CMMC Requirement PE.L1-B.1.IX – Manage Visitors & Physical Access: Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.
Links to Publicly Available Resources
This document provides self-assessment guidance for conducting Cybersecurity Maturity Model Certification (CMMC) assessments for Level 1. This article describes how proper physical security provides additional protection people, devices, and data. This abstract, derived from the book "Developing Cybersecurity Programs and Policies, 3rd Edition", provides guidance on how to develop and implement physical controls through policy and practice. This SANS whitepaper provides a broad overview of the importance of physical security as it intersects with cybersecurity. This example policy from the State of Michigan provides guidance for personnel for the protection of Criminal Justice Information (CJI).
Individuals with permanent physical access authorization credentials are not considered visitors. Audit logs can be used to monitor visitor activity. Organizations have flexibility in the types of audit logs employed. Audit logs can be procedural (e.g., written log of individuals accessing the facility), automated (e.g., capturing ID provided by a Personal Identity Verification (PIV) card), or some combination thereof. Physical access points can include facility access points, interior access points to systems or system components requiring supplemental access controls, or both. System components (e.g., workstations, notebook computers) may be in areas designated as publicly accessible with organizations safeguarding access to such devices.
Physical access devices include keys, locks, combinations, and card readers.
Further Discussion
Do not allow visitors, even those people you know well, to walk around your facility without an escort. All non-employees should wear special visitor badges and/or are escorted by an employee at all times while on the property.
Make sure you have a record of who accesses your facility (e.g., office, plant, factory). You can do this in writing by having employees and visitors sign in and sign out or by electronic means such as badge readers. Whatever means you use, you need to retain the access records for the time period that your company has defined.
Identifying and controlling physical access devices (e.g., locks, badges, key cards) is just as important as monitoring and limiting who is able to physically access certain equipment. Physical access devices are only strong protection if you know who has them and what access they allow. Physical access devices can be managed using manual or automatic processes such a list of who is assigned what key, or updating the badge access system as personnel change roles.