Physical security is the part of CPCSC most small suppliers assume they’ve already covered. The doors lock, the alarm company comes every year, there’s a camera at the front entrance. Then they read the physical protection family in ITSP.10.171 and realize it asks for something different from a locked door. It asks for proof.
2 of the 13 Level 1 requirements are physical: 03.10.01, physical access authorizations, and 03.10.07, physical access control. Level 2 adds the rest of the family: 03.10.02 for monitoring physical access, 03.10.06 for alternate work sites, and 03.10.08 for access control over transmission lines. An access control system and a camera system, set up properly, produce most of the evidence for all 5.
Who’s allowed in: 03.10.01
The requirement is an approved list of people allowed into the areas where systems holding Specified Information live, issued credentials to match, and a review on a schedule you choose. The access control system already holds the list. What’s usually missing is the review.
Export the cardholders with access to the enclave doors every quarter, compare them to HR’s active list, remove the ones who shouldn’t be there, and keep the export with a date and a name on it. That export is your evidence. The most common finding is a departed employee’s card still active on the server room door, and a quarterly export catches it.
Controlling the door: 03.10.07
This is where the configuration matters.
- Credential technology. 125 kHz proximity cards clone in seconds with cheap hardware. The floor I’d set is 13.56 MHz Seos or iCLASS SE with custom keys, not the standard keyset, in a corporate format such as HID Corporate 1000. HID’s February 2024 advisories (CVE-2024-23806) showed keys could be extracted from iCLASS SE configuration cards and encoders, so keep reader firmware current, lock out configuration-card changes, and disable legacy and 125 kHz technologies at the reader so a cloned old-format card can’t downgrade its way in.
- Reader wiring. Wiegand sends card data in the clear between reader and controller. OSDP with Secure Channel encrypts it, and new installs should use it.
- Card plus PIN on the doors that matter: the server room, the engineering area, secure storage.
- Held-open and forced-door alarms enabled on the enclave doors, routed to someone who’ll respond.
- Visitors logged and escorted, with a visible difference between staff, screened contractors, and visitors. Coloured lanyards and different card designs cost almost nothing, and an assessor sees them in the first 5 minutes.
- Anti-passback and tailgating controls matched to the risk, from signage to a turnstile to a 2-door vestibule. A fastener supplier on a defense program doesn’t need the same as a firm building armoured vehicle subsystems.
Watching the door: 03.10.02
Monitoring means you’d notice, and could reconstruct, who went where. Cameras on the entries and main routes, with at least one identification-grade camera at the enclave entry. A camera that shows somebody walked past isn’t the same as one that shows who it was; thermal cameras detect people but rarely identify them, which is worth knowing before you choose coverage for the door that matters most.
Then join the systems up. The door event, the video at that door, and the user’s login should share a clock. Sync the access controllers, the recorders, and the servers to one time source, as 03.03.07 asks of every system’s time stamps, so an investigation doesn’t start with an argument about which clock was wrong.
The parts people miss: 03.10.06 and 03.10.08
Alternate work sites are the engineer’s home office and the laptop in the truck. If Specified Information goes home, the requirement goes with it, and the rules for protecting it there belong in writing.
Access control for transmission covers the cabling. Network runs through an open warehouse ceiling or a shared riser can be tapped; locked telecom rooms and enclosed pathways for the runs serving the enclave are the fix. Integrators see these runs every day and rarely think of them as a security control.
The systems protecting the systems
Your access control server and VMS hold the evidence, which puts them inside the boundary. They get the same treatment as anything else there: named accounts, MFA where the platform supports it, patching on a schedule, their own network segment, and remote access through a controlled path. A card system on the office network with a shared admin login undermines everything it records.
The evidence pack
When the assessor asks, this is what you hand over:
- Quarterly access list export with reviewer and date
- Door configuration showing held-open and forced alarms on the enclave doors
- A sample door event report for the enclave door
- Camera coverage snapshots for the entries and the enclave door
- The visitor log and the escort rule
- The credential format, key program, and reader configuration
- Time synchronization settings on the controllers and recorders
- The retention periods you chose for door events and video, written in the system security plan
None of this needs new hardware in most buildings. It needs the systems you already own set up to prove what they do. The physical protection page on the CPCSC hub covers each requirement, and there’s a free access review record for the quarterly export.
