CMMC Level 1 · RequirementSEC / REQPE.L1-b.1.ix
Physical Protection · PE.L1-b.1.ix
Escort visitors, log physical access, manage devices
Requirement PE.L1-b.1.ix of the fifteen CMMC Level 1 security requirements, in the Physical Protection domain.
Short Answer
What do we owe for visitors and physical access records?
Visitors are escorted and watched, physical access is logged, and keys, badges, and other access devices are tracked and controlled.
Official Requirement
Escort visitors and monitor visitor activity; maintain audit logs of physical access; control and manage physical access devices.
Source · FAR 52.204-21(b)(1)
Requirement identity
- Framework
- Cybersecurity Maturity Model Certification · Level 1
- Domain
- Physical Protection (PE)
- Requirement ID
- PE.L1-b.1.ix
- FAR Clause
- FAR 52.204-21(b.1.ix)
- NIST SP 800-171 Mapping
- 3.10.3, 3.10.4, 3.10.5
Assessment Objectives
Related Requirements
Common Questions
- Do I really need a visitor log for a small office?
- If the office is part of your FCI environment, yes. Level 1 asks you to escort and monitor visitors, keep a log of physical access, and control access devices such as keys and badges. For a small supplier a simple sign-in log and an escort practice usually satisfy the intent.
Source Authority
- Primary Authority
- FAR 52.204-21(b)(1)
- Objectives Authority
- NIST SP 800-171A
- Program Authority
- 32 CFR 170.15(c)(1)(ii) Table 2
- Framework Version
- CMMC Assessment Guide, Level 1 v2.13 (September 2024)
- Effective Date
- 2024-12-16
- Last Verified
- 2026-08
Build the Record Behind This
AssessrLog connects this requirement to its assessment objectives, your evidence, and your determination, and keeps the whole record traceable and ready to affirm. The MET, NOT MET, or N/A call is always yours to make and record.