If your Brevard County facility handles Controlled Unclassified Information for a defense or aerospace prime, physical access control isn’t a nice-to-have. It’s six specific requirements written into NIST SP 800-171. The Pentagon suspended CMMC Phase 2 third-party assessments in July 2026, but that changed who checks your work, not what the controls are. DFARS 252.204-7012 still obligates you to implement NIST SP 800-171 Rev 2, self-assess, and post a score to SPRS. The doors, credentials, visitor logs, and locked wiring closets the standard describes are still due.
Here’s what that looks like at a real plant in Melbourne, Palm Bay, or Titusville — translated from the standard’s language into the hardware on the wall.
On this page
What changed in 2026, and what didn’t
On July 13, 2026 the Department of Defense announced the immediate suspension of CMMC Phase 2, which had been scheduled to take effect November 10, 2026. Phase 2 was the stage that would have required accredited third-party assessors (C3PAOs) to come verify your cybersecurity before certain contracts could be awarded. That verification step is paused while a CMMC Reform Task Force runs a top-to-bottom review.
Read the fine print and the ground doesn’t actually move for a facility manager. The Department was explicit that Phase 1 self-assessment requirements “remain firmly in place,” that DFARS 252.204-7012 still obligates contractors to provide adequate security by implementing NIST SP 800-171 Rev 2, and that it will enforce that standard “through self-assessments and select government-led assessments.” Scores still get posted to the Supplier Performance Risk System, and Level 1 and Level 2 holders still affirm compliance annually. In the Department’s own framing, the change affects the timing and mechanism of third-party certification, not the underlying security controls.
So the honest answer to “do we still have to do the physical security stuff?” is yes. If anything, a self-assessment regime means the paperwork and the photos that prove your access control works land on your desk, not an assessor’s. A government-led assessment can still arrive. Building the controls correctly once is cheaper than staging them twice.
The six physical-protection controls, translated into doors
NIST SP 800-171 Rev 2 puts physical security in family 3.10, Physical Protection. There are six requirements. Most published explanations stop at quoting them. What a contractor actually needs is the translation from the sentence to the hardware, so here’s each one and what it means at the entrance to a room where CUI lives.
3.10.1 — Limit physical access to authorized individuals. This is the control that justifies the whole electronic access system. A keyed lock can’t tell you who is authorized today versus who was authorized before they changed jobs or left the company. An access control system binds a credential to a person and a permission, and lets you change the permission in seconds without re-keying a door. On the DoD assessment scoring template it’s weighted 5 points, tied with 3.10.2 as the heaviest in the family, because it’s the foundation the other five build on.
3.10.2 — Protect and monitor the facility and support infrastructure. This one surprises people, because NIST’s own discussion names the examples: locked wiring closets, disconnected or locked spare jacks, cabling protected by conduit or cable trays. The network is part of the protected boundary. An unlocked IDF closet with a live spare jack is a physical-protection finding even if every door to the office is badged. For a cabling contractor this is familiar ground. It’s the same closets and pathways we build, which is why access control and structured cabling in Brevard County get designed together rather than in separate projects.
3.10.3 — Escort visitors and monitor visitor activity. Permanent badge holders aren’t visitors. Everyone else, from the HVAC tech to the auditor to the candidate on a tour, gets signed in, escorted, and logged. A system that issues a time-limited visitor credential and records every door it opens turns this from a clipboard at the front desk into a record you can actually produce.
3.10.4 — Maintain audit logs of physical access. The system has to remember who badged which door, when, and whether the attempt was granted or denied, kept long enough to be useful during an incident. This is where a cloud or server-backed system earns its license cost. The log is the deliverable.
3.10.5 — Control and manage physical access devices. Keys, fobs, cards, and combinations are inventory. You have to know how many exist, who holds each one, and be able to revoke one instantly when it’s lost or a person leaves. The failure mode here is the drawer of unlabeled fobs nobody can account for, which is exactly the problem an access control system is supposed to end, and exactly what an assessor asks to see.
3.10.6 — Enforce safeguarding for CUI at alternate work sites. Telework and secondary locations are in scope too. This one is more policy than hardware, but it’s a reminder that “the door” includes the home office and the second building.
Credentials: card, fob, or phone, and why the shape is the least important part
The question that fills forums is which credential to pick. The useful answer is that the form factor matters far less than the credential technology and the policy behind it. A low-frequency 125 kHz proximity card from the early 2000s can be cloned with a thirty-dollar device from the internet. An encrypted 13.56 MHz smart credential can’t be cloned the same way. A fob and a card running the same encrypted technology are equally secure. The difference is whether your staff want a badge they can clip and photo-print, or a token on a keyring.
| Credential | Best fit | Watch out for |
|---|---|---|
| Smart card (encrypted 13.56 MHz) | Sites that already badge people; visible photo ID doubles as the credential | Legacy 125 kHz prox cards are clonable — specify encrypted, not “whatever reads” |
| Key fob | Warehouses, plant floors, small teams who already carry keys | A fob carries no visible identity, so you must still number, assign, and audit it |
| Mobile credential | Multi-site operations; contractors issued access before they arrive | Dead batteries and phone policy; you need a fallback that isn’t improvised at the door |
Mobile credentials are the fastest-growing option because they can be issued and revoked remotely, which is useful when a contractor needs access to a Titusville building on Monday and a Palm Bay building on Wednesday. The catch is that they introduce policy questions a card never did: which phones are supported, whether personal devices are allowed, and what the plan is when a battery is dead at a secured entrance at 6 a.m. The right systems support both a token and a phone so there’s always a fallback.
The part that is specific to the Space Coast
A facility in Brevard County isn’t an office park in Atlanta, and the design reflects it. Three realities show up on nearly every site walk we do here.
Salt air attacks the hardware, not the logic. Any reader, keypad, or request-to-exit device mounted on an exterior door near Cape Canaveral, Merritt Island, or the river corridors sits in salt-laden air that corrodes contacts and housings specified for an inland climate. Outdoor-rated, gasketed, corrosion-resistant hardware costs a little more at install and a great deal less than replacing green-crusted readers every few seasons.
Lightning is a design input, not a footnote. Brevard sits in one of the most lightning-dense corridors in the country. Controllers and power supplies on the protected network want surge protection, and where a run crosses between buildings, they want the same all-dielectric, no-copper-path discipline we use for fiber backbones on the Space Coast. A copper reader line strung between two buildings is one more conductor for a surge to travel.
Campuses are multi-building. Aerospace and defense suppliers in Melbourne, Palm Bay, and Titusville rarely occupy one box. CUI often lives in a specific test bay or integration area inside a larger plant, which means the useful access control boundary is an interior room, not the front lobby. That’s the “interior access points to systems requiring supplemental controls” case NIST calls out, and it’s cheaper to wire when the cabling contractor plans the closet and the pathway for it from the start. The most common finding on a first site walk isn’t a missing front-door reader. It’s an interior CUI area that anyone with a building badge can walk into, and a wiring closet feeding it that still opens with a key half the building owns.
What it costs, the short version
Cost is the question everyone asks and the one that varies most, so here’s the honest range without pretending a blog post can quote your building. Industry integrators put a complete, professionally installed commercial door somewhere between $1,500 and $5,000, with simple buzzer setups lower and high-security or heavily built-out doors higher. The larger swing is the operating model. A cloud-managed system trades a lower upfront number for a per-door monthly license, while an on-premise server costs more to stand up and less to run. Over five years the two models land closer together than the sticker prices suggest. The thing that actually moves a quote is door count, existing wiring, and how much door hardware each opening needs: strikes, mag locks, request-to-exit, and position sensors. A site walk answers that. A price list can’t.
Key takeaways
- The 2026 CMMC Phase 2 pause suspended third-party assessments, not the NIST SP 800-171 controls behind them. DFARS 252.204-7012 and self-assessment still apply.
- Physical security is six requirements (family 3.10): limit access, protect the facility and cabling, escort visitors, log access, manage credentials, and cover alternate sites.
- Credential security is about the encryption and the revocation policy, not whether it’s a card, fob, or phone. Old 125 kHz prox is clonable.
- On the Space Coast, specify for salt air, lightning, and multi-building campuses, and protect the wiring closet, not just the front door.
Common questions about access control for Brevard defense facilities
Does the 2026 CMMC suspension mean we can stop working on physical security?
No. The suspension paused third-party (C3PAO) assessments under CMMC Phase 2. DFARS 252.204-7012 still requires you to implement NIST SP 800-171 Rev 2, Phase 1 self-assessments remain in place, and the Department said it will enforce the standard through self-assessments and select government-led assessments. The physical protection controls in family 3.10 are unchanged.
Do we need electronic access control, or is a good lock enough for NIST 800-171?
A mechanical lock can satisfy “limit physical access” on a low-traffic door, but it can’t produce the audit logs required by 3.10.4 or let you revoke a lost credential the way 3.10.5 expects. For any room where CUI is processed or stored, an electronic system is the practical way to meet the whole family at once and have records to show for it.
Is a key fob less secure than a card?
The form factor doesn’t determine security. An encrypted smart credential is equally strong as a card or a fob, and an old 125 kHz proximity credential is clonable in either shape. Specify the credential technology and the issuance-and-revocation policy, and the card-versus-fob choice becomes about staff preference.
Cloud or on-premise access control for a defense contractor?
Both can be compliant. Cloud systems make multi-site management and instant revocation easier and shift cost to a monthly license. On-premise keeps the management server inside your boundary, which some facilities prefer for CUI. The deciding factors are usually how many buildings you run and your own policy on where the management plane may live.
Does access control have anything to do with our network cabling?
Directly. NIST 800-171’s physical protection discussion names locked wiring closets, locked spare jacks, and conduit-protected cabling as physical access controls. The readers, controllers, and door hardware also ride the structured cabling plant. Designing access control and cabling together is cheaper and avoids a closet that passes one audit and fails the other. It’s the same reason our CMMC and NIST 800-171 network infrastructure work and physical security get planned as one project.
Planning access control for a CUI facility in Brevard County?
BBTS will walk the building, identify the rooms that actually need to be inside the boundary, and design business security and access control in Brevard County — and the cabling behind it — to meet NIST SP 800-171’s physical protection controls. Built for salt air, lightning, and a multi-building campus.
Call 321-636-9000Request a Site WalkSources: NIST SP 800-171 Rev 2, family 3.10 Physical Protection; DoD NIST SP 800-171 Assessment Methodology (control point values); U.S. Department of Defense CMMC Phase 2 suspension announcement (July 13, 2026) and DFARS 252.204-7012.
