Physical access devices managed

CMMC 2.0 PE.L1-3.10.5 (NIST 800-171r2 3.10.5) requires that organizations manage physical access devices — keys, badges, and tokens — that control entry to FCI-processing areas. An untracked badge issued to a former employee, or a lost key with no revocation procedure, creates an indefinite physical access risk with no audit trail. Physical device management is a procedural control that cannot be evaluated through code inspection but is a required evidence item during any CMMC formal assessment.

Document your physical access device management procedures in SECURITY.md. Assessors look for inventory, issuance, and revocation procedures:

## Physical Access Devices (PE.L1-3.10.5)
- Badge and key inventory maintained and reviewed quarterly
- Devices issued only after background check approval; recorded in access registry
- Departing employees: badge deactivated and key retrieved on last working day
- Lost or stolen devices: reported to security within 4 hours; deactivated immediately
- Spare devices stored in locked cabinet accessible to facility manager only

Tie device issuance and revocation to your HR offboarding checklist — the most common failure mode is delay between employment termination and badge deactivation.