Manage Physical Access
Control and manage physical access devices.
What an assessor scores, the objectives
PE.L2-3.10.5 is met only when every one of these 3 objectives, from NIST SP 800-171A, is satisfied. A single missed objective makes the whole requirement not met.
- a.physical access devices are identified
- b.physical access devices are controlled
- c.physical access devices are managed
How a C3PAO checks it
NIST SP 800-171A defines three assessment methods. For PE.L2-3.10.5, an assessor uses these:
Physical and environmental protection policy; procedures addressing physical access control; system security plan; physical access control logs or records; inventory records of physical access control devices; system entry and exit points; records of key and lock combination changes; storage locations for physical access control devices; physical access control devices; list of security safeguards controlling access to designated publicly accessible areas within facility; other relevant documents or records
Personnel with physical access control responsibilities; personnel with information security responsibilities
Organizational processes for physical access control; mechanisms supporting or implementing physical access control; physical access control devices
What it means, in context
Physical access devices include keys, locks, combinations, and card readers.
Identifying and c ontrolling physical ac cess devices (e.g., locks, badges, key cards) is just as important as monitoring and limiting who is able to physically access certain equipment. Physical access devices are only strong protection if you know who has them and what access they allow. Physical access devices can be managed using manual or automatic processes such a list of who is assigned what key, or updating the badge access system as personnel change roles. Example You are a facility manager. A team member retired today and returns their company keys to you. The project on which they were working requires access to areas that contain equipment with CUI. You receive the keys, check your electronic records against the seria l numbers on the keys to ensure all have been returned, and mark each key returned [c]. Potential Assessment Considerations • Are lists or inventories of physical access devices maintained (e.g., keys, facility badges, key cards) [a]? • Is access to physical access devices limited (e.g., granted to, and accessible only by, authorized individuals) [b]? • Are physical access devices managed (e.g., revoking key card access when necessary, changing locks as needed, maintaining access control devices and systems) [c]?
What passing evidence looks like
Control of physical access devices: who holds keys, badges, and codes, in a tracked list, with recovery on departure and code changes when someone leaves. This requirement can never sit on a POA&M.
Common ways contractors fail PE.L2-3.10.5
- !POA&M blocked: must be MET on assessment day.
- !The keypad code that has not changed since 2019 and is known by two ex employees is the finding. Change it, record the date, and tie code changes to offboarding.
The step by step walkthrough for Microsoft 365 GCC High, Google Workspace, and on premises setups, plus the exact evidence to capture, lives inside the Level 2 Accelerator.
Prove PE.L2-3.10.5, and the other 109
The Level 2 Accelerator walks all 110 requirements with you, generates your SSP, POA&M, and Audit Room from real evidence, includes the full Level 1 platform, and puts a credentialed officer alongside you for 180 days. Filed in 180 days, or we work free until you are.
No credit card. Phase 2 begins Nov 10, 2026, when applicable DoD solicitations start requiring a current Level 2 status to win the award.
PE.L2-3.10.5 questions, answered
How many points is CMMC requirement PE.L2-3.10.5 worth?+
PE.L2-3.10.5 is worth 1 point in the CMMC Level 2 score under 32 CFR 170.24. If it is not met, you lose 1 from your total of 110.
Can PE.L2-3.10.5 be placed on a POA&M?+
No. PE.L2-3.10.5 must be fully met before you can file. It cannot be deferred to a POA&M, so it is a gate on your assessment.
What family does PE.L2-3.10.5 belong to?+
PE.L2-3.10.5 is in the Physical Protection (PE) family, one of the 14 families of NIST SP 800-171 that make up CMMC Level 2.
- NIST SP 800-171 Rev. 2 3.10.5
- FAR Clause 52.204-21 Partial b.1.ix