NIST 800-171 3.10.4 (PE.L2-3.10.4): Physical Access Logs
Maintain audit logs of physical access.
CMMC Level 2 practice PE.L2-3.10.4
What 3.10.4 means in practice
Keep a record of who entered controlled areas and when. It can be electronic, such as badge reader logs, or a written entry log, as long as it is kept and can be reviewed.
SPRS points and the CMMC POA&M
- CMMC Level 2 practice
- PE.L2-3.10.4
- SPRS points
- 1 point. When it is not met, the DoD Assessment Methodology subtracts 1 from the score of 110.
- CMMC POA&M
- Never. 32 CFR 170.21(a)(2)(iii) names 3.10.4 among the 6 requirements a CMMC POA&M may never include, whatever their point value.
Sources: NIST SP 800-171 DoD Assessment Methodology, version 1.2.1 (June 24, 2020), Annex A; 32 CFR 170.21, Plan of Action and Milestones requirements.
What an assessor checks for 3.10.4
NIST SP 800-171A gives one determination statement for 3.10.4.
Determine if audit logs of physical access are maintained.
NIST SP 800-171A (June 2018), assessment objectives for 3.10.4
Evidence that shows 3.10.4 is met
- Badge reader access logs for controlled areas.
- Written entry logs, where they are used.
- The retention period for physical access logs, and a sample covering it.
How PolicyCortex gathers the evidence
No PolicyCortex collector reads the evidence for 3.10.4. Your team provides the evidence listed above.
Meet the requirement once. Keep the evidence current.
- Published
- Last updated
- Unchanged since publication