# CMMC 2.0 PE.1.134 Control and manage physical access devices.

- Source: https://support.icompaas.com/support/solutions/articles/62000229657-cmmc-2-0-pe-1-134-control-and-manage-physical-access-devices-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CMMC](https://support.icompaas.com/support/solutions/62000112530) › [2.0](https://support.icompaas.com/support/solutions/folders/62000168778)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Level 1**

**Description:**   

Physical access devices include keys, locks, combinations, and card readers. 

  

**Priority**: High

**Domain:**  PHYSICAL PROTECTION (PE)    

  

**Category**: Physical Security 

  

**Services Associated with AWS:**   

NA 

  

**Services Associated with Azure:** 

-   **Azure Security Center** 
-   **Azure Key Vault** 
-   **Azure Active Directory (Azure AD)**

  

**Objective Evidence:**   

-   Administrative: documented policies, standards & procedures
-   Administrative: supporting documentation to demonstrate how Physical Role Based Access Control (P-RBAC) is implemented 

  

Possible Technology Considerations : 

-   Physical Access Control (PAC) 

  

**What needs to be answered :**  

  

Are physical access devices (such as card readers, proximity readers, and locks) maintained and operated per the manufacturer recommendations? Are these devices updated with any changed access control information necessary to prevent unauthorized access? Does the facility/building manager review the location and type of each physical access device and evaluate its suitability for the company’s needs? Are keys, combinations, and other physical access devices secured?

**Checks for AWS**  

-   Physical Access Device Control and Management  
    Description: This check focuses on the control and management of physical access devices used to secure organizational facilities. Physical access devices include keys, locks, combinations, and card readers. Organizations need to establish appropriate controls and processes to effectively control and manage these devices. 

**Checks for Azure** 

-   Physical Access Device Control and Management  
     Description: This policy focuses on the control and management of physical access devices used to secure organizational facilities within the Azure environment. Physical access devices may include card readers, proximity readers, and other access control mechanisms. This policy ensures that appropriate controls and processes are established to effectively control and manage these devices in compliance with the organization's security requirements.
-   Compliance with Manufacturer Recommendations  
    Description: This policy check ensures that physical access devices deployed within the Azure environment are maintained and operated per the manufacturer's recommendations. It verifies that any updates or changes to access control information necessary to prevent unauthorized access are promptly applied to the devices.
-   Regular Review of Physical Access Devices  
    Description: This policy check mandates that the facility/building manager regularly reviews the location and type of each physical access device within the Azure environment. The purpose is to evaluate the suitability of each device for the company's current security needs and make adjustments as required.
-   Secure Storage of Physical Access Devices  
    Description: This policy check ensures that keys, combinations, and other physical access devices are properly secured within the Azure environment. It requires that these devices are stored in accordance with the organization's security policies and standards to prevent unauthorized access and potential security breaches.

**More Details:**   

No CUI stored in company facilities. All CUI storage done via AWS services.

## Related compliance guidance

- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): The CUI requirements CMMC Level 2 assesses, the SPRS score, POA&M rules and the phased DFARS rollout.
- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): The federal catalogue 800-171 is derived from — useful when a contract also cites a FedRAMP baseline.