Example, read only. A sample company whose own team runs its CMMC program here, reviewed by a credentialed officer and kept current.
PE.L1-3.10.5 · FAR 52.204-21 (b)(1)(ix), access device clause · NIST SP 800-171 3.10.5 · 3 controls rolled up
Manage Physical Access
Control and manage physical access devices
Reviewed by a credentialed officer on June 12, 2026. The officer advises and never signs; this corroborates your own self assessment and certifies nothing. The finding, and the affirmation, stay yours.
Who is accountable for this safeguard
They get the reminder when this evidence goes stale. Carries into next year's cycle.
What it means
Know where every key, keycard, fob, and access code is, who has it, and take it back when someone leaves.
Why it matters
Keys, fobs, and door codes need to come back when someone leaves. A spreadsheet of who has what, reviewed at termination, is the control, no hardware investment required.
The proof on file
- Key and badge registerFrom your registers · June 2, 2026On file
The narrative on file
Physical keys are issued only to the owner and office admin and are tracked on the key and badge register. The alarm code is changed when anyone with access leaves. Building access devices are limited to the two named staff.
You answer in plain English. Charlie drafts the narrative for your System Security Plan, and you confirm it.
What makes it pass
- Register lists every key, fob, keycard, and door code with holder name
- Issued date and (where applicable) returned date are filled in
- Offboarding checklist references key/fob/code recovery and is signed
- Code rotations are noted when a holder departs
Assessment objectives, NIST SP 800-171A
The team at Cedar Ridge Machine Works, LLC confirmed this safeguard MET. The evidence above is a living document: refresh rosters, devices, and accounts whenever the business changes and the safeguard stays current. The single signature happens in Attest & file, once all 17 are met.
Next safeguard →Need the exact clicks?Any business, step by step
- 1Maintain an Access Device Register: device ID (key #, fob serial, door code label), holder name, issued date, returned date
- 2Add key/fob/code recovery to your personnel offboarding checklist
- 3Rotate door codes immediately when a holder departs
- 4Owner signs the register and the offboarding checklist
Capture: Signed register + signed offboarding checklist (photo or PDF).
This is one of 17
Answer in plain English, file the proof, confirm it MET.
The team at Cedar Ridge Machine Works, LLC walked all 17 the same way. The platform explains each one in plain English and tells you what proof to grab or pulls it from Microsoft 365, Charlie drafts the paperwork with you, a credentialed officer reviews it, and your team confirms each one MET. The self assessment stays your act. Start free for 30 days, no credit card, or book a free advisory call if you would rather talk it through first.