PE.L1-3.10.5: Manage Physical Access Devices
Physical access devices like badge readers, locks, and entry terminals are critical control points in your CMMC compliance program. PE.L1-3.10.5 requires you to establish processes for controlling and managing these devices to prevent unauthorized physical access to facilities and systems. This control ensures your organization maintains visibility and oversight of all access control technology.
What this means
This control requires you to implement management practices for all physical access devices used to control entry to facilities and restricted areas. This includes badge readers, keypads, biometric scanners, electronic locks, and similar devices. You must establish policies for device provisioning, configuration, monitoring, and deactivation to ensure only authorized personnel can gain physical access and that access is properly logged and auditable.
How to comply
- 1.Inventory all physical access devices currently deployed across your facilities
- 2.Document the location, type, and function of each access control device
- 3.Establish policies for device configuration and security settings
- 4.Implement procedures for granting and revoking access credentials
- 5.Ensure all devices log access events with timestamps and user identification
- 6.Review and audit access device activity on a regular schedule
- 7.Maintain records of device maintenance, updates, and firmware patches
- 8.Define procedures for secure decommissioning when devices reach end-of-life
Evidence auditors look for
- Completed physical access device inventory spreadsheet with device types and locations
- Access control device management policy document
- Device configuration documentation showing security settings
- Access logs from badge readers or keypad systems showing user IDs and timestamps
- Maintenance records and patch logs for access control systems
- Audit reports of access device activity and anomalies
- Credential provisioning and revocation request records
- Device decommissioning procedures and completion records
Frequently asked questions
When will FAQs be available?
The FAQ for this control is currently being prepared.
GRCWatch automates physical access device inventory tracking and generates audit-ready access logs, eliminating manual spreadsheets and enabling one-click evidence compilation for PE.L1-3.10.5 assessments.
See how GRCWatch handles this control automatically
Start free trial