Physical Protection
Physical Protection is the locks, badges, escorts, and monitoring that keep unauthorized people away from the systems and media that hold CUI. Strong digital controls mean little if anyone can walk up to the server.
The 6 Physical Protection requirements
16 assessment objectives across this family.
- 3.10.1Limit Physical AccessLimit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.5 pt✕ POA&M
- 3.10.2Monitor FacilityProtect and monitor the physical facility and support infrastructure for organizational systems.5 pt✕ POA&M
- 3.10.3Escort VisitorsEscort visitors and monitor visitor activity.1 pt✕ POA&M
- 3.10.4Physical Access LogsMaintain audit logs of physical access.1 pt✕ POA&M
- 3.10.5Manage Physical AccessControl and manage physical access devices.1 pt✕ POA&M
- 3.10.6Alternative Work SitesEnforce safeguarding measures for CUI at alternate work sites.1 pt
Build Physical Protection, and all 14 families, with an officer
The Level 2 workspace walks your team through all 110 requirements at the objective level, drafts your SSP section by section from your own record for your team to read and accept, gives a prime or your own internal auditor a read only seat on the same record, and a credentialed officer reviews every step.
Book a free advisory callNo credit card, and Level 1 and Level 2 are both open, so sign up for the level your contracts call for. Self assessed and self attested: you score yourself in SPRS on a three year cycle and your senior official affirms it every year. As of September 3, 2026 a class deviation directs contracting officers to remove third party assessment from contracts. The program rule still provides for it, so your solicitation sets the track. Your team builds the same evidence either way. DFARS 252.204-7012 is unaffected, and the NIST SP 800-171 Rev 2 baseline is unchanged.
Questions, answered
How many CMMC Level 2 requirements are in Physical Protection?+
The Physical Protection family (PE) has 6 of the 110 CMMC Level 2 requirements, assessed against 16 objectives from NIST SP 800-171A.
What is the Physical Protection family about?+
Physical Protection is the locks, badges, escorts, and monitoring that keep unauthorized people away from the systems and media that hold CUI. Strong digital controls mean little if anyone can walk up to the server.