, and how it protects cross-connects and cabling that reach your equipment. Put these responsibilities in the written agreement, and confirm the provider's evidence with the auditor before you rely on it.

How an assessor tests 03.10.08 under SP 800-171A Rev. 3

This table breaks down how an assessor works through the single 03.10.08 determination statement, which assessment methods apply, and which objects they examine, interview or test. Use it to plan which documents, people and physical checks your organization should have ready before an assessment begins.

Assessment element	What the assessor does	Evidence to prepare	Where it usually fails
Determination statement	Confirms the organization controls physical access to distribution and transmission lines inside its facilities, using the examine, interview and test methods	A single statement to satisfy, covering cabling, jacks and wiring closets in every facility that houses the system	Assuming the requirement is covered by general facility access controls without addressing the cabling itself
Examine: physical protection policy and procedures	Reads the policy and procedures to see whether transmission line access control is addressed and assigned to a role	Approved policy and procedure documents with owners, review dates and approval records	Policy mentions physical security in general but never names cabling, jacks or wiring closets
Examine: procedures for access control for transmission mediums	Checks the operational procedure for how access to transmission mediums is restricted and monitored	Written procedure covering wiring closet keying, spare jack handling and conduit or tray protection	Procedure exists in draft or is not followed in practice
Examine: system design documentation	Compares the documented system layout with the physical paths of cabling and network distribution points	Network and cabling diagrams, floor plans marking wiring closets and distribution points, and asset records	Diagrams are outdated, omit patch panels or do not match the installed cabling
Interview: personnel with physical access control responsibilities	Asks facilities or security staff how they control access to closets, conduit and jacks, and how they respond to exceptions	Named roles, responsibilities and an explanation of routine checks	Staff describe the lock on the closet but not who holds keys or how keys are recorded
Interview: personnel with information security responsibilities	Asks security staff how they detect unauthorized access to transmission lines, such as tampering or wiretapping	Description of monitoring, alerting and response for transmission line incidents	Security staff are unaware that cabling access is in scope for the system
Test: processes for access control for distribution and transmission lines	Observes or samples the controls in place, such as locked closets, disconnected spare jacks and protected cable runs	Records of inspections, key or combination logs, and walk-through results for each in-scope facility	Unlocked wiring closets, undocumented spare jacks left live, or exposed cable runs in shared spaces

Implementing 03.10.08 in order, with the output of each step

This sequence moves from knowing where distribution and transmission lines run to a documented, walked-through set of controls that an assessor can trace back to the requirement. Each step produces a record the next step depends on.

Map distribution and transmission lines in scope
Start with floor plans, cabling records, patch panel inventories and wiring closet lists for every facility that houses systems with CUI. Trace which runs carry data between system components, from workstation outlets through riser cabling to server room distribution. The output is a line inventory that names each segment, its facility, its room and whether it is a distribution or transmission path. Confirm the list with the facilities team, because drawings often lag behind recent moves and fit-outs. The step is done when someone outside the project can pick any location on the floor plan and find its lines in the inventory.
Decide controls for each location
For each mapped location, choose the physical measure that limits access to the lines. Typical options are disconnecting or locking spare jacks, locking wiring closets, routing cable through conduit or trays that can be secured, and, where the risk justifies it, deploying sensors that detect wiretapping. Record the reasoning for each choice, including why a sensor is or is not used at a given site. The output is a control decision matrix tying each location to its measures and the residual risk accepted. Ask your risk owner to sign off on locations where you decide not to add a measure.
Define the physical protection policy and procedures
Write the policy and procedures that govern access to distribution and transmission lines, covering who may authorize changes to jacks, closets and conduit, how keys or combinations are issued and recorded, and how unused jacks are reactivated. Align the document with the physical protection controls that sit alongside 03.10.08 so that facility access rules and cabling rules do not conflict. The output is an approved, versioned document with an owner and a review date. Assessors will examine this document first, so confirm that it describes what the site actually does.
Assign ownership between facilities and IT
Split responsibility explicitly. Facilities teams often hold the keys, closets and building cabling, while IT owns the active network equipment and the jacks in use. Write a responsibility matrix that names an accountable person for each control in the decision matrix, plus a backup. Confirm that the people named know they hold the duty and have the access they need. The output is a signed responsibility matrix. Gaps tend to appear at shared spaces such as landlord-controlled risers, so record those explicitly.
Verify the controls with a physical walkthrough
Walk each in-scope location with the owners named in the matrix and compare what you find with the decision matrix and procedures. Check that spare jacks are disconnected or locked, that closets lock and that the lock is not propped open, that conduit and trays are closed, and that any sensors report to a monitored point. Photograph or log exceptions and assign remediation with a named owner. The output is a signed walkthrough record listing each location, the result and any open items. A finding that is not closed should appear in the plan of action and milestones rather than being quietly dropped.
Record the system design documentation
Update the system security plan and the system design documentation so they show where CUI-bearing transmission paths run, which facilities they cross and which controls protect them. Include the line inventory, decision matrix and responsibility matrix as referenced appendices. The output is a document set an assessor can follow from a requirement to a control, to an owner, to a physical location. Re-check the record after any cabling change, office move or new closet, since the documentation is only useful while it matches the building. Ask your assessor early which format they expect for the evidence package.

Evidence that passes a 03.10.08 review and how to keep it current

A 03.10.08 review tests whether physical access to distribution and transmission lines is actually controlled inside your facilities, so the evidence has to show both the design and the day-to-day practice. The cards below cover the artifacts assessors typically ask for, with a refresh habit for each so the package stays accurate between assessments.

Physical protection policy and procedures

This is the written statement of how your organization controls access to cabling, jacks, wiring closets and conduit. Assessors use it as the baseline for the examine and interview steps, so it should name the owners of the closets, the approved methods for securing spare jacks, and who approves exceptions. Check that the document names current roles, not former employees, and that the procedure matches what staff actually do when they open a closet. Review it at least once a year and after any facility move or reorganization.

Cabling and closet inventory

An inventory lists every wiring closet, patch panel, distribution run and active or spare jack in the facilities that handle CUI, with its location and the system it serves. Without it, you cannot show that every transmission path has a protection decision behind it. Tie each entry to a floor plan reference and a responsible owner. Reconcile the inventory against field walks and network port records whenever cabling changes, and keep a dated revision history.

Floor plans with protected paths

Marked floor plans show where distribution lines run through ceilings, risers, shafts and public corridors, and which segments are enclosed in conduit or trays. They let an assessor see whether protected paths cover the areas where unauthorized access is most plausible. Mark the locations of locked closets and any wiretapping sensors. Update the plans after every renovation or tenant change, and confirm that the version on file matches the building as it stands today.

Lock, key and badge records for closets

These records show who holds keys, combinations or badge rights to each wiring closet, when those rights were issued, and when they were removed. They are the evidence that closet access follows the same authorization discipline as the rest of the facility. Confirm that departing staff, contractors and vendors lose closet access as part of offboarding, and that key or combination changes are logged. Reconcile the holder list with the facility access list at the frequency your procedure sets.

Photos and inspection checklists

Dated photos and a short checklist from each closet inspection show the physical state of the controls: locked doors, sealed or disconnected spare jacks, intact conduit and trays, and no unauthorized equipment. Assessors often treat a recent, signed checklist as stronger evidence than a policy statement alone. Define the inspection frequency in your procedure, record exceptions with a corrective action and due date, and keep prior-cycle checklists so trends are visible.

Change records and tamper alerts

Change records document each jack, cable or closet modification, who approved it, and whether the protected state was restored. Where tamper or wiretap sensors are deployed, their alert logs and the response tickets show that someone reviewed and acted on them. Require a change ticket before any new jack is energized, and confirm that sensor logs are retained according to your records schedule. Test sensors on a defined cycle and keep the test results with the logs.

What meeting 03.10.08 costs in money and effort

This table breaks down the money and effort behind 03.10.08 by cost component, showing who is paid, whether the cost is one-time or recurring, and what drives it up. No supplied fact gives a price or duration, so use the right-hand column to build your own estimate and to ask vendors and contractors for written quotes.

Cost component	Who is paid or who does the work	One-time or recurring	What drives the cost
Locks, closet doors and access hardware	Locksmith, door hardware supplier or facilities contractor	One-time, with occasional replacement	Number of wiring closets, door type, and whether existing doors and locks can be reused
Spare jack protection (disconnected or locked jacks)	Facilities or network staff, or the cabling contractor	One-time, with ongoing changes as jacks are added	Count of user-accessible wall jacks and how often office moves happen
Conduit, cable trays and cable routing	Electrical or cabling contractor	One-time for new work, recurring when rerouting	Length of runs in shared or public areas and the amount of existing conduit that must be modified
Tamper or wiretapping sensors	Security integrator, sensor vendor and monitoring staff	One-time installation, recurring for monitoring and maintenance	Number of distribution points, whether alerts feed a monitored console, and integration with existing physical security systems
Engineering time to document cabling and design	Network engineers, cabling designers or an implementation partner	One-time, refreshed when the layout changes	Size of the cable plant, quality of existing drawings and how many systems share the distribution paths
Facilities labor for the walkthrough and fixes	Internal facilities staff or contractors	Recurring at the frequency the organization sets	Number of buildings and closets, and the number of findings from each walkthrough
Evidence upkeep (logs, photos, change records)	Internal compliance or IT staff	Recurring	How often jacks, closets and conduit change, and whether access records are kept in one place
External review of the physical walkthrough	Outside security consultant or implementation partner	Recurring if used, often before assessment	Scope of facilities covered and whether the review is a pre-assessment check or a full test
Independent assessor fees	Independent assessor or assessment firm	Recurring at each assessment cycle	Scope of the CUI environment, number of facilities, and how well evidence is prepared before the visit

Who owns 03.10.08 and what a partner can take on

Your organization owns requirement 03.10.08 and the decisions behind it. Facilities, IT and security staff decide which spaces hold distribution and transmission lines, who may enter the wiring closets and conduit routes, and what happens when a jack or cable run is found unexpectedly open. The policy and procedures that govern physical protection also remain yours, because the assessor will examine them as evidence that the control is operated and not just designed.

Policy and procedures: Maintain the physical protection policy and the procedure for access control for transmission mediums, and assign a named owner for each.
Facility decisions: Decide which closets, ceilings, raised floors and risers carry CUI-bearing lines, and who holds keys or badges to them.
Operational records: Keep access lists, lock and key logs, and inspection records current, since these are what an interviewee will point to.
Accountability: Assign personnel with physical access control responsibilities and personnel with information security responsibilities, and confirm both groups know their roles.
Compliance responsibility: Your organization is answerable to the federal agency that holds the contract, so any gap in the control is yours to fix.

Before engaging anyone, confirm internally who signs off on the system security plan entry for this requirement.

Where organizations usually fall short on 03.10.08

Most gaps under 03.10.08 come from assuming someone else's controls already cover the cabling, or from never writing down which cabling is in scope. The cards below cover the patterns assessors most often find, each with a closing action the team can take before an assessment.

Treating entry controls as coverage

Teams often point to 03.10.07 entry controls, such as badge readers and visitor escorts, as proof that cabling is protected. Those controls govern who enters the facility, not who can reach a patch panel or a jack once inside. 03.10.08 asks about access to the distribution and transmission lines themselves, so it needs its own design decision and its own evidence. Action: write a separate 03.10.08 statement that names the controls protecting lines inside the building, and cross-reference 03.10.07 only for the entry points.

Undocumented cabling after moves

Office moves, floor reconfigurations and new equipment often add runs and jacks that never reach the system design documentation. An assessor who samples a jack that no document describes will question whether any control applies to it. Spare jacks left live in unused rooms are a common example. Action: tie cabling changes to the existing change control process, and reconcile a walkthrough of jacks and closets against the diagrams once a year.

Shared buildings and closets

In multi-tenant buildings, wiring closets or risers may be controlled by the landlord or another tenant. The organization still owns the requirement for its own CUI lines, but it may not hold the keys or logs. Assessors will ask who can enter the closet that serves the CUI system. Action: confirm in writing with the building operator who controls each closet, what access is granted, and how the organization receives access records, or move the CUI system to space it controls.

Interview-level awareness gaps

Assessors test 03.10.08 through interviews as well as documents. Facilities staff, IT administrators and security staff must each be able to describe how cabling is protected and who to contact about a suspected tap or unlocked closet. When answers differ between groups, the finding often comes from the interview, not the policy. Action: brief the personnel with physical access control and information security responsibilities on the procedure, then ask each group to explain it in their own words during a dry run.

Undefined lines in scope

Rev. 3 introduced organization-defined parameters, and if the federal agency does not supply values, the nonfederal organization must set them. For 03.10.08, that means stating which distribution and transmission lines count as in scope, for example lines carrying CUI, lines between the CUI enclave and the rest of the network, or all lines in named rooms. Without that definition, the control cannot be tested consistently. Action: record the scope definition in the system security plan, get the contracting agency's view on any values it specifies, and list the closets and rooms it covers.

Why 03.10.08 has no CMMC Level 2 match and what that means for assessments

NIST maps no Rev. 2 requirement to 03.10.08, so the requirement has no matching ID in CMMC Level 2, which assesses the 110 Rev. 2 requirements. Rev. 3 introduced 03.10.08 as one of 19 new requirements, and the Rev. 2 to Rev. 3 change analysis shows nothing on the Rev. 2 side that it replaces. The practical result is that an assessor working from the Rev. 2 baseline has no line item that asks whether physical access to cabling, jacks and wiring closets is controlled. Physical protection in Rev. 2 focuses on the facility, the equipment and the people who enter it, so transmission lines can fall outside what a Rev. 2 assessment examines directly.

That gap does not mean the work can be skipped. The current DFARS 252.204-7012 path names SP 800-171 Revision 2 explicitly, and a DoW class deviation issued in September 2026 keeps contracting officers on that revision while CMMC Phase 2 is suspended. A FAR overhaul proposed rule would instead require Rev. 3 with organization-defined parameter values published by the DoW CIO, but it was not final as of October 2026. Confirm with your contracting officer which revision governs each contract, whether any task order or subcontract specifies a different one, and whether the agency has published ODP values you must follow. Get that answer in writing, because it determines whether 03.10.08 is assessed at all.

Plan for Rev. 3 now even if your current contract is assessed against Rev. 2. Inventory the spare jacks, wiring closets, conduit and trays, and any wiretapping-sensor coverage in each facility that handles CUI, and record who holds keys or badges to those spaces. Keep the system design documentation and the physical protection procedures that the Rev. 3 assessment objects call for, so the evidence exists when a Rev. 3 requirement arrives. Ask your assessor or contracting officer whether a Rev. 2 assessment will consider these controls voluntarily, and document the answer so the decision is traceable.

Questions buyers ask about 03.10.08 cost, effort and outside help

What does 03.10.08 require from our own team before a partner can help?

Your team owns the physical environment and the decisions about it, so the work starts with knowing where your distribution and transmission lines actually run. Someone must be able to show the cabling paths, patch panels, jacks, wiring closets and conduit or trays inside each facility in scope, and say who holds keys or badge rights to each closet. Your facilities or building management staff usually confirm which spaces are owned, leased or shared with other tenants, because shared risers and closets change the control design. Security and IT staff must agree on who reviews access to these spaces and how that review is recorded. Expect to provide system design documentation and your physical protection policy and procedures, since an assessor will examine both.

Can our own staff implement 03.10.08 without an outside partner?

Often yes, provided your staff can perform the physical work and produce the evidence an assessor will test. Locking unused jacks, securing wiring closets, routing cable through conduit or trays and installing wiretapping sensors are tasks that facilities, network and security teams commonly handle, but they need documented procedures and an accountable owner. A partner can help when the scope is large, when several sites must be made consistent, or when your team lacks time to write the procedures and collect records. Whichever route you choose, the organization owns the control and the evidence. Confirm your own capacity and any contractor rules at each facility before you decide.

What drives the cost of meeting 03.10.08 up or down?

The cost depends mostly on how many facilities, closets and distribution points are in scope and how much of the physical plant is already controlled. Costs rise when wiring closets lack locks, when spare jacks are live and unlabeled, when cabling runs through shared or uncontrolled spaces, or when several sites use different practices. Costs fall when closets already use keyed or badge access, when unused ports can be disabled, and when the environment is documented. Some costs are one-time, such as hardware, locks, sensors and conduit work. Others recur, such as access reviews, log checks and periodic re-verification. In a quote, ask the provider to separate labor, materials, documentation and recurring review effort, and to list each facility and closet in scope.

How long does it take to be ready for an assessment on 03.10.08?

Readiness time is driven by the state of your facilities and documentation, not by a fixed period. The main drivers are how many sites and closets are in scope, whether physical changes such as new locks, conduit or sensors need procurement or building work, and how long it takes to write and approve the physical protection procedures. Landlord approvals and shared-building rules can add time that is outside your control. Because 03.10.08 is a new requirement in Rev. 3, some organizations also need to decide how it fits their existing SP 800-171 system security plan. Ask any provider for a written schedule tied to the agreed scope and to each dependency, and confirm which milestones depend on your facilities team.

Will an assessor physically test our cabling and wiring closets under 03.10.08?

An assessor is likely to examine and interview rather than rely only on a walk-through, and may test the controls in place. SP 800-171A Rev. 3 gives one determination statement for 03.10.08 using examine, interview and test methods. Examine objects include the physical protection policy, procedures for access control for transmission mediums and system design documentation. Interview objects include people responsible for physical access control and for information security. Test objects cover the processes for controlling access to distribution and transmission lines. In practice, expect to show how closets are locked, who holds access, how spare jacks are disabled or secured, and how the process works when someone asks to enter. Confirm with your assessor which samples and locations they will select.

What can a partner not do for us when it comes to 03.10.08?

A partner cannot issue the assessment result. Only the federal agency with the contract, or the assessor it engages, determines compliance, and the score recorded in SPRS is a matter for your organization to keep accurate. A partner can plan the controls, prepare or harden the physical environment where it is in scope, write procedures, collect evidence and prepare your team for questions. It cannot accept ownership of the control on your behalf, decide which facilities fall within the CUI boundary without your input, or promise that an assessor will find the controls sufficient. Your organization keeps responsibility for the controls and their ongoing operation after the engagement ends.

Does 03.10.08 have a Rev. 2 equivalent that our existing controls already satisfy?

No. NIST's change analysis lists 03.10.08 as one of 19 requirements new in Rev. 3, and maps no Rev. 2 requirement to it. Work already done for CMMC Level 2 or Rev. 2 physical protection may still help, because access controls at entry points and visitor controls overlap in practice, but that overlap does not remove the need to address transmission lines explicitly. Ask your contracting officer which revision applies to your contract before you scope the work, since the answer determines whether this requirement is assessed at all.

How DeployOpen prepares 03.10.08 evidence for your assessment

DeployOpen plans, implements and documents self-hosted open-source platforms inside your own facilities and infrastructure, and prepares the physical and technical evidence that 03.10.08 Access control for transmission calls for. We do not issue assessment results; your independent assessor tests the requirement and reaches its own conclusion.

How we scope

We agree a written scope listing which facilities, wiring closets, jacks and transmission paths fall under 03.10.08.
We map the distribution and transmission lines that carry CUI to the system boundary and system design documentation.
We confirm with your assessor which examine, interview and test objects they expect to see for this requirement before work starts.

How we build

We help define the physical protection policy and access control procedures for transmission mediums that your organization owns and approves.
We document controls such as disconnected or locked spare jacks, locked wiring closets, cable conduit or trays and wiretapping sensors where your facilities need them.
We test that access restrictions on distribution and transmission lines work as written and record the results in a form your assessor can examine.

How we hand over

We deliver the policy, procedures, system design documentation and test records as organized evidence packages, mapped to the 03.10.08 assessment objects.
We train the personnel who hold physical access control and information security responsibilities so they can explain the controls to an interviewer.
We provide a handover session with a written list of open items, owners and any gaps your organization must close before assessment.

How we support

Ongoing support, upgrades and continuous testing for the 03.10.08 controls are available as a retainer after handover.
We can update the evidence when wiring closets, jacks or transmission paths change, so records stay current for your assessor.
Before your assessment, confirm with your assessor and your contracting authority which version of SP 800-171 applies to your contract.