Manage Physical Access

Inventory the keys, badges, fobs, and combinations first.

Objective [a] asks that physical access devices are identified: what devices exist, which doors they open, and who holds each one. A spreadsheet with device, area, holder, and issue date answers it.

Control is who gets one. Manage is what happens after.

Issue devices only to people on the authorized access list. Keep spares locked up, and record every issuance for [b]. Then keep the system true over time for [c]. Collect devices at departure, and deactivate lost badges. Change combinations when someone who knows them leaves, and re-key when a perimeter key goes unreturned.

Hand out as few perimeter keys as possible.

Every key to the outer door is a future re-keying decision when it fails to come back. Fewer holders makes departures cheap, and a badge system makes them free, since revocation is a click instead of a locksmith.

An unreturned key is a decision point, not a shrug.

When a departing employee does not return a key, either re-key the affected locks or record the accepted risk with a reason. What fails is an inventory that says twelve keys and a drawer that holds nine with no explanation.

This requirement is barred from any POA&M.

A POA&M, a plan of action and milestones, defers an unmet requirement past the assessment. 32 CFR 170.21(a)(2)(iii) puts PE.L2-3.10.5 on the same barred list as PE.L2-3.10.3 and PE.L2-3.10.4. The device inventory and issuance records have to exist on assessment day, and they are an afternoon of work in a small facility.