Physical Protection (PE) Family

The Physical Protection (PE) family contains 6 NIST SP 800-171 Rev 2 security requirements covering how the contractor controls physical access to in-scope facilities, equipment, and CUI.

Key PE requirements include limiting physical access to in-scope systems and equipment (PE.L2-3.10.1), protecting and monitoring physical facilities (PE.L2-3.10.2), escorting visitors and monitoring activity (PE.L2-3.10.3), maintaining audit logs of physical access (PE.L2-3.10.4), controlling and managing physical access devices (PE.L2-3.10.5), and enforcing safeguarding measures for CUI at alternate work sites (PE.L2-3.10.6).

A C3PAO will likely tour the facility, verify visitor procedures, sample physical access logs, and ask about teleworking arrangements (especially for employees handling CUI from home).