3.10.2 — Watch the Building
What It Says
Section titled “What It Says”Protect and monitor the physical facility and support infrastructure for organizational systems.
What It Actually Means
Section titled “What It Actually Means”Four things assessed: the facility is protected (locks, barriers), the support infrastructure is protected (power, cabling, HVAC), the facility is monitored (cameras, alarms), and infrastructure is monitored (environmental alerts). For most DIB contractors: CCTV on entry points and server rooms, alarm system, UPS/generator for servers, temperature monitoring in the server room, and fire suppression.
Pass or Fail
Section titled “Pass or Fail”Your assessor needs a “yes” to every row:
| # | Question | What “yes” looks like |
|---|---|---|
| 1 | Is the physical facility protected? | Locks, doors, barriers adequate for CUI areas |
| 2 | Is support infrastructure protected? | Power (UPS), cabling secured, HVAC for server room |
| 3 | Is the facility monitored? | CCTV on entries and server room; alarm system; footage retained |
| 4 | Is infrastructure monitored? | Temperature, humidity, power alerts for server room |
What to Have Ready on Assessment Day
Section titled “What to Have Ready on Assessment Day”Documents they’ll review: Physical and environmental protection policy; monitoring procedures; CCTV configuration and retention settings; alarm system documentation; environmental monitoring records; system security plan
People they’ll talk to: Personnel with physical access responsibilities; information security personnel
Live demos they’ll ask for: “Show me your security cameras — what do they cover?” “How long is footage retained?” “Show me environmental monitoring in the server room.” “What happens if the alarm triggers after hours?”
The Assessor’s Playbook
Section titled “The Assessor’s Playbook”These are the actual questions. Have answers ready.
- “Show me your security cameras — do they cover server room entries?”
- “How long is camera footage retained?”
- “Do you have environmental monitoring in the server room?”
- “What happens if the alarm triggers after hours?”
Where Companies Trip Up
Section titled “Where Companies Trip Up”No cameras or alarms. Entry points unmonitored. Install CCTV on all entries to CUI areas and server rooms.
Cameras nobody watches. Recording exists but nobody reviews footage or responds to motion alerts. Configure after-hours motion alerts.
No environmental protection. Server room without UPS, temperature monitoring, or fire suppression. These are all assessable.
How to Talk About This
Section titled “How to Talk About This”Connected Requirements
Section titled “Connected Requirements”| Requirement | Why it matters here |
|---|---|
| 3.10.1 — Lock the Doors | Physical access controls that monitoring supports |
| 3.10.4 — Log Physical Access | Camera footage supplements badge access logs |
Implementation
Section titled “Implementation”Step-by-step guides for Microsoft 365, AWS, Azure, and GCP are available to Ancitus clients.
Start a conversation →CMMC Practice ID: PE.L2-3.10.2 | SPRS Weight: 5 points | POA&M Eligible: No