NIST 800-171 Controls · Physical Protection

PE.1.002 — Protect and Monitor Physical Facility

CMMC Level 1SPRS if unmet: -3HIGH priority~10h to implement

Protect and monitor the physical facility and support infrastructure for organizational systems.

What PE.1.002 means in plain English

You need to keep your building and the things that keep your computers running — like power, internet, and HVAC — safe and monitored. This means having security cameras at entry points, keeping exterior doors locked after hours, and making sure someone would know if the power went out or a pipe burst near your server. You do not need a fancy security operations center — basic cameras and a monitored alarm system cover this.

The assessment question

“Do you have security measures such as cameras, alarms, or monitoring in place to protect the physical facility where CUI systems are located, including infrastructure like power and network equipment?”

How to implement PE.1.002

Install security cameras at all building entry points and in hallways leading to restricted areas. Wyze or Ring cameras cost $30-$60 each and include cloud storage options.
Set up a basic alarm system for after-hours intrusion detection. SimpliSafe or Ring Alarm starts around $15/month with professional monitoring.
Ensure your server room or closet has a basic environmental monitor — a $30 temperature and humidity sensor with alerts (like Govee WiFi sensor) will warn you before equipment overheats.
Verify that your UPS (uninterruptible power supply) for servers and critical workstations is working and tested. APC Back-UPS units start around $80 for a basic model.
Document your physical security setup in a one-page facility protection summary including camera locations, alarm zones, and emergency contacts.

Evidence your assessor will ask for

Security camera placement diagram or photos showing camera coverage at entries
Alarm system monitoring contract or subscription confirmation
Environmental monitoring evidence (sensor photos, alert configuration screenshots)
UPS equipment inventory and last test date
Facility protection summary document or physical security section of SSP

Does AI prompt monitoring help with this control? Honestly, no.

PE.1.002 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.

Full mapping: which 800-171 controls AI prompt monitoring evidences →

More Physical Protection controls

PE.1.001

Limit Physical Access to Systems

PE.2.003

Escort and Monitor Visitors

PE.2.004

Maintain Physical Access Audit Logs

PE.2.005

Control Physical Access Devices

PE.2.006

Safeguard CUI at Alternate Work Sites

Score yourself against all 110 controls

The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.

Start the free assessment $499 AI risk assessment