What this requirement asks
Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
This is a CMMC Level 2 requirement in the Configuration Management family, drawn from NIST SP 800-171 Rev. 2. An assessor evaluates it objective by objective — every objective below must be supported by evidence, not just described in a policy.
Assessment objectives (8)
- 3.4.5[a] — physical access restrictions associated with changes to the system are defined
- 3.4.5[b] — physical access restrictions associated with changes to the system are documented
- 3.4.5[c] — physical access restrictions associated with changes to the system are approved
- 3.4.5[d] — physical access restrictions associated with changes to the system are enforced
- 3.4.5[e] — logical access restrictions associated with changes to the system are defined
- 3.4.5[f] — logical access restrictions associated with changes to the system are documented
- 3.4.5[g] — logical access restrictions associated with changes to the system are approved
- 3.4.5[h] — logical access restrictions associated with changes to the system are enforced
What an assessor examines
Examine:
- Configuration management policy
- procedures addressing access restrictions for changes to the system
- system security plan
- configuration management plan
- system design documentation
- system architecture and configuration documentation
- system configuration settings and associated documentation
- logical access approvals
- physical access approvals
- access credentials
- change control records
- system audit logs and records
- other relevant documents or records
Interview:
- Personnel with logical access control responsibilities
- personnel with physical access control responsibilities
- personnel with information security responsibilities
- system or network administrators
Test:
- Organizational processes for managing access restrictions associated with changes to the system
- mechanisms supporting, implementing, and enforcing access restrictions associated with changes to the system
Evidence that defends it
Maintain inventory and ownership
Check your readiness
Score this requirement against your own environment with the Level 2 self-assessment checklist, or estimate your SPRS score with the free CMMC compliance tool. Self-reported answers are planning signals only — they do not establish a verified or assessor-accepted result.