NIST 800-171 Controls · Physical Protection
PE.2.004 — Maintain Physical Access Audit Logs
Maintain audit logs of physical access.
What PE.2.004 means in plain English
You need a record of who entered and left your restricted areas and when. If you use keypad locks, they may have a built-in log. If you use key cards, the system tracks entries automatically. Even if you use regular keys, you can maintain a simple paper sign-in sheet on the door of the server room. An assessor will want to see that you can look back at least 90 days and tell them who accessed the room on any given day.
The assessment question
“Do you maintain logs (electronic or paper) that record who accessed restricted areas containing CUI systems, including dates and times, and are these logs retained for at least 90 days?”
How to implement PE.2.004
- If using keypad locks (like Schlage), enable the audit trail feature and download the log monthly using the manufacturer's app or software.
- If using key card systems, ensure the access control software is configured to retain logs for at least 90 days. Export and back up logs monthly.
- If using manual keys, place a sign-in sheet in a holder on the door of each restricted room: columns for date, time in, time out, name, and purpose.
- Store completed paper logs in a secure location for at least one year. Scan and save digitally as backup.
- Review physical access logs monthly for unusual patterns — access outside business hours, unknown names, or excessive frequency.
Evidence your assessor will ask for
- Physical access logs for restricted areas covering at least the past 90 days
- Evidence of regular log review (monthly review notes or sign-off)
- Access control system configuration showing retention settings
- Written procedure for maintaining and reviewing physical access logs
Does AI prompt monitoring help with this control? Honestly, no.
PE.2.004 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.
Full mapping: which 800-171 controls AI prompt monitoring evidences →
More Physical Protection controls
Score yourself against all 110 controls
The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.