Monitoring Physical Access (03.10.02)_monitoring-physical-access

Monitoring Physical Access (03.10.02) Monitoring Physical Access

High-Level Description

Family: Physical Protection Framework: NIST SP 800-171 Rev 3 Applicability: Systems processing, storing, or transmitting CUI

Monitor physical access to the facility where the system resides to detect and respond to physical security incidents. Review physical access logs [organization-defined] and upon occurrence of [organization-defined].

What to Check

• Verify Monitoring Physical Access (03.10.02) Monitoring Physical Access is implemented for CUI systems
• Review SSP documentation for Monitoring Physical Access (03.10.02)
• Validate CMMC Level 2 assessment objective for Monitoring Physical Access (03.10.02)
• Confirm POA&M addresses any gaps for Monitoring Physical Access (03.10.02)

How to Test

Step 1: Review System Security Plan

Examine the SSP for Monitoring Physical Access (03.10.02) implementation description and responsible parties.

Step 2: Assess Implementation

# Verify security controls protecting CUI
# Check access controls, encryption, monitoring as applicable

# For Linux systems:
ls -la /etc/security/ 2>/dev/null
grep -r "CUI\|controlled" /etc/security/ 2>/dev/null

# For cloud:
# Use cloud-audit-mcp tools to assess posture

Step 3: CMMC Assessment Validation

Verify this requirement passes CMMC Level 2 assessment methodology per SP 800-171A Rev 3.

Tools

Remediation Guide

Requirement Statement

Monitor physical access to the facility where the system resides to detect and respond to physical security incidents. Review physical access logs [organization-defined] and upon occurrence of [organization-defined].

Supplemental Guidance

A facility can include one or more physical locations containing systems or system components that process, store, or transmit CUI. Physical access monitoring includes publicly accessible areas within organizational facilities. Examples of physical access monitoring include guards, video surveillance equipment (i.e., cameras), and sensor devices. Reviewing physical access logs can help to identify suspicious activities, anomalous events, or potential threats. The reviews can be supported by audit logging controls if the access logs are part of an automated system. Incident response capabilities include investigations of physical security incidents and responses to those incidents. Incidents include security violations or suspicious physical access activities, such as access outside of normal work hours, repeated access to areas not normally accessed, access for unusual lengths of time, and out-of-sequence access.

Risk Assessment

CWE Categories

References

• NIST SP 800-171 Rev 3
• NIST SP 800-171A Rev 3 (Assessment)
• CMMC Model Overview
• NIST OSCAL Content

Checklist

• SSP documents Monitoring Physical Access (03.10.02) implementation
• Evidence of operating effectiveness collected
• POA&M addresses any gaps
• CMMC assessment objective met
• Continuous monitoring active