NIST 800-171 3.10 Physical Protection
Physical Protection limits who can physically reach systems and equipment, protects and watches the facility, escorts visitors, keeps physical access logs, manages keys and badges, and carries safeguards to alternate work sites such as home offices.
6 requirementsup to 14 SPRS points1 can go on a CMMC POA&M
The 6 Physical Protection requirements
- 3.10.1 Physical AccessPE.L2-3.10.1Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.
- 3.10.2 Facility MonitoringPE.L2-3.10.2Protect and monitor the physical facility and support infrastructure for organizational systems.
- 3.10.3 Visitor EscortPE.L2-3.10.3Escort visitors and monitor visitor activity.
- 3.10.4 Physical Access LogsPE.L2-3.10.4Maintain audit logs of physical access.
- 3.10.5 Physical Access DevicesPE.L2-3.10.5Control and manage physical access devices.
- 3.10.6 Alternate Work SitesPE.L2-3.10.6Enforce safeguarding measures for CUI at alternate work sites.
Physical Protection: points and the CMMC POA&M
- Q-01
How many SPRS points can the Physical Protection family cost?
Up to 14 of the 313 points a score can lose: 2 worth 5 points and 4 worth 1.
- Q-02
Which Physical Protection requirements can go on a CMMC POA&M?
1 of the 6: 3.10.6, worth 1 point. 3.10.3, 3.10.4 and 3.10.5 are never allowed, whatever the value (32 CFR 170.21(a)(2)(iii)). The others are worth more than 1 point, which 32 CFR 170.21(a)(2)(ii) does not admit. The score must also be at least 88.
Know the family. Keep the evidence for every requirement in it.
- Published
- Last updated
- Unchanged since publication