As of November 10, 2025, Cybersecurity Maturity Model Certification (CMMC) Phase 1 is live, involving contractor self-assessments against NIST 800-171. While many contractors focus on tightening cybersecurity controls, physical security failures are just as likely to surface during compliance assessments.
This article breaks down five active Controlled Unclassified Information (CUI) physical protection requirements and walks through how to implement a layered security posture that satisfies them.
The 5 Physical Protection Requirements in NIST SP 800-171 Rev 3 Section 3.10
NIST SP 800-171 Rev 3, published in May 2024, is NIST’s current publication governing how nonfederal systems and organizations protect CUI they receive from federal agencies. It introduced refined language across multiple control families. However, CMMC Level 2 assessments continue to reference Rev 2 until the Department of Defense (DoD) completes rulemaking to incorporate Rev 3.
These five physical protection requirements reflect Rev 3’s structure and are worth addressing in your System Security Plan regardless of which revision applies to your current assessment cycle.
03.10.01: Physical Access Authorizations
Access authorization is the foundation that every other control builds on. It establishes the “who is allowed in” baseline. You must maintain current authorization lists and issue credentials that prove someone has legitimate access. When personnel change roles or leave the organization, their authorization should be removed from the access list.
The practical implementation breaks down into three core activities:
- Maintaining authorization lists: Keep current rosters showing exactly who has access privileges to specific CUI areas, updated in real time when personnel status changes.
- Issuing and managing credentials: Deploy badge systems, PINs, access cards, or biometric credentials that verify identity at entry points and create an auditable access trail.
- Reviewing and revoking access: Conduct periodic audits of authorization lists and deactivate credentials when personnel separate or move to roles that don’t require CUI access.
03.10.02: Monitoring Physical Access
03.10.02 requires that you actively monitor physical access to systems and CUI areas. This requirement mandates active monitoring and review of physical access, not just passive systems. Assessors are looking for the following:
- Monitoring mechanisms at access points: Cameras, sensors, guards, or other detection systems positioned where personnel enter CUI areas
- Access log maintenance: Automated or manual records documenting who accessed CUI areas and when
- Regular log review: Documented review cadence showing that logs are examined for anomalies on a defined schedule
- Incident response procedures: Written protocols for responding when monitoring detects unauthorized access attempts or suspicious activity
03.10.06: Alternate Worksite
As remote and hybrid work becomes standard across the defense industrial base, 03.10.06 addresses a gap that traditional facility-focused security doesn’t cover: protecting CUI when employees access it from home offices, coworking spaces, or other locations outside your primary facility.
This requirement mandates that you explicitly determine which alternate worksites are approved for CUI access and establish enforceable security requirements that apply to those locations.
- Designating approved alternate worksites: Document which types of alternate locations employees may use to access CUI, including private residences, specific branch offices, approved coworking facilities, or temporary contingency locations. Not every work-from-home scenario qualifies.
- Establishing location-specific security requirements: Deploy tailored controls that address the unique risks of each alternate worksite type.
03.10.07: Physical Access Control
This requirement centers on entry and exit point reinforcement, verifying that only authorized individuals pass through. It also mandates documentation for every entry and exit. Effective implementation requires these approaches:
- Access restriction technology: Badge readers, keypads, biometric controls, or guard-managed checkpoints that verify authorization before granting entry
- Visitor management: Logs documenting visitor entry, escort procedures ensuring visitors remain supervised, and visitor identification systems distinguishing guests from authorized personnel
- Secured access devices: Keys, combinations, and credentials stored and controlled to prevent unauthorized duplication or use
03.10.08: Access Control for Transmission
Most defense contractors focus their physical security efforts on doors, gates, and server rooms. Then, assessors ask about the network infrastructure carrying CUI data, and the compliance gap becomes obvious.
The 03.10.08 requirement extends physical access control to the transmission layer. Compliance requires securing the infrastructure pathways that often get overlooked during initial security planning, including wiring closets, cable runs, and network hardware. If someone can access the cables carrying CUI traffic, they can potentially intercept data without ever touching a CUI system directly.
How to Build Layered Physical Security That Satisfies Section 3.10
A layered physical security approach satisfies multiple requirements simultaneously while preventing the security incidents that trigger your incident-response obligations in the first place. The strategy works from the outside in, establishing a hardened perimeter that prevents unauthorized access, layering credential controls at every entry point, and then closing the detection loop with active monitoring.
1. Secure the Perimeter
Though not explicitly required by NIST, perimeter security supports physical access control requirements and establishes your first line of defense. Everything inside that boundary assumes the outer edge is already controlled. Without a secure perimeter, your badge readers and surveillance cameras are simply managing access to an unprotected space that criminals can enter at will.
Electric fencing as your perimeter barrier offers proactive protection in two ways:
- Visual deterrence: The fence’s warning signs and imposing height signal that unauthorized entry will be resisted.
- Physical deterrence: If a determined criminal tries to access your site, a medically safe shock prevents them from tampering with the fence.
2. Control Every Access Point
Once the perimeter is hardened, every point of entry into CUI areas should have a documented access control method, whether that’s a credential-based system, guard-managed checkpoints, or a combination. No gaps in coverage can exist. An unmonitored side door is a compliance gap, and a gate left unlocked during shift changes is a vulnerability that assessors will document.
Effective access control includes:
- Authorization lists synchronized with access systems
- Credential verification at every door and gate
- Visitor logs and escort procedures
- Access provisioning and deprovisioning workflows
Credential systems should generate timestamped access logs automatically. These logs can provide evidence supporting 03.10.07’s audit-log requirement without manual record-keeping.
3. Monitor Physical Access
Surveillance with NDAA-compliant cameras and active monitoring closes the detection loop that physical barriers and credentials cannot fully cover, satisfying 03.10.02’s mandate for detection plus response. For effective monitoring, implement the following interconnected measures:
- Strategic camera placement: Position surveillance cameras where personnel enter or exit CUI areas, capturing clear footage of every access event for later review or real-time verification.
- Active monitoring: Use real-time monitoring to confirm security incidents, with routine review schedules.
- Access log analysis: Examine automated logs showing credential usage patterns, looking for anomalies such as after-hours access, failed authentication attempts, or credential sharing between personnel.
- Incident response protocols: Document what happens when monitoring detects suspicious activity, from escalation procedures to law enforcement notification to evidence preservation for investigations.
The 03.10.02 requirement applies specifically to access points, but extending camera coverage to the full perimeter exceeds the minimum requirement. This approach creates a stronger audit posture, particularly for facilities with large outdoor footprints.
4. Ensure Audit-Ready Documentation
Having the systems in place is necessary but not sufficient. Documentation turns physical implementation into verifiable compliance. If no documented record exists, assessors have no way to verify compliance.
Assessment methods are flexible and can include examination, interviews, plus testing of processes and mechanisms. Evidence that can support your assessment includes:
- Access authorization records: Current lists showing who is authorized to access CUI areas, when authorizations were granted, and when they were revoked
- Monitoring logs and review records: Access logs and surveillance footage indexes
- Visitor logs and barrier evidence: Sign-in sheets, escort assignments, and photographic or schematic evidence of physical barriers installed at CUI area boundaries
- Infrastructure access records: Documentation showing that wiring closets, server rooms, and cable runs are physically secured with controlled access
A physical security partner whose systems generate this documentation automatically reduces the manual burden significantly. Automated access logging, integrated surveillance systems, and credential management platforms create audit trails that satisfy documentation requirements without dedicated staff managing spreadsheets or manual records.
Protect Your CUI Facility With AMAROK
A layered security approach can help organizations address multiple physical protection requirements in NIST SP 800-171 simultaneously, while creating audit-ready documentation and reducing the risk of physical breaches.
AMAROK has protected over 9,000 commercial properties since 1973, including defense contractors whose facilities process, store, or transmit CUI. Our multi-layered perimeter security system integrates The Electric Guard Dog® Fence, video surveillance, Gate Access Control, and 24/7 monitoring to address physical protection requirements while generating audit documentation.
Schedule a free risk assessment today to understand your site’s vulnerabilities and how perimeter security can support your compliance posture.
