- Use the monitoring the facility actually has — badge-system alerts, cameras, alarms, or human presence in small facilities — and define what reviewing its output means in practice.
- Fold physical anomalies into the incident process under 03.06.01: a propped server-room door is an incident, not a facilities quirk.
03.10.02OFFICIAL TITLEPENDING NIST SME REVIEW
03.10.02 — Monitoring Physical Access
03.10 Physical Protection · NIST SP 800-171 Rev. 3
Independent summary of the official requirement
Requires monitoring physical access to the facility where the system resides to detect and respond to physical security incidents, and reviewing physical access logs at an organization-defined frequency and upon occurrence of organization-defined events or potential indications of events.
Rev. 3 requirement text is multi-part and parameterized with organization-defined values, so this site summarizes rather than reproduces it. The summary is independent — read the official publication for the binding wording.
NIST SP 800-171 Rev. 3 — Protecting CUI in Nonfederal Systems ↗NIST SP 800-171A Rev. 3 — Assessing Security Requirements for CUI ↗Independent interpretation
What this requirement is after
Somebody has to be able to notice the forced door, the badge used at 3 a.m., or the tailgater on camera — and the logs have to be looked at on a schedule, not only after something is already known to be wrong.
Across revisions
Carries Rev. 2's protect-and-monitor requirement forward with log review made explicit — a defined frequency plus event-driven review.
Mapped practices
Brilliant at the Basics practices that support this requirement
No practice maps to this requirement — deliberately.
The campaign’s twenty practices are a priority list, not a control catalog, and none of them works this requirement’s substance directly. It still applies to you if it is in your contract’s scope: address it through your own implementation and the related artifacts below, and treat the absence of a mapping here as honesty, not permission to skip it.
Doing the work
Implementation considerations and evidence
- Physical access log reviews at the defined frequency
- Alarm or camera coverage documentation for the relevant areas
Artifacts
Templates and worksheets with a mapped relationship
No artifact in the library names this requirement yet. The library index groups everything by category and practice.
The other revision
Where this came from in Rev. 2
Provenance
Sources and review status
| Primary sources | NIST SP 800-171 Rev. 3 — Protecting CUI in Nonfederal Systems · NIST SP 800-171A Rev. 3 — Assessing Security Requirements for CUI |
|---|---|
| Review status | Pending NIST SME review |
| Content version | 1.0 |
| Updated |