Protect the rooms, equipment and work areas where CUI is handled.
Work through all six requirements and 16 assessment objectives. Limit physical access, protect and monitor facilities and support infrastructure, escort and monitor visitors, maintain physical access logs, manage access devices and enforce safeguards at alternate work sites.
Sources reviewed October 28, 2026. These instructions have not been tested in a Microsoft tenant. This guide does not establish compliance or replace an official assessment. Suggested checks and manual worksheet states are working aids.
Identify the areas and people. Include systems, equipment, operating environments and the authorized physical-access list. Shared premises, landlord access and local equipment need explicit decisions.
Check protection and monitoring separately. Include both facilities and their support infrastructure. Identify who notices a problem, who responds and which parts depend on another organization.
Follow visitors and access devices. An arrival record does not provide escort or activity monitoring. Inventory and control keys, badges, spares and other physical devices throughout issue, return and changes.
Maintain physical access evidence. Trace actual events to physical access logs. Keep detailed visitor and device records in approved restricted storage, with your approved retention and disposal arrangements.
Include alternate sites and provider duties. Define and enforce safeguards at approved home or temporary work sites. Inherit only the cloud responsibilities supported by applicable provider evidence.
Use fictional records and authorized harmless checks. Do not attempt unauthorized entry, bypass locks, stage an intrusion, disable alarms or interfere with power and safety systems. Keep CUI, home addresses/layouts, visitor details, access-device values, combinations, floor plans, detailed logs and evidence in approved protected storage. This website does not receive completed worksheets or exercise answers.
Protect the places where people can touch a system, remove equipment or see work in progress. Identify who is allowed physical access, then check systems, equipment and their operating environments separately. A Microsoft account or building tenancy does not grant physical authorization.
Official requirement and assessment objectives
Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.
NIST SP 800-171A, June 2018. Determine if:
Official objectives for 3.10.1
Objective
Official text
3.10.1[a]
authorized individuals allowed physical access are identified.
3.10.1[b]
physical access to organizational systems is limited to authorized individuals.
3.10.1[c]
physical access to equipment is limited to authorized individuals.
3.10.1[d]
physical access to operating environments is limited to authorized individuals.
What to do
Identify authorized people and areas
Use the approved boundary and facility records to identify systems, equipment, rooms and operating environments. Name the role approving access and keep the actual authorized-person list in restricted storage. Distinguish employees, service personnel, visitors and landlord access. Include local networking, printers and other equipment supporting the CUI system.
Apply physical restrictions to the actual scope
Use appropriate controlled entrances, locks, cabinets, equipment placement and accountable keys or badges. Check access to the system itself, associated equipment and the area in which it operates. An unlocked equipment closet inside a controlled building may still allow access beyond the approved list. Coordinate with the facility owner and preserve safe emergency egress.
Compare authorization with actual access
Review approved lists against issued devices and actual practices, including changes of role and departure. With authorization, observe an ordinary access/denial check using designated participants; do not attempt entry, tailgating or lock bypass. Record what was observed, what remains unknown and any landlord/provider restrictions on evidence.
Check each objective
Record what you observed, the evidence reference and anything still unknown. A plan, cloud assurance report or completed template only supports the controls and responsibilities it actually addresses.
3.10.1[a]
Identify the current approved individuals and their permitted physical areas; verify who approves and updates access.
Records to keep: Restricted authorized-person list, area/system scope, approval and change references.
3.10.1[b]
Observe how actual physical access to sampled organizational systems is restricted to the approved people.
Records to keep: System references, effective physical restrictions and authorized observation results.
3.10.1[c]
Check physical restrictions on equipment, including relevant network, printer and support equipment.
Records to keep: Equipment/location references, approved access and actual controlled-access checks.
3.10.1[d]
Check access to the operating environments where the systems and equipment are used or housed.
Records to keep: Restricted area references, entry arrangements, landlord duties and actual observations.
Records to keep
Approved physical areas, systems/equipment and accountable access approvers, using restricted references.
Authorized-person list, physical control checks, role/departure changes and unresolved access gaps.
If a check fails
If an area or device is accessible beyond authorization, protect the affected equipment and information using an approved temporary arrangement. Notify the responsible facility/system roles, consider the incident route for possible unauthorized access, correct the control and recheck it before restoring the affected use. Do not compromise emergency access or egress.
Working with a small budget
Start with existing controlled entrances, suitable cabinets, keys and a maintained access list. Locks, landlord changes and secure equipment placement may cost money. Windows authentication helps logical access but does not prevent someone opening a room or taking a device.
Protect and monitor facilities and support infrastructure
A locked office does not show that the wiring closet, power, cooling or other support infrastructure is protected and monitored. Treat protection and monitoring as separate checks for both the facility and the infrastructure supporting the systems.
Official requirement and assessment objectives
Protect and monitor the physical facility and support infrastructure for organizational systems.
NIST SP 800-171A, June 2018. Determine if:
Official objectives for 3.10.2
Objective
Official text
3.10.2[a]
the physical facility where organizational systems reside is protected.
3.10.2[b]
the support infrastructure for organizational systems is protected.
3.10.2[c]
the physical facility where organizational systems reside is monitored.
3.10.2[d]
the support infrastructure for organizational systems is monitored.
What to do
Map facilities and their supporting infrastructure
Identify the facilities and relevant power, communications/cabling, environmental systems and other support dependencies. Record which organization protects and monitors each part, including shared buildings, landlords and service providers. Do not place detailed floor plans, camera locations, alarm codes or home addresses in an ordinary tracker.
Verify protection for both parts
Check safeguards appropriate to the environment, such as controlled access, secured utility/network areas, equipment enclosures and protection of relevant power or environmental components. Coordinate with qualified facility staff; do not open electrical panels, disable alarms or interfere with safety systems. A provider brochure does not establish protection at a contractor office.
Verify monitoring and the response route
Check the selected monitoring for the facility and support infrastructure separately, responsible responders, coverage limitations and actual review/response records. Monitoring can use suitable staffed observations, access/alarm information or environmental alerts where appropriate; cameras are not the only option. Obtain authorization for any harmless test, preserve safety and record untested alarm paths honestly.
Check each objective
Record what you observed, the evidence reference and anything still unknown. A plan, cloud assurance report or completed template only supports the controls and responsibilities it actually addresses.
3.10.2[a]
Check implemented protection at the physical facilities housing the in-scope systems.
Records to keep: Facility responsibility/control references and actual inspection or applicable provider assurance.
3.10.2[b]
Check protection of the actual support infrastructure, including relevant shared or landlord-managed parts.
Records to keep: Infrastructure scope, responsible parties, safeguards and observed protection limitations.
3.10.2[c]
Check the facility is monitored and that observations or alerts reach responsible people.
Records to keep: Monitoring coverage, response assignments and actual review or approved check records.
3.10.2[d]
Check monitoring covers the support infrastructure and has a working escalation route.
Records to keep: Relevant monitoring/alert references, owner/provider duties and actual review or safe test results.
Records to keep
Facility and support dependency references, protection/monitoring responsibilities and provider/landlord evidence boundaries.
Actual inspections, monitoring reviews, approved safe checks, response records and unresolved coverage gaps.
If a check fails
Use the approved facility and incident procedures if a protection or monitoring gap is discovered. Arrange a safe temporary location or pause the affected use when needed. Involve qualified facilities staff for power/environmental faults, preserve relevant evidence and recheck coverage and escalation after correction. Do not disable safety equipment for a test.
Working with a small budget
Existing responsible staff, controlled rooms and suitable monitoring may cover parts of the need. Sensors, alarm services, secure utility areas and provider changes may add costs. Record what existing controls actually cover before selecting a paid monitoring product.
Signing in a visitor does not keep them with an escort or show what they do. Arrange an accountable escort throughout the relevant visit and monitor visitor activity in the protected area, including service and building personnel when treated as visitors under your approved process.
Official requirement and assessment objectives
Escort visitors and monitor visitor activity.
NIST SP 800-171A, June 2018. Determine if:
Official objectives for 3.10.3
Objective
Official text
3.10.3[a]
visitors are escorted.
3.10.3[b]
visitor activity is monitored.
What to do
Authorize the visit and assign an escort
Confirm the purpose, approved area and responsible host through the established visitor process. Identify an authorized escort and backup, explain permitted activity and protect CUI from viewing. Keep necessary visitor identity/contact details in the approved restricted visitor record, not in the public template or an ordinary action tracker.
Maintain escort and monitor activity
Meet the visitor at the controlled point, maintain the approved escort arrangement and observe activity through the visit. Include moves between rooms, service work and any escort handoff. A temporary badge, sign-in entry or camera recording by itself does not establish that the visitor was escorted and monitored. Follow approved privacy and facility arrangements without making assumptions about surveillance permissions.
Close the visit and check exceptions
Confirm departure, recover or disable temporary access as appropriate, and record the actual visit/escort and relevant exceptions in restricted storage. Use a fictional walk-through or authorized designated participants to check handoffs. Report an unattended or unexpected visitor through the approved route; do not stage an unannounced intrusion.
Check each objective
Record what you observed, the evidence reference and anything still unknown. A plan, cloud assurance report or completed template only supports the controls and responsibilities it actually addresses.
3.10.3[a]
Observe whether visitor escort arrangements operate through arrival, movement, handoffs and departure.
Records to keep: Visitor procedure, designated escort and restricted actual visit/observation references.
3.10.3[b]
Check visitor activity is monitored during the relevant visit and exceptions are handled.
Records to keep: Monitoring responsibilities, actual observations and exception/escalation records.
Records to keep
Approved visitor/escort procedure, responsibilities and restricted visitor record location.
Actual escort and activity-monitoring observations, handoffs, departure/access recovery and exceptions.
If a check fails
When an escort is unavailable or lost, stop the affected visit and move to the approved safe waiting/exit process. Protect exposed information and notify the responsible host/security role. Handle possible disclosure or unauthorized entry through Incident Response and verify the escort/monitoring correction before continuing.
Working with a small budget
An accountable host, clear visitor process and restricted paper or Office record can be useful starting points. Staff time, controlled reception and badge/access changes still need resourcing. A visitor-management subscription cannot supply an escort or monitor activity by itself.
Keep usable records of physical access to the protected scope. A Windows sign-in or cloud audit event records a different event from someone entering a room, opening a cabinet or visiting a facility.
Official requirement and assessment objectives
Maintain audit logs of physical access.
NIST SP 800-171A, June 2018. Determine if:
Official objectives for 3.10.4
Objective
Official text
3.10.4
Determine if audit logs of physical access are maintained.
What to do
Define the physical events and record method
Identify the relevant entry points, areas and physical access events, including the arrangements for keys/manual logs and provider-held records. Select an appropriate physical access log method and define the fields, responsible role, review approach, access protection and organization-approved retention/disposal. This guide does not prescribe a universal retention period.
Maintain protected and retrievable records
Keep actual physical access records under the approved process, with enough context to understand who or what access reference, location reference and time/event occurred. Protect against unauthorized access or alteration and check that provider/landlord records can be obtained when needed. Keep personal visitor details, badge identifiers and detailed entry history in restricted evidence storage.
Trace a permitted sample to the actual log
Use an authorized known physical event to check that the expected record exists, is intelligible and can be retrieved by the responsible role. Document logging outages, missing records or clock/context problems. Review required retention and any evidence hold before disposal. Do not create an invented entry to fill a missing historical record.
Check each objective
Record what you observed, the evidence reference and anything still unknown. A plan, cloud assurance report or completed template only supports the controls and responsibilities it actually addresses.
3.10.4
Trace representative actual physical access events to maintained, protected and retrievable physical access audit logs, including relevant manual/provider arrangements.
Records to keep: Approved physical-log scope/method, restricted samples, retrieval/review and missing-record actions.
Records to keep
Physical-log scope, methods, responsible role, approved retention/disposal and restricted record locations.
Actual access record/retrieval checks, logging gaps, provider evidence and corrective actions.
If a check fails
For missing or unavailable logs, preserve the records that exist, notify the responsible role and use an approved temporary recording method. Investigate the loss and possible unauthorized access, restore collection/retrieval and record the period and scope that remain unverifiable. Do not backfill events as if they had been recorded at the time.
Working with a small budget
A controlled manual log may be appropriate in some settings; electronic access systems can provide other useful records. Check the actual coverage, maintainability and protection. Microsoft cloud sign-in logs do not replace physical access logs, even when already included in a subscription.
Identify control and manage physical access devices
Know which keys, badges, tokens, combinations or other physical access devices exist, who controls them and how their access changes. A list without issuance, return and change procedures leaves access devices unmanaged.
Official requirement and assessment objectives
Control and manage physical access devices.
NIST SP 800-171A, June 2018. Determine if:
Official objectives for 3.10.5
Objective
Official text
3.10.5[a]
physical access devices are identified.
3.10.5[b]
physical access devices are controlled.
3.10.5[c]
physical access devices are managed.
What to do
Identify devices and accountable owners
Inventory physical access devices and the areas/equipment they open, including spares, temporary devices and devices held by landlords or providers where relevant. Use restricted identifiers and custody references in the tracker. Keep actual combinations, key-cutting details, badge values and sensitive access mappings in protected storage.
Control issue use storage and return
Authorize device issue to the approved person and scope, record custody, secure spares and control duplication or sharing under the approved rules. Check return/deactivation when access is no longer required. Physical access may need a separate action from disabling an AD DS or Entra account; confirm any actual badge-system integration instead of assuming it.
Manage loss changes and periodic review
Set organization-approved review and change triggers, including loss, compromise, transfer, termination and changed area permissions. Determine authorized deactivation, reissue, combination change or lock work for the affected device and dependencies. Coordinate with qualified facility staff and emergency arrangements, then verify the actual result and reconcile the inventory.
Check each objective
Record what you observed, the evidence reference and anything still unknown. A plan, cloud assurance report or completed template only supports the controls and responsibilities it actually addresses.
3.10.5[a]
Compare the physical access-device inventory with actual keys, badges, combinations and other devices in scope.
Records to keep: Restricted inventory, device/area references, responsible owner and reconciliation observations.
3.10.5[b]
Check device issue, custody, storage, duplication/sharing restrictions and return are controlled.
Records to keep: Approved issuance and custody records, spare-device controls and return/deactivation evidence.
3.10.5[c]
Trace loss, role/departure and access-change handling to actual device changes and inventory updates.
Records to keep: Defined review/change triggers, authorized change records and actual verification of the outcome.
Records to keep
Restricted physical access-device inventory, authorized issue/custody, spare storage and return records.
Loss/compromise reports, access changes, review decisions and actual deactivation/reissue or lock-change verification.
If a check fails
For a lost, unreturned or compromised access device, invoke the approved facility process promptly and protect the affected area. Decide the scope of deactivation, rekeying or combination changes with authorized staff, preserve relevant records and verify the result. Disabling a Microsoft identity alone does not prove that a physical key or badge stopped working.
Working with a small budget
Use existing issuance and return processes with the free register before buying a new platform. Replacement locks/keys, badge administration and landlord coordination can carry real costs. Avoid storing secret access values in a convenient spreadsheet.
Define and apply physical safeguards when CUI work occurs at a home office, temporary site or another approved location. AVD, MFA and a managed laptop do not protect a room from household members, other occupants or people who can see the screen or reach papers.
Official requirement and assessment objectives
Enforce safeguarding measures for CUI at alternate work sites.
NIST SP 800-171A, June 2018. Determine if:
Official objectives for 3.10.6
Objective
Official text
3.10.6[a]
safeguarding measures for CUI are defined for alternate work sites.
3.10.6[b]
safeguarding measures for CUI are enforced for alternate work sites.
What to do
Define approved sites and safeguards
Identify permitted alternate work arrangements and the approving role. Define measures appropriate to the CUI and site, including authorized people, controlled work/storage areas, screen/paper visibility, secure equipment and end-of-work handling. Define whether printing or local storage is permitted and what to do when a site cannot meet the safeguards. Use restricted site references rather than home addresses or photographs in ordinary records.
Put the safeguards into operation
Confirm the person understands and can apply the approved physical arrangements before affected CUI work. Coordinate endpoint/session controls with the physical controls; protect the local endpoint, printed output and unattended equipment even when the workload runs in the cloud. Household membership, coworking membership or a VPN connection does not authorize access to CUI.
Verify enforcement without collecting private details
Use an approved, proportionate review with restricted evidence references and authorized harmless checks. Verify actual implementation rather than treating a signed policy as sufficient. Review when the location or conditions change. Do not request personal home layouts or visitor details through this website, run unapproved surveillance or perform a surprise home inspection.
Check each objective
Record what you observed, the evidence reference and anything still unknown. A plan, cloud assurance report or completed template only supports the controls and responsibilities it actually addresses.
3.10.6[a]
Check that alternate-site CUI safeguarding measures and approval/stop conditions are defined for the actual work arrangements.
Records to keep: Approved alternate-site procedure, required safeguards, scope/approval and restricted site references.
3.10.6[b]
Check those safeguards are applied at actual approved alternate sites, including local equipment, visibility, storage and permitted output.
Records to keep: Authorized implementation review, actual harmless check results, changes and unresolved limitations.
Records to keep
Approved alternate-work scope, defined safeguards, accountable roles and restricted site/evidence references.
Actual enforcement checks, changed conditions, stop/relocation decisions and corrective verification.
If a check fails
If the site cannot provide the approved safeguards, pause the affected CUI activity and use an approved alternative location or method. Protect equipment and records, report possible exposure through the incident route and verify the safeguards before resuming. Do not approve the site only because cloud authentication succeeds.
Working with a small budget
Start with an appropriate controlled workspace, existing storage and clear handling rules. Suitable locks, secure containers, privacy arrangements or relocation may still cost money. Optional Intune or AVD features support endpoint/session controls and need their own entitlement; they do not supply physical security at home.
Microsoft setup paths and the physical procedures beside them
First record the tenant, service instance, endpoint/session-host join, Windows edition, management authority and actual location. These examples have not been tested in a Microsoft tenant. Authorize changes, limit the test scope and agree recovery first. Logical authentication and session controls support the system; they do not replace locks, visitor escort, equipment custody or alternate-site physical safeguards.
Facility and equipment procedures for every deployment
Maintain a restricted list of authorized people and physical areas. Compare that list with actual keys, badges and access restrictions for the system, equipment and operating environment. Include relevant shared and landlord-managed areas.
Arrange protection and monitoring for the facility and its support infrastructure. Verify the responsible response route. Coordinate any safe inspection or harmless check with qualified facility personnel and preserve emergency egress.
Assign an escort and monitor visitor activity, including handoffs and departure. Maintain actual physical access logs and controlled issue/return/change records for physical access devices.
Approve alternate-site safeguards and verify that they operate before the affected CUI work. Use restricted evidence references. If the site cannot apply the safeguards, pause that work and use an approved alternative.
AD DS only and hybrid joined Windows
Keep facility access changes separate from AD DS account actions unless an actual integration and its outcome have been verified. For a supporting unattended-session lock, review Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → Security Options → Interactive logon: Machine inactivity limit in the relevant Group Policy. On a suitable standalone device, review the corresponding local security policy. Select a period appropriate to the approved work/location; this guide sets no universal timeout.
Microsoft documents screen-saver prerequisites, seconds for this policy, a disabled value of zero/blank and a restart requirement. Check the source before rollout, coordinate a maintenance window and confirm the effective policy and actual lock/unlock on an authorized test device with harmless content. Hybrid join does not settle GPO/MDM conflicts. A locked screen still leaves the equipment and room physically accessible.
Microsoft Entra joined Windows
Entra join alone does not manage the room or deploy a lock policy. With eligible MDM management, review the supported LocalPoliciesSecurityOptions/InteractiveLogon_MachineInactivityLimit setting through the applicable Intune configuration surface or documented CSP path. Confirm edition/build support, units shown in that surface, assignment, conflicts and actual behavior. Where supported, controlled local Windows policy is another option. Intune requires the relevant entitlement and enrollment; do not assume it from Office installation.
Commercial Microsoft 365 and Azure
Map the actual service to customer and provider responsibilities. Azure documents datacenter physical controls, but retain applicable assurance and responsibility evidence for the service in use. Your own office, network closet, printers, endpoints and approved alternate sites remain in your physical review. A commercial subscription or general certification list does not establish CUI suitability or satisfaction of every objective.
GCC, GCC High and Azure Government
Identify the identity tenant and each service separately. National clouds use distinct endpoints and some capabilities differ. Check the actual government service, entitlement, provider responsibility/evidence and feature availability before adapting a commercial configuration path. GCC, GCC High and Azure Government are not interchangeable labels. Government cloud hosting does not inherit physical protection for the contractor facility or a home workspace.
Azure Virtual Desktop and alternate sites
Record the actual client, local endpoint, session host and management path. Microsoft recommends idle screen locks and session limits; choose and verify the supported host policy for your deployment with authorized harmless checks. Check the client and session host separately, confirm lock/unlock behavior and assess application/user impact before change. Disconnect, lock and sign-out have different effects; do not infer physical safeguarding or session termination from one visible disconnected screen.
Apply alternate-site measures to the local screen, keyboard, device, workspace, papers and permitted output. AVD does not stop another occupant viewing a screen or opening a cabinet. If a lock check fails, protect the workstation through the approved temporary handling route, correct the scoped policy and recheck it. If site safeguards fail, use an approved alternative before resuming affected work.
Included tools and optional costs
Use the free Office materials, existing controlled areas, suitable storage and supported local Windows/GPO options where appropriate. Intune management and AVD have their own prerequisites and entitlements. Physical locks, badge changes, controlled reception, monitoring services and suitable alternate-work arrangements may require spending regardless of the Microsoft plan. Choose any purchase from the actual physical gap and responsibilities.
These situations are fictional. Discuss them with the facility lead, system owner, visitor hosts, access-device custodian and alternate-work approver. Use the Word exercise pack for facilitator notes. Record what participants actually did and what was only proposed. These example answers are not test results.
Supports 3.10.1, 3.10.2, 3.10.3, 3.10.4
The repair visitor is signed in but the escort leaves
In this fictional situation, a building repair visitor signs in and receives a temporary badge. The host leaves to answer a call while the visitor continues near equipment. A support closet is unlocked, and the team cannot identify who monitors its power and environmental alerts. The building entry system has a record, but no one has checked that physical access logs for the relevant areas can be retrieved.
Discuss
Who is authorized for the areas and who must escort and monitor the visitor?
Which facility and support infrastructure protection and monitoring checks remain open?
Which actual physical access records would need to be maintained and retrieved?
What a useful response includes
Pause the affected visit, protect CUI and equipment, and follow the approved waiting/escort handoff process. Check both continuous escort and activity monitoring.
Check authorized access to systems, equipment and operating areas. Assign separate protection and monitoring checks for the facility and support infrastructure with the responsible facility/landlord roles.
Plan an authorized trace of a known physical event to the appropriate restricted logs. Record missing coverage and follow the incident route if actual unauthorized access or disclosure is suspected.
Lesson: A sign-in entry and badge do not establish escort, monitored activity or protection and monitoring of the support infrastructure.
Record: Keep fictional area and event references, expected versus discussed actions, responsible roles and proposed verification. No real visitor entry, alarm test or incident is represented.
Supports 3.10.1, 3.10.4, 3.10.5
The account was disabled but the cabinet key was not returned
In this fictional situation, a role transfer removes a person's need to enter a protected equipment area. Their Microsoft account access changes, but the physical-device inventory still assigns them a cabinet key and a temporary badge. The team has no evidence of return, deactivation or a decision about copies. It proposes closing the action because the cloud account no longer signs in.
Discuss
What does the identity change leave unresolved for physical access?
How should the key, badge, spares and possible duplication be identified, controlled and managed?
What would verify the actual access change without attempting unauthorized entry?
What a useful response includes
Keep the physical access action open. Review the approved area list and responsible facility role; do not assume Microsoft account changes affect independent keys or badge systems.
Use the restricted inventory and custody records to trace return/deactivation, loss or duplication concerns, and the authorized reissue, rekeying or combination-change decision where needed.
Arrange an approved designated-participant check and review relevant physical records. Record actual outcomes, inventory reconciliation, residual uncertainty and incident escalation as appropriate.
Lesson: Physical access devices need their own controlled lifecycle and verification, even when identity and employment processes are linked.
Record: Record fictional device and change references, missing custody evidence, approved next actions, owner and due date. No real deactivation, lock change or access attempt is part of this discussion.
Supports 3.10.1, 3.10.2, 3.10.6
The cloud report does not cover the shared home workspace
In this fictional situation, a team uses AVD and points to a cloud provider's datacenter assurance report. A proposed alternate work site shares a room with other occupants, has no agreed secure storage and permits printing without a handling decision. The endpoint screen locks, but nobody has defined or checked the physical safeguards for that site. The team proposes putting home addresses and photos in a widely shared tracker.
Discuss
Which responsibilities can be supported by actual provider evidence and which stay with the organization?
What safeguards must be defined and enforced before the affected alternate-site work?
How can the team verify implementation while keeping personal home details restricted?
What a useful response includes
Map the actual provider service, evidence scope and inherited responsibilities. Keep the contractor facility, endpoint, local equipment and alternate-site controls in the organization's review.
Define and approve controls for authorized access, visibility, equipment/storage, unattended work and permitted printing. If the site cannot apply them, pause the affected work and use an approved alternative.
Use restricted site/evidence references and an authorized proportionate review with harmless content. Record what was checked and what remains untested. AVD and screen locks support technical controls but do not replace the physical safeguards.
Lesson: Cloud datacenter evidence covers the responsibilities it actually addresses. It does not secure the room, local endpoint or paper at an alternate work site.
Record: Keep fictional site references, provider responsibility decisions, defined safeguards, proposed checks and open actions. No home address, photo, personal visitor detail, CUI or live configuration change is needed.
Five free Word and Excel materials
Download a copy and adapt it in your approved environment. Blank inputs and fictional examples are separate. Use restricted references and keep actual home/visitor details, physical access secrets, detailed logs and evidence in protected storage. The templates do not calculate a compliance score.
Excel
Physical areas and safeguards register
Map physical areas, systems, equipment, authorization, facility and support safeguards, visitors, logs and provider responsibilities.
Ready for record review means a row is prepared for someone to examine. It is not verified physical protection, visitor authorization, approved alternate-site work or a compliance finding. Keep remaining limitations and next actions explicit.
Turn an unverified physical control into an assigned action
In a fictional review, a shared support closet is locked, but nobody can identify who monitors the relevant infrastructure alerts or responds to them. The team keeps 3.10.2[d] as Evidence to check in the Level 2 gap-and-action worksheet. It links a restricted area record, assigns the facility lead to clarify the landlord duties and plans an authorized harmless escalation check. It records the actual later outcome before resolving the action.
Use Access Control for logical permissions, Personnel Security for transfer and departure coordination, Media Protection for paper and device custody, and Incident Response for suspected unauthorized access or disclosure. Keep those decisions linked to their own actual evidence.
Sources and limits
Reviewed October 28, 2026. This series uses NIST SP 800-171 Revision 2 and the June 2018 assessment procedures for CMMC Level 2. Later standards and product guidance do not replace the selected baseline. Technical actions remain untested in a tenant. Choose controls and evidence for the actual boundary, cloud, deployment and obligations; this guide gives no universal monitoring technology, surveillance permission or log-retention period.
Map the actual service and customer/provider duties. Provider datacenter controls do not establish protection at contractor premises or alternate sites.
Cloud instances use different endpoints and may differ in features. Confirm each identity tenant and service rather than assuming commercial/government parity.