Lock the doors to where the information lives. 6 requirements, 3.10.1 to 3.10.6, 2 of them worth 5 points.
This is an independent guide. Movegistics is not affiliated with or endorsed by Project Spectrum or the Department of War. The information provided in these guides is for general information purposes only. Links to official sources are provided where available. See the Disclaimer for more.
Facts last checked: .
“Usually applies to” lists what a typical moving company has in scope for each requirement; your own scope decides. See what's in scope.
“May wait on a POA&M” applies only if your overall score is at least 88 of 110, and the gap must then be closed within 180 days. See how Level 2 works.
Only authorized people can physically get to the computers, network equipment and rooms where DoD shipment information is handled.
Usually applies to: The office, the dispatch desk, the network closet, and any room or warehouse office where DoD shipment information is handled or kept.
Official wording: “Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.”
Protect and monitor the office and what your systems depend on, such as power, network cabling and the closet where the router lives, with locks, alarms or cameras.
Usually applies to: The same places, and what your systems depend on there: power, network cabling and the closet where the router lives.
Official wording: “Protect and monitor the physical facility and support infrastructure for organizational systems.”
Visitors, such as customers, vendors and delivery drivers, are escorted and watched in areas where DoD shipment information is handled.
Usually applies to: Customers, vendors, delivery drivers, job applicants and other visitors in those areas.
Official wording: “Escort visitors and monitor visitor activity.”
Keep a record of physical access, such as a visitor sign-in sheet or a badge reader's log.
Usually applies to: Entry to the office and to any room where DoD shipment information is handled.
Official wording: “Maintain audit logs of physical access.”
Know who has keys, badges and door codes, collect them when people leave, and change codes when needed.
Usually applies to: Office and warehouse keys, badges, door codes and alarm codes.
Official wording: “Control and manage physical access devices.”
Set rules for working with DoD shipment information at home or on the road, and make sure people follow them, for example a private space, a locked screen and no printing at home.
Usually applies to: Anyone handling DoD shipment information outside the office: estimators at a residence, staff working from home, crew leads on the road.
Official wording: “Enforce safeguarding measures for CUI at alternate work sites.”
Sources: official wording, NIST SP 800-171 Rev 2; points, 32 CFR 170.24; plans of action, 32 CFR 170.21. The plain-English explanations are ours.
