CMMC Level 1 · RequirementSEC / REQPE.L1-b.1.ix
Physical Protection · PE.L1-b.1.ix
Escort visitors, log physical access, manage devices
Requirement PE.L1-b.1.ix of the fifteen CMMC Level 1 security requirements, in the Physical Protection domain.
Short Answer
What do we owe for visitors and physical access records?
Visitors are escorted and watched, physical access is logged, and keys, badges, and other access devices are tracked and controlled.
Official Requirement
Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.
Source · FAR 52.204-21(b)(1)
Requirement identity
- Framework
- Cybersecurity Maturity Model Certification · Level 1
- Domain
- Physical Protection (PE)
- Requirement ID
- PE.L1-b.1.ix
- FAR Clause
- FAR 52.204-21(b)(1)(ix)
- NIST SP 800-171 Mapping
- 3.10.3, 3.10.4, 3.10.5Why one requirement maps to 3 NIST requirement numbers
Assessment Objectives
Related Requirements
Guides and Terms
Common Questions
- Do I really need a visitor log for a small office?
- If the office is part of your FCI environment, yes. Level 1 asks you to escort and monitor visitors, keep a log of physical access, and control access devices such as keys and badges. For a small supplier a simple sign-in log and an escort practice usually satisfy the intent.
Source Authority
- Primary Authority
- FAR 52.204-21(b)(1)
- Official Text
- Objectives Authority
- NIST SP 800-171A (June 2018)
- Program Authority
- 32 CFR 170.15(c)(1)(ii) Table 2
- Framework Version
- CMMC Assessment Guide, Level 1 v2.13 (September 2024)
- Effective Date
- 2024-12-16
- Last Verified
- 2026-10-02
Cite This Page
“CMMC PE.L1-b.1.ix: Escort visitors, log physical access, manage devices.” AssessrLog, a product of ProfytAI Pte. Ltd.. Last verified 2026-10-02. https://assessrlog.com/cmmc/requirements/escort-visitors-and-log-physical-access/
Build the Record Behind This
AssessrLog connects this requirement to its assessment objectives, your evidence, and your determination, and keeps the whole record traceable and ready to affirm. The MET, NOT MET, or N/A call is always yours to make and record.