Assessing a DoD contractor, you observe they have implemented physical security measures to protect their facility housing organizational systems…

The CMMC practice PE.L2-3.10.2 requires the organization to "Monitor physical access to the facility where organizational systems are located to detect and respond to physical security incidents." The scenario explicitly states that the contractor has installed video surveillance cameras at entry/exit points and that security personnel monitor the feeds. This is a direct and appropriate implementation of the practice. Therefore, this correctly implemented control is not a concern for the assessor. The other options describe clear deficiencies in the contractor's physical security posture that create vulnerabilities and would be flagged as concerns.

B. Unlocked wiring closets: This is a significant concern as it represents a failure to limit physical access to critical system components, violating the principle of least privilege and creating opportunities for tampering.

C. Network cables hanging from the walls: This is a concern because exposed cabling is vulnerable to unauthorized tapping, physical damage, or disconnection, which could compromise the confidentiality and availability of CUI.

D. Damaged cable conduits: This is a concern because conduits are intended to protect cabling. Damage negates this protection, exposing the infrastructure to the same risks as unprotected, hanging cables.

---

1. Cybersecurity Maturity Model Certification (CMMC) Model Version 2.0, Department of Defense, December 2021.

Reference: Page 43, Domain: Physical Protection (PE), Practice PE.L2-3.10.2. This document specifies the requirement to "Monitor physical access to the facility where organizational systems are located to detect and respond to physical security incidents."

2. CMMC Level 2 Assessment Guide, Department of Defense, December 2021.

Reference: Pages 131-132, PE.L2-3.10.2 (NIST SP 800-171 Control 3.10.2). The guide's assessment objectives include determining if "physical access to the facility...is monitored." The use of video surveillance is a primary method to meet this objective, confirming that its proper implementation (as described in the scenario) is a positive finding, not a concern.

3. NIST Special Publication 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, National Institute of Standards and Technology, February 2020.

Reference: Page 23, Section 3.10.2. This is the source requirement for CMMC PE.L2-3.10.2. The discussion notes for this control family emphasize protecting physical plant and support infrastructure, which includes cabling and wiring closets, making options B, C, and D valid concerns.

4. NIST Special Publication 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations, National Institute of Standards and Technology, September 2020.

Reference: Page 278, Control PE-4, "Access Control for Transmission Medium." This control provides the foundational security principle for protecting cabling from physical tampering or damage. Damaged conduits and hanging cables (Options C and D) directly contradict this principle.