DE.CM-02 says the physical environment is monitored to find potentially adverse events. If people can walk up to your servers, laptops or network closet, you need a way to notice when something is wrong. For many small companies that means badge or visitor logs, a lock on the network closet, and a camera or alarm where it matters. No CSF certification exists; you show the outcome with records.
What good looks like
Entry to offices and equipment rooms is logged. Visitors sign in. Someone reviews badge failures and after hours entries. Locks, alarms and cabinets are checked for tampering. If you are fully remote, the scope shifts to shared spaces, your cloud provider's attestations and home office guidance.
How to implement it
- List the physical spaces that hold sensitive equipment or data.
- Use badge readers or keypads that keep logs, and a visitor sign in sheet or app.
- Review access logs monthly for odd hours and repeated failures.
- Put tamper seals or locks on network closets and check them on a schedule.
- For remote teams, collect your cloud and colocation providers' physical security reports instead of monitoring buildings you do not control.
Evidence to collect
- Badge or door log exports with a review sign off.
- Visitor logs.
- Photos of locks, cameras and alarm placement.
- Provider attestation reports for hosted infrastructure.
Common gaps
Logs exist but are never reviewed. The server closet is also the storage closet. Contractors have standing access that was never removed.
Quick check
We are fully remote. Does DE.CM-02 still apply?
Yes, in a smaller form. Cover any shared office, your equipment shipping and storage, and the physical controls of the cloud providers you depend on.
Sources
- NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
- NIST CSF 2.0 Reference Tool and implementation examples: https://csrc.nist.gov/Projects/Cybersecurity-Framework/Filters#/csf/filters
