Physical security is a practice family that increasingly cuts across remote-work scenarios because the CMMC L2 Scoping Guide identifies OSA office buildings as Security Protection Assets in Table 2.
The six PE practices
| Practice | Requirement |
|---|---|
| PE.L2-3.10.1 | Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals. |
| PE.L2-3.10.2 | Protect and monitor the physical facility and support infrastructure for organizational systems. |
| PE.L2-3.10.3 | Escort visitors and monitor visitor activity. |
| PE.L2-3.10.4 | Maintain audit logs of physical access. |
| PE.L2-3.10.5 | Control and manage physical access devices. |
| PE.L2-3.10.6 | Enforce safeguarding measures for CUI at alternate work sites (e.g., telework sites). |
What "facility" means under the Scoping Guide
The L2 Scoping Guide Table 2 lists "OSA office buildings" as a category of Security Protection Asset. Practically, this means PE family controls apply to:
- The primary office building where in-scope work happens.
- Co-located data centers (also explicitly named in Table 2).
- Security Operations Centers.
- Any other facility where CUI is processed, stored, or transmitted, or where SPA functions are performed.
- Remote workers' home offices — covered specifically by PE.L2-3.10.6 (alternate work sites).
Implementation patterns by scenario
| Scenario | Typical PE controls |
|---|---|
| Single-office contractor | Badge access, visitor sign-in, escorted access for non-employees, server room separation, alarm/monitoring, physical access logs. |
| Multi-tenant office space | Same as above plus suite-level access control, separation from non-OSA areas, careful approach to common areas. |
| Co-located data center | Provider-managed physical access (often inherited via Customer Responsibility Matrix), OSA-managed cage-level access, two-person integrity for critical operations. |
| Remote worker (home office) | Acceptable Use covering home office; CUI restricted to MDM-enrolled devices with disk encryption; screen privacy policy; no shared household device use; secure storage of any printed CUI; sanitization on offboarding. |
What the assessor will examine
- Physical access policy and procedures.
- Badge access logs (for badged facilities).
- Visitor logs and escort records.
- Asset inventory tied to physical locations.
- Acceptable use agreements covering physical handling.
- Remote work agreements covering home office expectations.
- For co-located facilities, the provider's physical security documentation referenced in the SSP and CRM.
Common errors
- Treating physical security as out-of-scope because the OSA is "all cloud." Even cloud-only environments have offices where users handle CUI, plus the cloud provider's data centers (inherited via CRM).
- Skipping PE.L2-3.10.6 for remote workers. Remote work is now the norm; the SSP should explicitly address alternate-work-site safeguards.
- Visitor logs that aren't actually maintained. Policy requirement without operational evidence is a finding.
- Badge access for an office where employees regularly prop the door open. The control's design must match its operation.
- No periodic review of physical access rights. Stale physical access (former employees still with badges) parallels stale logical access.
Sources
Set physical security expectations for remote workers.
The CMMC Compliance Engine includes the AGR-RWK-01_Remote_Work_Security_Agreement covering home-office safeguarding measures for PE.L2-3.10.6.
Get the CMMC Compliance Engine