Limit Physical Access

Objective [a] is a list. Write it before you buy a lock.

Name the people authorized for physical access to each controlled area: the building, the office, the server closet. The rest of the requirement limits access to the people on that list, so the list has to exist, stay current, and match who actually holds keys and badges.

Layer the physical controls to match your facility.

A locked exterior door, a lockable office, and a locked closet or rack for network equipment cover [b] and [c] in a small office. Badge readers and electronic locks do the same job with better records. They are worth buying when headcount makes keys unmanageable, not before.

The operating environment is anywhere CUI can be seen or heard.

CUI is Controlled Unclassified Information, the government information your contract obliges you to protect. Objective [d] extends the requirement past the server room. It covers the offices, work areas, and print stations where CUI shows on screens, sits on desks, or comes up in conversation. Define those areas and limit access to them the same way.

Put printers where output is not exposed, or prohibit printing CUI outright.

An output tray in a shared hallway hands CUI to anyone walking past, which fails [c] for that device. Move the printer inside the controlled area. Or write and train a policy that CUI is never printed, and post a sign at the printer saying so.

A shop floor does not need floor-to-ceiling walls.

Fence and lock an enclosure for the equipment inside an access-controlled building. Lock the CUI drawings in a cabinet at the end of the shift. Those layers limit access in a way you can demonstrate. Each layer needs a lock and a defined set of key holders. The material of the barrier matters less than who can pass it.

Policy plus trained people is a real control where hard barriers fail.

A manufacturing bay with doors open for ventilation still passes when signage marks the boundary, visitors sign in and are escorted, and employees are trained to challenge strangers. Write the reasoning down so the assessor sees a decision, not an oversight.