菜单
Monitor physical access to the facility where the system resides to detect and respond to physical security incidents.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
eBPF-based post-exploitation for kernel-level credential harvesting, process hiding, and traffic interception on Linux
AWS post-exploitation for IAM privilege escalation, data exfiltration, persistence, and operational security via boto3
Azure/Entra ID post-exploitation for tenant compromise, Key Vault extraction, managed identity abuse, and token manipulation
CI/CD pipeline attacks for secret extraction, pipeline injection, and supply chain compromise via GitHub/Jenkins/GitLab
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
| name | Monitoring Physical Access (03.10.02)_monitoring-physical-access |
| description | Monitor physical access to the facility where the system resides to detect and respond to physical security incidents. |
| category | configuration |
| version | 3.0 |
| author | cyberstrike-official |
| tags | ["nist","sp800-171","rev3","monitoring physical access (03-10-02)","family-03.10","cui-protection","cmmc"] |
| tech_stack | ["any"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Family: Physical Protection Framework: NIST SP 800-171 Rev 3 Applicability: Systems processing, storing, or transmitting CUI
Monitor physical access to the facility where the system resides to detect and respond to physical security incidents. Review physical access logs [organization-defined] and upon occurrence of [organization-defined].
Examine the SSP for Monitoring Physical Access (03.10.02) implementation description and responsible parties.
# Verify security controls protecting CUI
# Check access controls, encryption, monitoring as applicable
# For Linux systems:
ls -la /etc/security/ 2>/dev/null
grep -r "CUI\|controlled" /etc/security/ 2>/dev/null
# For cloud:
# Use cloud-audit-mcp tools to assess posture
Verify this requirement passes CMMC Level 2 assessment methodology per SP 800-171A Rev 3.
| Tool | Purpose | Usage |
|---|---|---|
| cloud-audit-mcp | Assess cloud CUI environment | cloud_audit_* tools |
| Manual Review | SSP and POA&M review | Documentation analysis |
Monitor physical access to the facility where the system resides to detect and respond to physical security incidents. Review physical access logs [organization-defined] and upon occurrence of [organization-defined].
A facility can include one or more physical locations containing systems or system components that process, store, or transmit CUI. Physical access monitoring includes publicly accessible areas within organizational facilities. Examples of physical access monitoring include guards, video surveillance equipment (i.e., cameras), and sensor devices. Reviewing physical access logs can help to identify suspicious activities, anomalous events, or potential threats. The reviews can be supported by audit logging controls if the access logs are part of an automated system. Incident response capabilities include investigations of physical security incidents and responses to those incidents. Incidents include security violations or suspicious physical access activities, such as access outside of normal work hours, repeated access to areas not normally accessed, access for unusual lengths of time, and out-of-sequence access.
| Finding | Severity | Impact |
|---|---|---|
| Monitoring Physical Access (03.10.02) Monitoring Physical Access not implemented | Medium | CUI Protection - Physical Protection |
| Monitoring Physical Access (03.10.02) partially implemented (POA&M) | Low | CMMC certification risk |
| CWE ID | Title |
|---|---|
| N/A | No direct CWE mapping |