Cyber AB CMMC-CCA Exam With Confidence Using Practice Dumps

The Physical and Environmental Protection (PE) Policy is the governing artifact that describes how physical access to facilities and environments is managed and controlled. While the SSP provides a system-wide overview, and access lists provide details of who is authorized, it is the PE Policy that explicitly documents the physical access control measures required under CMMC.

Extract from PE.L2-3.10.1:

“Organizations must develop, document, and disseminate physical and environmental protection policies that govern how access to buildings and systems containing CUI is limited to authorized individuals.”

CMMC Level 2 requires that network access to CUI systems be restricted to authorized users and devices. A guest network without password protection that connects directly into the LAN violates AC.L2-3.1.3 (Access Enforcement) and SC.L2-3.13.16 (Cryptographic protection) because unauthorized users may access OSC systems and CUI indirectly.

Exact Extracts:

AC.L2-3.1.3: “Control the flow of CUI by enforcing access restrictions.”

SC.L2-3.13.16: “Employ cryptographic mechanisms to protect confidentiality of CUI during transmission.”

Assessment Guide: “Guest wireless networks must be segmented and controlled to prevent unauthorized access to internal networks containing CUI.”

Why other options are not correct:

A: Additional assessment is irrelevant — issue is failure to meet requirements.

C/D: False — requirements clearly exist, and the OSC’s current setup fails them.

The Physical Protection (PE) practices require that unmanned access points to areas containing CUI be restricted with technical controls that only allow entry to authorized personnel. While cameras, signage, and turnstiles support security, they do not actually prevent access.

Extract from PE.L2-3.10.1:

“Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.”

The strongest measure listed is one-way gates requiring credentials or intercom authorization, which directly enforces access control.