Physical Protection controls who can physically reach systems and CUI. Its six requirements cover limiting physical access, protecting the facility, escorting visitors, logging access, managing badges and keys, and safeguarding CUI at alternate work sites such as home offices.
It is a low-point family — 14 points — but it holds three of the six requirements in the entire standard that can never be placed on a POA&M. That makes it a gating family for any assessment.
What the Physical Protection family covers
Physical Protection contains 6 requirements, numbered 3.10.1 to 3.10.6 in NIST SP 800-171 Revision 2. In CMMC Level 2 they carry the practice prefix PE.L2, so 3.10.1 appears as PE.L2-3.10.1.
The requirements apply to every location where CUI or in-scope systems exist: offices, server rooms, shop floors, data closets and remote work locations. In a cloud-heavy environment the provider covers its data centers, but your offices and home workers remain your responsibility.
| Requirement | What it requires | SPRS points | POA&M |
|---|---|---|---|
| 3.10.1 | Limit physical access to systems, equipment and operating environments to authorized individuals | 5 | No |
| 3.10.2 | Protect and monitor the physical facility and support infrastructure | 5 | No |
| 3.10.3 | Escort visitors and monitor visitor activity | 1 | Never |
| 3.10.4 | Maintain audit logs of physical access | 1 | Never |
| 3.10.5 | Control and manage physical access devices | 1 | Never |
| 3.10.6 | Enforce safeguarding measures for CUI at alternate work sites | 1 | Eligible |
Point values from the DoD Assessment Methodology v1.2.1. POA&M eligibility under 32 CFR 170.21.
What it costs you in SPRS points
The family puts 14 of the 313 deductible points in the SPRS score at risk. The five-point requirements are 3.10.1 and 3.10.2. The remaining 4 are worth one point each.
The two five-point requirements are 3.10.1 and 3.10.2. The other four are worth one point each — but three of them cannot be deferred, so their low value is misleading.
The never-defer trap
3.10.3 (escort visitors and monitor visitor activity), 3.10.4 (maintain audit logs of physical access) and 3.10.5 (control and manage physical access devices) are one-point requirements, which would normally make them deferrable. 32 CFR 170.21 excludes them explicitly. An organization that planned to "fix the visitor log later" will find that it cannot achieve conditional status until it does.
All three are inexpensive: a visitor sign-in process with escorts, a badge system or key log that records access, and an inventory of badges and keys with a process to recover them when people leave. Small offices without electronic badge systems can meet them with paper logs, provided the logs are kept and reviewed.
Implementation priorities for Physical Protection
Define the controlled areas — server rooms, engineering offices, shop floors, document storage — and who may enter each. Put the three never-defer controls in place first: a visitor log with escorts, access logs from your badge system or a manual log, and an inventory of keys and badges with a recovery process. Then address facility monitoring and home-office guidance for anyone handling CUI remotely.
What you can and cannot defer
Under 32 CFR 170.21 only one-point requirements may be placed on a POA&M, with the single exception of 3.13.11 when encryption exists but is not FIPS-validated. In this family that makes 3.10.6 eligible for deferral. 3.10.3, 3.10.4 and 3.10.5 are on the list of six requirements that can never be deferred, whatever the point value.
3.10.6, alternate work sites, is the only deferrable requirement in the family. For organizations with remote workers handling CUI, it is also the one most often overlooked.
Evidence assessors expect
Assessors work at the level of the objectives in NIST SP 800-171A and use examine, interview and test. For this family, have the following ready — the full evidence package checklist covers all 14 families:
- A list of authorized individuals for each controlled area.
- Visitor logs and escort procedures.
- Physical access logs from badge systems or manual logs.
- An inventory of badges, keys and combinations, with recovery records.
- Facility monitoring such as cameras or alarms where applicable.
- Guidance and agreements for home or alternate work sites.
Frequently asked questions
Do we need an electronic badge system?
No. NIST SP 800-171 requires controlled and logged access, not a specific technology. Locks with a key log and a visitor book can work in a small office.
Are home offices in scope?
Yes, if people handle CUI at home. 3.10.6 requires safeguarding measures there, such as locked storage and screen privacy.
Does a cloud provider cover physical protection?
For its data centers, yes, which is part of FedRAMP authorization. Your own offices and endpoints are still your responsibility.
How long should physical access logs be kept?
NIST SP 800-171 does not specify. Keep them at least as long as your audit logs, commonly a year, so they can support an investigation.