CMMC Level 2 / Control family · PE

Physical Protection

That the physical spaces and equipment holding CUI are controlled — access, visitors, and alternate work sites.

6

requirements in this family

What it requires

The 6 requirements, in plain language.

3.10.1 Limit Physical Access [CUI Data]

Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals

3.10.2 Monitor Facility

Protect and monitor the physical facility and support infrastructure for organizational systems

3.10.3 Escort Visitors [CUI Data]

Escort visitors and monitor visitor activity

3.10.4 Physical Access Logs [CUI Data]

Maintain audit logs of physical access

3.10.5 Manage Physical Access [CUI Data]

Control and manage physical access devices

3.10.6 Alternative Work Sites

Enforce safeguarding measures for CUI at alternate work sites

NIST SP 800-171 Rev 2 — Family PE. CMMC Level 2 assesses each requirement's objectives via a C3PAO. NIST SP 800-171r2 →

How Aletheon covers it

One owner across the whole family — built, run, and proven.

Enclave builds these controls into the boundary as code; Cadence keeps them enforced between assessments; Attest proves them to the C3PAO against every objective.

See all fourteen families →

Not sure which families your contract puts in scope?

A readiness check maps your environment to all 110 controls and tells you exactly where you stand.

Book a readiness check