Back to Control Explorer



Control Acronym



Physical Protection

CMMC Level


800-171 Control #


CMMC Description

Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.

CMMC Clarification

Think about what parts of your physical space (e.g., office, plant, factory), what equipment, including the network, need to be protected from physical contact. For those parts of your company to which you want only specific employees to have physical access, monitor or limit who is able to enter those spaces with badges, key cards, etc. Example You work for a small company as the project manager for a Department of Defense (DoD) project. The project requires special equipment that should be used only by project team members. You work with your boss to put locks on the doors to your area. This restricts access to the room to only those employees who work on the DoD project.

800-171 Description

Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.

800-171 Discussion

This requirement applies to employees, individuals with permanent physical access authorization credentials, and visitors. Authorized individuals have credentials that include badges, identification cards, and smart cards. Organizations determine the strength of authorization credentials needed consistent with applicable laws, directives, policies, regulations, standards, procedures, and guidelines. This requirement applies only to areas within facilities that have not been designated as publicly accessible. Limiting physical access to equipment may include placing equipment in locked rooms or other secured areas and allowing access to authorized individuals only; and placing equipment in locations that can be monitored by organizational personnel. Computing devices, external disk drives, networking devices, monitors, printers, copiers, scanners, facsimile machines, and audio devices are examples of equipment.

Other Source Discussion


CIS Control References

NIST 800-53 Control Ref.

NIST SP 800-53 Rev 4 PE-2

CMMC Derived

NIST CSF Control References

NIST 800-171 References

NIST SP 800-171 Rev 1 3.10.1

Applicable FAR Clause

FAR Clause 52.204-21 b.1.viii

NIST CSF Control Reference


CERT RMM Reference


Modification of NIST 800-171B Reference

NIST 800-171B Reference

UK NCSCCyber Reference

AS ACSC Reference


Assessment Sub-Criteria 1

PE.1.131.[a] authorized individuals allowed physical access are identified;

Assessment Sub-Criteria 2

PE.1.131.[b] physical access to organizational systems is limited to authorized individuals;

Assessment Sub-Criteria 3

PE.1.131.[c] physical access to equipment is limited to authorized individuals; and

Assessment Sub-Criteria 4

PE.1.131.[d] physical access to operating environments is limited to authorized individuals.

Assessment Sub-Criteria 5

Assessment Sub-Criteria 6

Assessment Sub-Criteria 7

Assessment Sub-Criteria 8

Assessment Sub-Criteria 9

Assessment Sub-Criteria 10

Assessment Sub-Criteria 11

Assessment Sub-Criteria 12

Assessment Sub-Criteria 13

Assessment Sub-Criteria 14

Assessment Sub-Criteria 15