Practice PE.L2-3.10.5 Details - Revision history

David at 00:30, 16 March 2025

2025-03-16T00:30:13Z

← Older revision		Revision as of 00:30, 16 March 2025
Line 1:		Line 1:
	'''Source of Reference: The official [https://~~www~~.~~acq~~.~~osd.mil~~/cmmc/~~documentation.html~~ CMMC Level ~~1 Self-~~Assessment Guide] from the ~~Office of the Under Secretary~~ of Defense ~~Acquisition & Sustainment~~.'''		'''Source of Reference: The official [https://dodcio.defense.gov/cmmc/Resources-Documentation/ CMMC Level 2 Assessment Guide] from the Department of Defense Chief Information Officer (DoD CIO).'''

	For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.		For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.

	== PE.L1-3.10.5 – MANAGE PHYSICAL ACCESS ==		== PE.L2-3.10.5 – MANAGE PHYSICAL ACCESS ==
			Level 1 Reference: PE.L1-b.1.ix
	=== SECURITY REQUIREMENT ===		=== SECURITY REQUIREMENT ===
	Control and manage physical access devices.		Control and manage physical access devices.
Line 14:		Line 15:
	'''Examine'''		'''Examine'''

	[SELECT FROM: Physical and environmental protection policy;procedures addressing physical access control;system security plan;physical access control logs or records;inventory records of physical access control devices; system entry and exit points; records of key and lock combination changes; storage locations for physical access control devices;physical access control devices; list of security safeguards controlling access to designated publicly accessible areas within facility; other relevant documents or records].		[SELECT FROM: Physical and environmental protection policy; procedures addressing physical access control; system security plan; physical access control logs or records; inventory records of physical access control devices; system entry and exit points; records of key and lock combination changes; storage locations for physical access control devices; physical access control devices; list of security safeguards controlling access to designated publicly accessible areas within facility; other relevant documents or records].

	'''Interview'''		'''Interview'''
Line 26:		Line 27:
	Physical access devices include keys, locks, combinations, and card readers.		Physical access devices include keys, locks, combinations, and card readers.
	=== FURTHER DISCUSSION ===		=== FURTHER DISCUSSION ===
	Identifying and controlling physical access devices (e.g., locks, badges, key cards) is just as important as monitoring and limiting who is able to physically access certain equipment.Physical access devices are only strong protection if you know who has them and what access they allow. Physical access devices can be managed using manual or automatic processes such a list of who is assigned what key, or updating the badge access system as personnel change roles.		Identifying and controlling physical access devices (e.g., locks, badges, key cards) is just as important as monitoring and limiting who is able to physically access certain equipment. Physical access devices are only strong protection if you know who has them and what access they allow. Physical access devices can be managed using manual or automatic processes such a list of who is assigned what key, or updating the badge access system as personnel change roles.

	'''Example'''		'''Example'''

	You are a facility manager. A team member retired today and returns their company keys to you.The project on which they were working requires access to areas that contain equipment with FCI. You receive the keys, check your electronic records against the serial numbers on the keys to ensure all have been returned, and mark each key returned [c].		You are a facility manager. A team member retired today and returns their company keys to you. The project on which they were working requires access to areas that contain equipment with FCI. You receive the keys, check your electronic records against the serial numbers on the keys to ensure all have been returned, and mark each key returned [c].

	'''Potential Assessment Considerations'''		'''Potential Assessment Considerations'''

David: David moved page Practice PE.L1-3.10.5 Details to Practice PE.L2-3.10.5 Details

2025-03-16T00:29:25Z

David moved page Practice PE.L1-3.10.5 Details to Practice PE.L2-3.10.5 Details

← Older revision	Revision as of 00:29, 16 March 2025
(No difference)

Wikiadmin: Created page with "'''Source of Reference: The official [https://www.acq.osd.mil/cmmc/documentation.html CMMC Level 1 Self-Assessment Guide] from the Office of the Under Secretary of Defense Acquisition & Sustainment.''' For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you. == PE.L1-3.10.5 – MANAGE PHYSICAL ACCESS == === SECURITY REQUIREMENT === Control and manage physical access devices. === ASSESSMENT OBJECTIVES === Determine..."

2022-02-23T23:28:00Z

Created page with "'''Source of Reference: The official [https://www.acq.osd.mil/cmmc/documentation.html CMMC Level 1 Self-Assessment Guide] from the Office of the Under Secretary of Defense Acquisition & Sustainment.''' For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you. == PE.L1-3.10.5 – MANAGE PHYSICAL ACCESS == === SECURITY REQUIREMENT === Control and manage physical access devices. === ASSESSMENT OBJECTIVES === Determine..."

New page

'''Source of Reference: The official [https://www.acq.osd.mil/cmmc/documentation.html CMMC Level 1 Self-Assessment Guide] from the Office of the Under Secretary of Defense Acquisition & Sustainment.'''

For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.

== PE.L1-3.10.5 – MANAGE PHYSICAL ACCESS ==
=== SECURITY REQUIREMENT ===
Control and manage physical access devices.
=== ASSESSMENT OBJECTIVES ===
Determine if:
: [a] physical access devices are identified;
: [b] physical access devices are controlled; and
: [c] physical access devices are managed.
=== POTENTIAL ASSESSMENT METHODS AND OBJECTS ===
'''Examine'''

[SELECT FROM: Physical and environmental protection policy;procedures addressing physical access control;system security plan;physical access control logs or records;inventory records of physical access control devices; system entry and exit points; records of key and lock combination changes; storage locations for physical access control devices;physical access control devices; list of security safeguards controlling access to designated publicly accessible areas within facility; other relevant documents or records].

'''Interview'''

[SELECT FROM: Personnel with physical access control responsibilities; personnel with information security responsibilities].

'''Test'''

[SELECT FROM: Organizational processes for physical access control; mechanisms supporting or implementing physical access control; physical access control devices].
=== DISCUSSION ===
Physical access devices include keys, locks, combinations, and card readers.
=== FURTHER DISCUSSION ===
Identifying and controlling physical access devices (e.g., locks, badges, key cards) is just as important as monitoring and limiting who is able to physically access certain equipment.Physical access devices are only strong protection if you know who has them and what access they allow. Physical access devices can be managed using manual or automatic processes such a list of who is assigned what key, or updating the badge access system as personnel change roles.

'''Example'''

You are a facility manager. A team member retired today and returns their company keys to you.The project on which they were working requires access to areas that contain equipment with FCI. You receive the keys, check your electronic records against the serial numbers on the keys to ensure all have been returned, and mark each key returned [c].

'''Potential Assessment Considerations'''
* Are lists or inventories of physical access devices maintained (e.g., keys, facility badges, key cards) [a]?
* Is access to physical access devices limited (e.g., granted to, and accessible only by, authorized individuals) [b]?
* Are physical access devices managed (e.g., revoking key card access when necessary, changing locks as needed, maintaining access control devices and systems) [c]?
=== KEY REFERENCES ===
* FAR Clause 52.204-21 Partial b.1.ix
* NIST SP 800-171 Rev 2 3.10.5