NIST 800-171 3.10.5 (PE.L2-3.10.5): Physical Access Devices
Control and manage physical access devices.
CMMC Level 2 practice PE.L2-3.10.5
What 3.10.5 means in practice
Keys, locks, combinations and badge readers are inventoried and managed: issued to named people, collected when no longer needed, and changed or rekeyed when one is lost or its holder leaves. A master key nobody can account for, or a door code that never changes, undoes the rest of physical protection.
SPRS points and the CMMC POA&M
- CMMC Level 2 practice
- PE.L2-3.10.5
- SPRS points
- 1 point. When it is not met, the DoD Assessment Methodology subtracts 1 from the score of 110.
- CMMC POA&M
- Never. 32 CFR 170.21(a)(2)(iii) names 3.10.5 among the 6 requirements a CMMC POA&M may never include, whatever their point value.
Sources: NIST SP 800-171 DoD Assessment Methodology, version 1.2.1 (June 24, 2020), Annex A; 32 CFR 170.21, Plan of Action and Milestones requirements.
What an assessor checks for 3.10.5
NIST SP 800-171A gives 3 determination statements for 3.10.5, each found satisfied or other than satisfied. Determine if:
- 3.10.5[a] physical access devices are identified.
- 3.10.5[b] physical access devices are controlled.
- 3.10.5[c] physical access devices are managed.
NIST SP 800-171A (June 2018), assessment objectives for 3.10.5
Evidence that shows 3.10.5 is met
- An inventory of keys, badges and combinations, and who holds each.
- Records of devices collected when people left.
- Records of locks rekeyed or combinations changed after a loss or a departure.
How PolicyCortex gathers the evidence
No PolicyCortex collector reads the evidence for 3.10.5. Your team provides the evidence listed above.
Meet the requirement once. Keep the evidence current.
- Published
- Last updated
- Unchanged since publication