Example, read only. A sample company whose own team runs its CMMC program here, reviewed by a credentialed officer and kept current.
PE.L1-3.10.1 · FAR 52.204-21 (b)(1)(viii) · NIST SP 800-171 3.10.1
Limit Physical Access
Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals
Reviewed by a credentialed officer on June 12, 2026. The officer advises and never signs; this corroborates your own self assessment and certifies nothing. The finding, and the affirmation, stay yours.
Who is accountable for this safeguard
They get the reminder when this evidence goes stale. Carries into next year's cycle.
What it means
Only approved people can walk up to the computer, server, or file cabinet that holds contract info. Locked doors, keycards, or a locked office count.
Why it matters
For service-trade contractors this is usually the easiest control, a locked office plus a written list of who has keys is often all that's needed. Don't overthink it.
The proof on file
- Physical Protection Policy (Policy Center)From your Policy Center · May 20, 2026On file
The narrative on file
The office and server closet are locked, and only the owner and office admin hold keys. Workstations are in the controlled office area, not the open shop floor. The visitor policy keeps non employees out of areas where FCI is worked.
You answer in plain English. Charlie drafts the narrative for your System Security Plan, and you confirm it.
What makes it pass
- Photo clearly shows the locked door, cabinet, or storage with the lock visible
- A signed roster lists every authorized person, the space they can access, and the date authorized
- Home offices and vehicles used for FCI work are included in the roster
- Owner signature and date
Assessment objectives, NIST SP 800-171A
The team at Cedar Ridge Machine Works, LLC confirmed this safeguard MET. The evidence above is a living document: refresh rosters, devices, and accounts whenever the business changes and the safeguard stays current. The single signature happens in Attest & file, once all 17 are met.
Next safeguard →Need the exact clicks?Any business, step by step
- 1Walk through every space where contract info is handled, offices, vehicles, storage rooms
- 2Confirm the space can be locked (door lock, keycard, locked cabinet)
- 3Write a one-page list: who has a key or code, when they got it, when they last returned it
- 4Take a clear photo of the locked door or cabinet, and upload the signed key-holder list
Capture: Photo of the locked space (door closed, lock visible) + signed key/access list (PDF or photo).
This is one of 17
Answer in plain English, file the proof, confirm it MET.
The team at Cedar Ridge Machine Works, LLC walked all 17 the same way. The platform explains each one in plain English and tells you what proof to grab or pulls it from Microsoft 365, Charlie drafts the paperwork with you, a credentialed officer reviews it, and your team confirms each one MET. The self assessment stays your act. Start free for 30 days, no credit card, or book a free advisory call if you would rather talk it through first.