A DoD contractor failed their CMMC assessment last year — not because of a firewall misconfiguration or an unpatched server. It was a video management system sitting inside their facility that had been logging access to a CUI storage room for three years. No audit retention policy. No access controls on the admin console. No integrity monitoring. The assessor flagged it immediately. The re-assessment cost them four months and roughly $180,000 in remediation and contract delays.
That scenario is not unusual. It is the rule, not the exception. Physical security systems have been quietly accumulating compliance debt for years because the conversation around CMMC 2.0 has stayed almost entirely in the IT department. Firewalls get hardened. Endpoints get patched. And meanwhile, the VMS server sitting in the security office closet runs on Windows Server 2012 with default credentials and no audit log retention.
If your physical security infrastructure touches Controlled Unclassified Information — and for most DoD facilities, VA campuses, and federal contractor sites, it does — then it is in scope for CMMC 2.0. Full stop. This post breaks down exactly what that means, which controls apply, and what you need to do before an assessor walks through the door.
Why Physical Security Systems Are In CMMC Scope — And Most Organizations Don't Know It
CMMC 2.0 is built on NIST SP 800-171, which defines CUI protection requirements across 14 control families. The scope of those requirements is not limited to laptops, servers, and cloud systems. Any system that stores, processes, or transmits CUI falls under the framework. That includes physical security systems when they are deployed in environments where CUI is handled.
Think through the actual data flows. A Physical Access Control System (PACS) that badges personnel into a room where CUI is processed generates access logs that identify who entered, when, and how long they stayed. That is CUI-adjacent data at minimum, and in many cases it is directly tied to CUI handling events. A Video Management System (VMS) recording a CUI processing area captures footage that could reveal operational details, personnel patterns, and information handling procedures. An intrusion detection system monitoring a CUI storage facility generates event data that documents the security posture of a protected area.
The 2023 CMMC 2.0 final rule, published in December 2024 and effective as of mid-2025 for many contract types, makes this scope question less ambiguous than it used to be. Third-Party Assessment Organizations (C3PAOs) are being trained to ask about physical security infrastructure. They are walking into server rooms and security offices. They are looking at what systems exist, what they log, and how those logs are protected.
Most integrators don't think of their VMS as a CUI system. Assessors do. That gap is where compliance failures happen.
The first step is not a control gap analysis. It is an honest inventory. Every physical security device on a federal or DoD contractor site needs to be evaluated against one question: does this system touch CUI, or does it operate in an environment where CUI is handled? If the answer is yes, it is in scope.
The Three Control Families That Will Make or Break Your Assessment
NIST 800-171 has 14 control families. For physical security systems, three of them will generate the most findings during a CMMC Level 2 assessment. Knowing them cold before the assessor arrives is the difference between a clean report and a Plan of Action and Milestones (POA&M) that delays your contract award.
Access Control — IA.L2-3.1.1 and PE.L2-3.10.1
These controls require that physical access to systems processing CUI be restricted to authorized users, logged, and periodically reviewed. For physical security systems, this means the admin console on your VMS and PACS server needs the same access discipline you apply to any other CUI system. Role-based access. Unique user accounts — no shared admin logins. Session logging. Regular access reviews that are documented and retained.
- Every technician, vendor, and integrator who has ever touched the system should have a documented access record
- Default manufacturer credentials must be changed — this is one of the most common findings assessors document
- Remote access to VMS or PACS admin interfaces requires multi-factor authentication under AC.L2-3.1.12
- Access privilege reviews need to happen on a defined schedule — quarterly is defensible, annual is not
Audit and Accountability — AU.L2-3.3.1
This control requires that system event logs be created, retained, protected from tampering, and reviewable. A VMS that overwrites recordings on a 30-day loop with no audit retention policy is a direct gap. So is a PACS that generates access logs but stores them locally on a device with no backup, no integrity protection, and no defined retention period.
- NIST 800-171 does not specify a retention period, but 90 days minimum is common assessor guidance — your System Security Plan (SSP) needs to define and justify your retention policy
- Logs must be protected from modification — a VMS admin who can delete or alter access logs is an audit failure
- Log review needs to be documented. Generating logs that no one reviews is not compliance
- Time synchronization matters here — AU.L2-3.3.7 requires system clocks to be synchronized, which affects the evidentiary value of any log
System and Information Integrity — SI.L2-3.14.1
Physical security devices must be monitored for integrity. A camera that has been physically tampered with, a card reader with a cloned firmware image, or a controller that has been accessed without authorization — all of these represent integrity failures that must be detectable. This is where most physical security integrators have the largest gaps, because traditional physical security management does not include integrity monitoring at the device level.
- Firmware versions on all devices should be tracked and compared against known-good baselines
- Configuration changes on controllers and VMS servers should generate alerts
- Physical tamper detection on readers and cameras is not just a feature — under SI.L2-3.14.1, it is a requirement
- Malware protection applies to VMS servers and any Windows-based security system components — these systems need endpoint protection, not just network segmentation
What a Pre-Assessment Inventory Actually Looks Like
Before any gap analysis happens, you need a complete picture of your physical security infrastructure. This is not a spreadsheet exercise you hand off to an intern. It requires someone who understands both the physical systems and the CMMC framework — which is exactly why most organizations are unprepared when the assessor shows up.
For each device and system in scope, document the following:
- Device type, manufacturer, model, and firmware version
- Physical location and the CUI environment it serves or monitors
- Data classification of information the system stores, processes, or transmits
- Current access control configuration — who has admin access, how access is granted and revoked
- Log retention policy — where logs are stored, for how long, and how they are protected
- Network segmentation — is the device on the same network as CUI systems, or isolated?
- Maintenance and support access — does the manufacturer have remote access? Under what conditions?
That last item generates findings more often than people expect. Many physical security systems have active vendor remote access portals that were set up during installation and never disabled. Under AC.L2-3.1.14 and MA.L2-3.7.5, remote maintenance access must be controlled, monitored, and terminated after use. A standing open VPN tunnel to a PACS manufacturer's support team is a compliance gap.
Once the inventory is complete, map each system to the applicable CMMC control families, document current compliance status, and identify gaps. That gap list becomes the foundation of your POA&M if you are not fully compliant today — and it gives you a remediation roadmap with enough lead time to close gaps before assessment.
Design-Phase Compliance Is Cheaper Than Remediation
The organizations that handle CMMC assessments most efficiently are the ones that built compliance requirements into their physical security design specifications before a single piece of equipment was installed. Retrofitting a PACS for CMMC compliance after it has been deployed across 12 buildings is expensive. Designing it correctly from the start costs almost nothing extra.
Specific design decisions that affect CMMC compliance include:
- Network architecture: Physical security systems should be on an isolated network segment, not co-mingled with general IT infrastructure. This limits the scope of CUI exposure and simplifies your System Security Plan.
- Hardware selection: Not all VMS platforms and PACS controllers support the audit logging and integrity monitoring features CMMC requires. Selecting hardware that supports these capabilities natively is far simpler than trying to bolt them on later.
- Vendor agreements: Any third-party service or support agreement for physical security systems needs to include access control provisions aligned with CMMC requirements. This belongs in the contract, not in a verbal understanding with a field technician.
- Documentation: System Security Plans, configuration documentation, and access records need to exist at deployment. Creating them two weeks before an assessment from memory is not a viable approach.
Compliance built into the design phase costs time on the front end. Compliance bolted on after the fact costs money, delays, and in some cases, contract awards.
When TSS Group designs physical security infrastructure for DoD contractors and federal facilities, CMMC control mapping is part of the design deliverable — not a separate engagement. Every system we specify gets evaluated against the control families that apply to it. Every piece of documentation an assessor will need is built into the project closeout package. That approach does not add significant cost to a project. It eliminates the cost of remediation later.
The Bottom Line
If you are a DoD contractor or federal facility manager with physical security systems operating in or near CUI environments, your CMMC scope includes those systems. The assessment will include them. The question is whether you find the gaps now, on your own timeline, or whether an assessor finds them for you on theirs.
Start with an honest inventory. Map your physical security infrastructure to NIST 800-171 control families — specifically Access Control, Audit and Accountability, and System and Information Integrity. Document what you have, document what you are missing, and get a remediation plan in place before your assessment window opens. If you are in a new build or major upgrade cycle, this is the time to build compliance in at the design phase.
TSS Group provides CMMC-aligned physical security design, assessment preparation support, and system documentation for federal contractors and government facilities. If you need a qualified team that understands both the physical systems and the compliance framework, contact us to schedule a scoping conversation.