# NIST 800-171 3.10.5 Control and manage physical access devices.

- Source: https://support.icompaas.com/support/solutions/articles/62000229325-nist-800-171-3-10-5-control-and-manage-physical-access-devices-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [NIST](https://support.icompaas.com/support/solutions/62000112528) › [800-171](https://support.icompaas.com/support/solutions/folders/62000168440)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description:**   

Physical access devices include keys, locks, combinations, and card readers. 

  

**Priority**: High   

  

**Category**: Physical Security 

  

**Services Associated with AWS:**   

NA 

  

**Objective Evidence:**   

-   Administrative: documented policies, standards & procedures
-   Administrative: supporting documentation to demonstrate how Physical Role Based Access Control (P-RBAC) is implemented 

  

Possible Technology Considerations : 

-   Physical Access Control (PAC) 

  

**What needs to be answered :**  

  

Are physical access devices (such as card readers, proximity readers, and locks) maintained and operated per the manufacturer recommendations? Are these devices updated with any changed access control information necessary to prevent unauthorized access? Does the facility/building manager review the location and type of each physical access device and evaluate its suitability for the company’s needs? Are keys, combinations, and other physical access devices secured? 

-   Physical Access Device Control and Management  
    Description: This check focuses on the control and management of physical access devices used to secure organizational facilities. Physical access devices include keys, locks, combinations, and card readers. Organizations need to establish appropriate controls and processes to effectively control and manage these devices. 

  

**More Details:**   

No CUI stored in company facilities. All CUI storage done via AWS services.

## Related compliance guidance

- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): How the 800-53 catalogue, baselines and the Risk Management Framework fit together, and which controls take the most work in the cloud.
- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): If the driver is a DoD or federal contract handling CUI, 800-171 (and CMMC) is the scope you actually need.