CMMC Level 1 Certification in 17 Steps (Part 2)

In this CMMC Level 1 certification article, we address two security domains that are applicable to CMMC Level 1 Certification (for v2.0), namely Physical Security (PE), and Media Protection (IA). Check out Cyber AB’s CMMC guidelines for further information here.

---

---

Have you read the CMMC Level 1 Certification Steps (Part 1)? Read it here

What are the CMMC Level 1 certification requirements for MP and PE domains?

MP.L1-3.8.3: Media Disposal

Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.

Consideration factors:

Contractors seeking for CMMC Level 1 certifications should be in a position of answering “Yes” for the following question:

Is all managed data storage erased, encrypted, or destroyed using mechanisms to ensure that no usable data is retrievable?

Expectations to meet this requirement:

Any media, such as computer hard-drive, mobile device, flash drive, CDs/DVDs, as well as documents containing FCI must be erased, encrypted, shredded, or destroyed before they are disposed or recycled. Demonstrated process to show one of the accepted sanitization methods is used in the organization:

1. Crushing and destroying the media module
2. Encrypting the data inside with a long (16+ character) key
3. Overwriting the data many times using a special program
4. Degaussing the media module
5. Shredding the documents and CD/DVD with cross-cut shredders

PE.L1-3.10.1: Limit Physical Access

Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.

Consideration factors:

Contractors seeking for CMMC Level 1 certifications should focus on physical access to facility, machines, equipment, and system components which can store, process or generate FCI.

Expectations to meet this requirement:

1. List of personnel, including contractors and vendor employees who access your facility, is developed and facility access credentials are issued.
2. The areas where FCI is handled are identified and marked accordingly.
3. Physical security protection methods are in place, such as guards, locks, cameras, and card readers to limit the access to sensitive areas. Only those who are identified and authorized can access with their own badges/key cards/keys.
4. FCI processing/handling machines (computers, laptops, operating machines, servers, network appliances) and printers are all located inside the protected areas. If printer is outside of the secured area, its use must be initiated by an authorized person after login (i.e., on-demand encrypted printing). No FCI should be sent to a printer for an instant printing if the printer is outside of the protected area.
5. Doors to protected/secure areas are self-closing and locking.
6. No network wiring passes through the unsecured areas.

PE.L1-3.10.3: Escort Visitors

Escort visitors and monitor visitor activity.

Consideration factors:

Contractors seeking for CMMC Level 1 certifications should be in a position of answering “Yes” for the following questions:

1. Are personnel required to accompany visitors to areas in a facility with physical access to organizational systems?
2. Are visitors clearly distinguishable from regular personnel?
3. Is visitor activity monitored (e.g., use of cameras or guards, reviews of secure areas upon visitor departure, review of visitor audit logs)?

Expectations to meet this requirement:

1. Demonstrated process of visitors being escorted.
2. Visitors are given a different color or type of badge to distinguish them, and their use of the badge is enforced.
3. A visitor log exists with a necessary information captured, such as their names, contact information, company worked, visited person name, time in/out.
4. Visitor activity is further monitored with cameras and/or guards.

PE.L1-3.10.4: Physical Access Logs

Maintain audit logs of physical access.

Consideration factors:

You should be in a position of answering “Yes” for the following questions:

1. Are logs of physical access to sensitive areas (both authorized access and visitor access) maintained per retention requirements?
2. Are visitor access records retained for as long as required?

Expectations to meet this requirement:

1. A visitor log exists with minimally necessary information captured, such as names, company worked, visited person name, time in/out. Visitor logs are retained per company record retention policy, which should typically be not less than a year.
2. In addition to visitor access, all access to the secure areas must be logged by the access control devices and logs are retained in a secure place for the retention period.

PE.L1-3.10.5: Manage Physical Access

Control and manage physical access devices.

Consideration factors:

You should be in a position of answering “Yes” for the following questions:

1. Is the inventory of physical access devices maintained (e.g., keys, facility badges, key cards)?
2. Is access to physical access devices limited (e.g., granted to, and accessible only by, authorized individuals)?
3. Are physical access devices managed (e.g., revoking key card access when necessary, changing locks as needed, maintaining access control devices and systems)?

Expectations to meet this requirement:

1. An inventory of physical access devices, such as keys, badges, and key cards.
2. A secure location for keys, badges, and keycards where access is authorized only to identified persons.
3. A process outlining how the access devices are maintained and updated, period of updates, etc. Electronic keycards are considered one of the best as regular keys will need to be changed when an employee/contractor leaves..

---

CMMC Level 1 Certification Steps (Part 3)? Read it here

Linqs offers comprehensive CMMC Level 1 assessment services