---
title: "NIST 800-171 3.10 Physical Protection"
description: "The 6 NIST SP 800-171 Physical Protection requirements (3.10, CMMC PE): text, SPRS points, POA&M rules and evidence."
url: https://policycortex.com/nist-800-171/physical-protection
sealed: 2026-11-11
amended: 2026-11-11
register: nist-800-171/physical-protection
records: 4
digest: sha3:941c4c8de8ebad181ea08440dc23a792d133a79642a49ef0d4108062001a5b7a
---

# NIST 800-171 3.10 Physical Protection

NIST 800-171 / Physical Protection

Physical Protection limits who can physically reach systems and equipment, protects and watches the facility, escorts visitors, keeps physical access logs, manages keys and badges, and carries safeguards to alternate work sites such as home offices.

6 requirements · up to 14 SPRS points · 1 can go on a CMMC POA&M

## The 6 Physical Protection requirements

| Requirement | CMMC practice | SPRS points | Requirement text |
|---|---|---|---|
| [3.10.1 Physical Access](https://policycortex.com/nist-800-171/physical-protection/3.10.1) | PE.L2-3.10.1 | 5 points | Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals. |
| [3.10.2 Facility Monitoring](https://policycortex.com/nist-800-171/physical-protection/3.10.2) | PE.L2-3.10.2 | 5 points | Protect and monitor the physical facility and support infrastructure for organizational systems. |
| [3.10.3 Visitor Escort](https://policycortex.com/nist-800-171/physical-protection/3.10.3) | PE.L2-3.10.3 | 1 point | Escort visitors and monitor visitor activity. |
| [3.10.4 Physical Access Logs](https://policycortex.com/nist-800-171/physical-protection/3.10.4) | PE.L2-3.10.4 | 1 point | Maintain audit logs of physical access. |
| [3.10.5 Physical Access Devices](https://policycortex.com/nist-800-171/physical-protection/3.10.5) | PE.L2-3.10.5 | 1 point | Control and manage physical access devices. |
| [3.10.6 Alternate Work Sites](https://policycortex.com/nist-800-171/physical-protection/3.10.6) | PE.L2-3.10.6 | 1 point | Enforce safeguarding measures for CUI at alternate work sites. |

## Physical Protection: points and the CMMC POA&M

**Q: How many SPRS points can the Physical Protection family cost?**
A: Up to 14 of the 313 points a score can lose: 2 worth 5 points and 4 worth 1.

**Q: Which Physical Protection requirements can go on a CMMC POA&M?**
A: 1 of the 6: 3.10.6, worth 1 point. 3.10.3, 3.10.4 and 3.10.5 are never allowed, whatever the value (32 CFR 170.21(a)(2)(iii)). The others are worth more than 1 point, which 32 CFR 170.21(a)(2)(ii) does not admit. The score must also be at least 88.

## Related pages

- **Calculator**: [SPRS score calculator: mark the Physical Protection requirements and see what they cost.](https://policycortex.com/sprs-score-calculator#family-PE)
- **Sample package**: [Sample package: an SSP, a POA&M and an evidence chain the product generated from demonstration data.](https://policycortex.com/sample-package)
- **Previous family**: [3.9 Personnel Security](https://policycortex.com/nist-800-171/personnel-security)
- **Next family**: [3.11 Risk Assessment](https://policycortex.com/nist-800-171/risk-assessment)
- **All requirements**: [All 110 NIST SP 800-171 requirements, by family.](https://policycortex.com/nist-800-171)

Know the family. Keep the evidence for every requirement in it. [Request Access](https://app.policycortex.com/auth?mode=request-access) · [Book a call](https://policycortex.com/book)

## Register colophon

| Seq | Label | SHA3-256 | Prev |
|---|---|---|---|
| REC 0000 | FAMILY | b4709473ab32 | f93713f4c04a |
| REC 0001 | REQUIREMENTS | bb02ad855f7a | b4709473ab32 |
| REC 0002 | POINTS AND POA&M | 917864a8535a | bb02ad855f7a |
| REC 0003 | RELATED | 941c4c8de8eb | 917864a8535a |

Head sha3:941c4c8de8ebad181ea08440dc23a792d133a79642a49ef0d4108062001a5b7a. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.