Most small defense suppliers have a lock on the server room door and a short list of people who hold a key. That list is the control, and it is also where the control fails, because keys leave no record. Nobody can tell you who opened the door last Tuesday.

Physical access authorizations (03.10.01) and physical access control (03.10.07) are both in CPCSC Level 1 . An assessor wants a short list of who may enter, and some way to show that the list is what the door enforces.

Why I push access control over keys

Keys work. I recommend access control because it produces a record. Card or biometric beats a PIN, since a PIN can be known and a finger is harder to borrow. Card plus PIN belongs on the doors that matter, such as the server room and secure storage.

The rest is simple and auditors like it. Employee ID on a navy lanyard, screened contractors on yellow, visitors on red, and a card design that shows division at a glance.…