EVIDENCE COLLECTION GUIDE • COLLECTING EVIDENCE
Requirements 8 and 9: limiting physical access, managing visitors, and controlling keys
KB-035 | Applies to: All plans | Last reviewed: October 1, 2026 | Maintained by AffirmReady Support
Physical Protection is about who can walk into the places where your computers, network equipment, and paper records are kept. Most of this evidence is simple to collect and does not require any technical knowledge.
Who usually collects this
The office manager or owner.
Requirement 8: Limit physical access
What you are showing: only authorized people can get into your office and especially the areas where network equipment and servers are kept.
- A short written description of how the office is secured, such as locked doors after hours, an alarm, or a reception desk.
- A photo of the locked network closet or server area, or a note describing where network equipment is kept and how it is secured.
- If you use badges or door codes, a list of who has access.
Requirement 9: Manage visitors, keep access records, and control keys and badges
What you are showing: visitors are escorted and supervised, you keep a record of who came in, and you know who holds keys, badges, or door codes.
- Your visitor sign-in log. A few recent pages or a recent export is enough. Paper logs can be scanned.
- A short visitor procedure stating that visitors sign in and are escorted while in work areas.
- A key, badge, and door code list showing who holds each one.
- A record showing keys or badges are collected and codes are changed when someone leaves, such as a note on the key list.
A simple key and badge list
| Holder | Item | Issued | Returned or changed |
|---|---|---|---|
| Jane Smith | Front door key #3 | 2024-02-01 | |
| Former employee | Alarm code | 2023-05-10 | Code changed 2026-08-30 |
If you work from a shared building or home office, describe how your space and equipment are secured in your setting. The goal is the same: only authorized people can get to your systems and records.
Checklist
| # | Evidence | Typically from | Collected |
|---|---|---|---|
| 8 | Description of office security | Owner or office | ☐ |
| 8 | Network equipment location and lock | Owner or office | ☐ |
| 8 | Badge or door code access list | Owner or office | ☐ |
| 9 | Visitor sign-in log samples | Owner or office | ☐ |
| 9 | Visitor escort procedure | Owner or office | ☐ |
| 9 | Key, badge, and code list | Owner or office | ☐ |
| 9 | Record of returns and code changes | Owner or office | ☐ |
Where to save it
Save everything from this guide in your own evidence folder under CMMC L1 Evidence / 4 Physical Protection, then record the location in AffirmReady for each requirement. AffirmReady does not store evidence files, so your evidence stays in systems your company controls.
Need help?
If you have questions about physical security evidence, Email support@affirmready.com and include your company name and the email address on your AffirmReady account. Our team is available Monday through Friday, 8:00 AM to 5:00 PM Eastern, and typically responds within one business day.