Physical facility access limited to authorized individuals

CMMC 2.0 PE.L1-3.10.1 (NIST 800-171r2 3.10.1) requires limiting physical access to organizational facilities and systems to authorized individuals. Physical access controls are the last line of defense when digital controls are bypassed — an attacker with physical access to a server or workstation can circumvent authentication, extract disk contents, or install hardware keyloggers. This check cannot be evaluated through source code inspection; it requires a physical site audit covering badge/key card access, locked server rooms, and physical security perimeters. Even when this check is skipped in a code-level audit, the underlying CMMC obligation to document and enforce physical controls remains.

Document your physical access control procedures in SECURITY.md at the repository root. While code inspection cannot verify physical controls, documentation evidence is reviewed during formal CMMC assessments:

## Physical Security (PE.L1-3.10.1)
- Badge/key card access required at all facility entry points
- Server rooms locked with access restricted to operations personnel
- Physical access list reviewed and updated quarterly
- Unauthorized access incidents reported to security team within 24 hours

Maintain this documentation alongside your System Security Plan (SSP) for CMMC assessment readiness. Physical facility inspection by a C3PAO assessor is required to satisfy PE.L1-3.10.1 — no amount of code configuration substitutes for that assessment.