What this requirement asks
Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.
This is a CMMC Level 2 requirement in the Physical Protection family, drawn from NIST SP 800-171 Rev. 2. An assessor evaluates it objective by objective — every objective below must be supported by evidence, not just described in a policy.
Assessment objectives (4)
- 3.10.1[a] — authorized individuals allowed physical access are identified
- 3.10.1[b] — physical access to organizational systems is limited to authorized individuals
- 3.10.1[c] — physical access to equipment is limited to authorized individuals
- 3.10.1[d] — physical access to operating environments is limited to authorized individuals
What an assessor examines
Examine:
- Physical and environmental protection policy
- procedures addressing physical access authorizations
- system security plan
- authorized personnel access list
- authorization credentials
- physical access list reviews
- physical access termination records and associated documentation
- other relevant documents or records
Interview:
- Personnel with physical access authorization responsibilities
- personnel with physical access to system facility
- personnel with information security responsibilities
Test:
- Organizational processes for physical access authorizations
- mechanisms supporting or implementing physical access authorizations
Evidence that defends it
Show facility access controls, badges, doors
Check your readiness
Score this requirement against your own environment with the Level 2 self-assessment checklist, or estimate your SPRS score with the free CMMC compliance tool. Self-reported answers are planning signals only — they do not establish a verified or assessor-accepted result.