MENU
An OSC is preparing for assessment. Which item of evidence would show the OSC's efforts to restrict physical access within the OSC's environment?
Applicable Requirement: PE.L2-3.10.1 --- ''Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.''
Why D is Correct: Documented procedures describing physical access restrictions (badge policies, visitor management, locked server rooms, guard post orders) serve as primary evidence that access is managed and enforced. Assessors can then corroborate via interviews and observation.
Why Other Options Are Insufficient:
A (VPN configuration): Relates to remote logical access, not physical security.
B (Switch configs): Technical network controls, not physical access.
C (Architecture drawings): Show logical/system design, not physical entry restrictions.
Reference (CCA Official Sources):
NIST SP 800-171 Rev. 2 --- PE.L2-3.10.1
NIST SP 800-171A --- PE.L2-3.10.1 Assessment Objectives
CMMC Assessment Guide -- Level 2 --- Physical Protection Evidence Guidance