Control and Manage Physical Access Devices

CMMC practice PE.L2-3.10.5, drawn from NIST SP 800-171 Rev 2 requirement 3.10.5, mandates that organizations identify all physical access devices — including keys, key cards, proximity badges, PIN codes, biometric readers, and combination locks — used to control entry to facilities housing CUI or organizational systems. Organizations must control these devices by establishing formal issuance and return procedures, limiting distribution to authorized individuals, and ensuring no unaccounted copies or credentials exist. Management of these devices involves maintaining an inventory, performing periodic audits, promptly revoking access upon personnel changes or device loss, and documenting all device transactions. The practice applies to both electronic and mechanical access control mechanisms and requires that the entire device lifecycle — from procurement through decommissioning — be governed by policy. This requirement directly supports NIST SP 800-171 Security Requirement 3.10.5 and aligns with the broader Physical Protection domain objective of preventing unauthorized physical access to CUI environments.