Example, read only. A sample company whose own team runs its CMMC program here, reviewed by a credentialed officer and kept current.
PE.L1-3.10.4 · FAR 52.204-21 (b)(1)(ix), audit log clause · NIST SP 800-171 3.10.4 · 3 controls rolled up
Physical Access Logs
Maintain audit logs of physical access
Reviewed by a credentialed officer on June 12, 2026. The officer advises and never signs; this corroborates your own self assessment and certifies nothing. The finding, and the affirmation, stay yours.
Who is accountable for this safeguard
They get the reminder when this evidence goes stale. Carries into next year's cycle.
What it means
Keep a record (sign-in sheet, keycard log, or camera clips) of who came in and when.
Why it matters
You don't need an enterprise badge system, a notebook at the front door works. What matters is that a record exists and is retained long enough to investigate if something walks off.
The proof on file
- Visitor logFrom your registers · June 2, 2026On file
The narrative on file
The visitor log at the front desk records the name, company, date, time in, time out, and host for every visitor. The owner reviews it monthly and retains it as an audit record.
You answer in plain English. Charlie drafts the narrative for your System Security Plan, and you confirm it.
What makes it pass
- Visitor log shows multiple recent entries spread across at least a few weeks (not blank, not all from one day)
- Each entry has: date, name, company, time-in, time-out, escort
- Retention rule referenced (one year minimum)
- For badge-system path: exported access events covering the last 30 days
Assessment objectives, NIST SP 800-171A
The team at Cedar Ridge Machine Works, LLC confirmed this safeguard MET. The evidence above is a living document: refresh rosters, devices, and accounts whenever the business changes and the safeguard stays current. The single signature happens in Attest & file, once all 17 are met.
Next safeguard →Need the exact clicks?Keycard / badge system with tenant integration, step by step
- 1If your physical access system is integrated with Entra/AD, export the last 30 days of access events
- 2Screenshot the export and store it with the evidence pack
Capture: Exported access-event report (CSV or PDF) plus a screenshot confirming origin.
This is one of 17
Answer in plain English, file the proof, confirm it MET.
The team at Cedar Ridge Machine Works, LLC walked all 17 the same way. The platform explains each one in plain English and tells you what proof to grab or pulls it from Microsoft 365, Charlie drafts the paperwork with you, a credentialed officer reviews it, and your team confirms each one MET. The self assessment stays your act. Start free for 30 days, no credit card, or book a free advisory call if you would rather talk it through first.