Physical access logs maintained

CMMC 2.0 PE.L1-3.10.4 (NIST 800-171r2 3.10.4) requires that organizations maintain audit logs of physical access to systems containing FCI. Without retained access logs, there is no way to investigate a physical security incident, verify that only authorized individuals entered sensitive areas, or demonstrate accountability during a CMMC assessment. Physical access logs — key card entry records, server room door logs — are the physical equivalent of application audit trails. The absence of a log retention policy or log review procedure is a finding in any CMMC formal assessment.

Document your physical access log procedures in SECURITY.md. Include retention period, log types, and review frequency — all are examined during CMMC assessments:

## Physical Access Logs (PE.L1-3.10.4)
- Key card and badge reader logs retained for a minimum of 90 days
- Server room door access logged electronically; logs reviewed monthly
- Anomalous access events (after-hours, repeated failed attempts) escalated to security team
- Log access restricted to authorized personnel only

Ensure your access control hardware vendor provides exportable logs and that the export/review process is tested at least quarterly. CMMC assessors will request log samples.