NIST 800-171 3.10.2 (PE.L2-3.10.2): Facility Monitoring
Protect and monitor the physical facility and support infrastructure for organizational systems.
CMMC Level 2 practice PE.L2-3.10.2
What 3.10.2 means in practice
Protect the building and the support infrastructure that keeps the systems running (power, cooling, cabling) and watch them with guards, alarms, cameras or sensors. Monitoring means someone is alerted and responds, not only that a camera records.
SPRS points and the CMMC POA&M
- CMMC Level 2 practice
- PE.L2-3.10.2
- SPRS points
- 5 points. When it is not met, the DoD Assessment Methodology subtracts 5 from the score of 110.
- CMMC POA&M
- Not allowed. It is worth 5 points, and 32 CFR 170.21(a)(2)(ii) admits only requirements worth 1 point, with one exception: 3.13.11 when encryption is used but not FIPS validated.
Sources: NIST SP 800-171 DoD Assessment Methodology, version 1.2.1 (June 24, 2020), Annex A; 32 CFR 170.21, Plan of Action and Milestones requirements.
What an assessor checks for 3.10.2
NIST SP 800-171A gives 4 determination statements for 3.10.2, each found satisfied or other than satisfied. Determine if:
- 3.10.2[a] the physical facility where organizational systems reside is protected.
- 3.10.2[b] the support infrastructure for organizational systems is protected.
- 3.10.2[c] the physical facility where organizational systems reside is monitored.
- 3.10.2[d] the support infrastructure for organizational systems is monitored.
NIST SP 800-171A (June 2018), assessment objectives for 3.10.2
Evidence that shows 3.10.2 is met
- Protection measures for the spaces and support infrastructure that serve the system.
- Alarm, camera or guard monitoring records, and how alerts are answered.
- Alarm response or physical security incident logs.
How PolicyCortex gathers the evidence
No PolicyCortex collector reads the evidence for 3.10.2. Your team provides the evidence listed above.
Meet the requirement once. Keep the evidence current.
- Published
- Last updated
- Unchanged since publication