CMMC control families

CMMC Physical Protection (3.10 PE): 6 requirements you can actually buy for

Six requirements about the building, the rack and the screen — the family that most often goes unbudgeted, and the second-easiest one to put real equipment behind. Filters, locks and enclosures are ordinary supply; the camera and access-control software above them is licensing, and the per-site staging is scoped with the order.

Get a physical-security estimate See what's inside

Family: 3.10 — Physical Protection
Requirements: 6 of the 110 Level 2 requirements
Level 1: In scope — basic requirements from this family
Boundary: The capability behind the control — never a certification we hold

Overview

The building, the rack, the desk and the screen

Physical protection carries six requirements: limit physical access to systems, equipment and operating environments to authorized individuals (3.10.1); protect and monitor the physical facility and its support infrastructure (3.10.2); escort visitors and monitor visitor activity (3.10.3); maintain audit logs of physical access (3.10.4); control and manage physical access devices (3.10.5); and enforce safeguarding measures for CUI at alternate work sites (3.10.6). Three of those are records and procedure. The other three are the ones that turn into a purchase order, and they are usually the last thing anybody budgets for.

Levels

What each level asks of this family

Physical protection is one of the six families Level 1 touches: the FAR 52.204-21 basics that land here cover limiting physical access to authorized individuals, and escorting visitors, logging physical access and managing physical access devices.

At Level 2 the same six apply in full, with 3.10.6 — safeguarding CUI at alternate work sites — carrying more weight than it used to now that home offices are permanent. That is the requirement where privacy filters and locks are usually justified, and it is worth writing the alternate-work-site position into the SSP explicitly rather than leaving it implied.

Level 3 layers enhanced requirements from NIST SP 800-172 onto a Final Level 2, assessed by DIBCAC.

What's quotable

What you can actually quote against this family

Each card names the requirement the line serves — hardware, software licensing or the integration work that puts either into service. Naming a control is not a coverage claim: the configuration, the procedure and the evidence stay inside your program, and no purchase — hardware, license or service — confers certification on its own. Naming a manufacturer describes the market, not a Uniqcli partnership or endorsement.

Screens in shared and alternate space (3.10.6)

No requirement names a privacy filter. What 3.10.6 asks for is safeguarding measures at alternate work sites, and a filter is the cheapest measure most programs land on for a laptop used in shared space. 3M and StarTech.com are both deep and genuinely stocked here, with Kensington, Targus and Rocstor alongside — sized per model, so the quote needs the exact machine.

Equipment that walks (3.10.1)

Limiting physical access to equipment is easier when the equipment is attached to the desk. Cable locks are ordinary supply — Kensington carries the deepest catalog, StarTech.com and Rocstor the best availability, with Targus and CODi behind them. Quoted per seat, and the quote states which models are on the shelf today rather than assuming.

Locked racks and enclosures (3.10.1, 3.10.5)

For anything rack-mounted, physical access control means a lockable enclosure and managed keys. Legrand — including its Middle Atlantic and Ortronics lines — is the largest stocked rack line we carry, with Eaton and its Tripp Lite lockable boxes behind it, then Vertiv, Schneider's NetShelter range, Rocstor and StarTech.com. Availability on the deeper catalogs is thinner than the row counts suggest, so these are quoted, not assumed.

Monitoring the facility (3.10.2)

Where the facility itself has to be monitored, network cameras are the equipment behind it. On the hub the verified lines are Ubiquiti — which also carries a small access-control device range — with Adesso and GeoVision alongside; other camera brands you may see on our catalog pages are discovery listings from our sister storefronts rather than hub stock, and the quote will tell you which is which. The video-management and access-control software those systems run on is licensing, sourced through the same distribution and quoted per channel, per door and per term rather than held on a shelf.

Delivered as a labeled kit per site

Physical protection is the family that spreads across the most locations, which is where a bulk shipment turns into a scheduling problem. Site-by-site staging, kitting and phased release scheduling are scoped with the order, so each building receives a labeled kit sized to its own headcount and machine list rather than a share of a pallet.

Limits

What no purchase closes here

Visitor escort under 3.10.3, physical access audit logs under 3.10.4 and the management of physical access devices under 3.10.5 are records and habits. A camera does not escort anyone, a lock does not maintain a key register, and a filter does not stop a screen being read over a shoulder if nobody uses it. The program stays yours to run — the policy, the decisions, the cadence and the evidence an assessor actually reads. What a supplier puts behind it is the tooling, the licensing and the integration work. We procure and stage equipment; we are not a general contractor and do not perform facilities work, cabling installation or guard services.

We are not an assessor, a C3PAO or an RPO, and we hold no CMMC level. We quote against the SSP you already have — hardware, licensing and the integration work around them — not a generic bundle assembled around a level number.

Questions

Physical protection questions

What are the CMMC physical security requirements at Level 1?

Physical protection is one of the six families Level 1 touches, and the FAR 52.204-21 basics that land here are limiting physical access to authorized individuals, escorting visitors and monitoring their activity, maintaining audit logs of physical access, and controlling and managing physical access devices. Level 1 carries 15 requirements in total across those six families, self-assessed annually with an affirmation in SPRS and no POA&Ms permitted.

Do you need visitor logs for CMMC?

3.10.3 requires visitors to be escorted and their activity monitored, and 3.10.4 requires audit logs of physical access to be maintained. Between them that is a visitor record in practice. Neither requirement names a system — a bound book satisfies the wording as readily as a badge platform, provided it is actually kept and can be produced.

Does CUI require a privacy screen filter?

No requirement names one. 3.10.6 requires safeguarding measures for CUI at alternate work sites, and a privacy filter is one inexpensive measure that helps satisfy it for a laptop used in shared or public-facing space. Whether it is the right measure for your sites is a decision for your program — we supply the filter, not the judgement.

Do server racks holding CUI have to be locked?

No requirement says "lock the rack" in those words. 3.10.1 requires physical access to systems, equipment and operating environments to be limited to authorized individuals, and in a shared or multi-tenant space a lockable enclosure is the ordinary way of doing that. 3.10.5 then asks you to control and manage the physical access devices — which means the keys have a register, not just an owner.

Related families and background

All fourteen control families Media Protection (3.8 MP)Access Control (3.1 AC)NIST SP 800-171 hardware checklist

Get a CMMC estimate — CMMC Physical Protection (3.10 PE)

Tell us where to reach you and a Uniqcli specialist follows up by email to scope what you need across hardware, software licensing and integration, then comes back with pricing and availability — quoted against the SSP you already have, not a generic bundle.

An estimate for the capability behind the control — never a certification we hold. No purchase — hardware, license or service — confers a CMMC level on its own; what you buy makes the controls implementable.

The solutions atlas

Every solution, one accountable partner.

All solutions →

Ask AI about Uniqcli

“CMMC Physical Protection (3.10 PE)”

Talk to us about physical protection

Send the headcount, the site list or the rack layout. A Uniqcli specialist replies with an estimate for filters, locks and enclosures sized to the machines you actually have, any camera or access-control licensing above them, and per-site staging where the rollout needs it — availability stated per line, TAA and §889 screening performed before it goes out.

Get a physical-security estimate All fourteen families