Back to Control Explorer
PE.1.131
Content
Control Acronym
PE
Family
Physical Protection
CMMC Level
1
800-171 Control #
3.10.1
CMMC Description
Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.
CMMC Clarification
Think about what parts of your physical space (e.g., office, plant, factory), what equipment, including the network, need to be protected from physical contact. For those parts of your company to which you want only specific employees to have physical access, monitor or limit who is able to enter those spaces with badges, key cards, etc. Example You work for a small company as the project manager for a Department of Defense (DoD) project. The project requires special equipment that should be used only by project team members. You work with your boss to put locks on the doors to your area. This restricts access to the room to only those employees who work on the DoD project.
800-171 Description
Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.
800-171 Discussion
This requirement applies to employees, individuals with permanent physical access authorization credentials, and visitors. Authorized individuals have credentials that include badges, identification cards, and smart cards. Organizations determine the strength of authorization credentials needed consistent with applicable laws, directives, policies, regulations, standards, procedures, and guidelines. This requirement applies only to areas within facilities that have not been designated as publicly accessible. Limiting physical access to equipment may include placing equipment in locked rooms or other secured areas and allowing access to authorized individuals only; and placing equipment in locations that can be monitored by organizational personnel. Computing devices, external disk drives, networking devices, monitors, printers, copiers, scanners, facsimile machines, and audio devices are examples of equipment.
Other Source Discussion
N/A
CIS Control References
NIST 800-53 Control Ref.
NIST SP 800-53 Rev 4 PE-2
CMMC Derived
NIST CSF Control References
NIST 800-171 References
NIST SP 800-171 Rev 1 3.10.1
Applicable FAR Clause
FAR Clause 52.204-21 b.1.viii
NIST CSF Control Reference
NIST CSF v1.1 PR.AC-2
CERT RMM Reference
CERT RMM v1.2 KIM:SG4.SP2
Modification of NIST 800-171B Reference
NIST 800-171B Reference
UK NCSCCyber Reference
AS ACSC Reference
Sub-Criterias
Assessment Sub-Criteria 1
PE.1.131.[a] authorized individuals allowed physical access are identified;
Assessment Sub-Criteria 2
PE.1.131.[b] physical access to organizational systems is limited to authorized individuals;
Assessment Sub-Criteria 3
PE.1.131.[c] physical access to equipment is limited to authorized individuals; and
Assessment Sub-Criteria 4
PE.1.131.[d] physical access to operating environments is limited to authorized individuals.