Physical security remains a CMMC gap in GCC High environments

At a glance

What this is: This guide explains why GCC High does not remove physical security obligations and shows that PE controls still cover offices, remote workspaces, visitors, logs, and access devices.

Why it matters: IAM and compliance teams need to treat physical access, workspace handling, and device custody as part of the control environment because cloud hosting does not neutralise local exposure of CUI.

Context

Physical security is the control family that governs who can physically reach systems, paper records, and devices that handle Controlled Unclassified Information. In GCC High deployments, the cloud tenant is only part of the control surface, because employees still read, store, print, and process CUI in offices, conference rooms, and home workspaces.

The governance gap appears when teams assume FedRAMP-hosted infrastructure covers everything around it. It does not. The real risk sits at the boundary between logical access and physical access, where unlocked screens, visitor access, lost badges, and unmanaged remote workspaces can expose CUI even when the cloud configuration is sound.

Key questions

Q: How do teams close physical security gaps in GCC High environments?

A: Teams close the gap by treating every CUI handling location as in scope, not just the cloud tenant. That means controlled entry, visitor escorting, badge and key lifecycle management, clean desk expectations, and telework rules for remote workspaces. If those controls are missing, the environment is compliant in the cloud but exposed on the ground.

Q: What evidence will a C3PAO expect for physical protection controls?

A: A C3PAO typically expects policies, logs, and operational records that show how physical access is restricted, monitored, and revoked. Useful evidence includes visitor logs, badge inventories, access logs, camera records, and telework agreements. The goal is to prove that CUI is protected wherever employees can physically reach it, not just where the tenant runs.

Q: Why do unlocked workstations still matter in a cloud-first CUI programme?

A: Because a cloud tenant cannot stop someone standing at a desk from reading data already displayed on a screen. Unlocked workstations turn physical proximity into an access path, so clean desk discipline, auto-lock settings, and workspace privacy become part of the CUI control set. Cloud security does not eliminate local exposure.

Q: How should organisations manage badges, keys, and visitor access for CUI areas?

A: They should treat badges, keys, and visitor passes as controlled access devices with issue, return, and revocation procedures. Visitors should be logged and escorted in restricted areas, and former personnel should not retain access devices after departure. The objective is to prevent uncontrolled physical entry into spaces where CUI can be viewed or handled.

Technical breakdown

How PE controls extend beyond the cloud tenant

NIST 800-171 Physical and Environmental Protection focuses on the environments where CUI is actually handled. In GCC High, Microsoft protects the data centre, but the customer still owns the rooms, devices, and work areas where users access the tenant. That means badge readers, locked doors, clean desks, secure storage, and logging of physical entry all sit outside the cloud provider’s scope. The practical question is not whether the tenant is compliant, but whether the surrounding access environment is controlled enough that the tenant can be used safely.

Practical implication: map PE controls to every place CUI can be viewed or stored, not only to the hosted environment.

Why visitor handling and access logs matter in CUI environments

Physical security is not only about keeping intruders out. It is also about proving who entered controlled areas, when they entered, and whether they were escorted while CUI could be visible. Visitor logs, badge logs, and camera records create the evidence trail that assessors expect because they show whether access was authorized and monitored. Without that trail, organisations cannot demonstrate that a person who walked into a restricted space was properly controlled, even if the data itself remained on a compliant cloud platform.

Practical implication: keep visitor, badge, and facility logs aligned so assessors can trace physical access to specific controlled areas.

Alternative work sites create a physical security blind spot

Remote and hybrid work shift CUI handling out of the office and into environments the organisation does not directly control. That changes the failure mode from perimeter breach to workspace exposure, such as shoulder surfing, printed material left in view, or a company laptop used in an unsecured room. GCC High technical controls can enforce device compliance, but they do not enforce the discipline of where and how an employee works. The control therefore depends on documented telework rules, secure storage, screen positioning, and managed endpoints.

Practical implication: treat telework as a physical security problem as well as an endpoint policy problem.

Threat narrative

Attacker objective: The objective is to expose or remove CUI from a physical location that the organisation failed to secure adequately.

1. Entry occurs when a person gains physical access to an office, conference room, or remote workspace where CUI is visible on an unattended device or printed material.
2. Credential or access misuse follows when badges, keys, or weak visitor handling allow the person to remain in or return to the controlled area without challenge.
3. Impact occurs when CUI is observed, removed, photographed, or stolen from the physical environment despite the cloud tenant itself remaining intact.

Breaches seen in the wild

• Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Physical security is the missing control plane in many GCC High programmes: cloud hosting reduces one class of responsibility, but it does not replace the need to govern the rooms, desks, badges, and telework spaces where CUI is actually handled. The compliance failure is not in the tenant itself; it is in assuming the tenant absorbs the surrounding physical risk. Practitioners should treat physical access as part of the identity and access model for the whole CUI environment.

The control gap is boundary blindness, not policy absence: organisations often have access policies, yet those policies stop at the data centre wall. That is a governance failure because the user’s workstation, visitor flow, and remote location are where the exposure happens. The practical lesson is to define the CUI handling boundary explicitly, then assign ownership for every physical site inside it.

Managed badges and monitored spaces remain essential because local access can defeat logical controls: a well-configured tenant still loses if someone can sit at an unlocked workstation or enter a restricted room unescorted. This is where physical security intersects with IAM and endpoint governance, because access rights are meaningless if the device itself is left exposed. Practitioners should align physical safeguards with account, device, and visitor governance rather than treating them as separate compliance tasks.

Alternative work site governance is now a core compliance control, not a policy appendix: home offices and hybrid work locations have become routine access points for CUI, so telework safeguards need the same discipline as office controls. That means documented workspace requirements, evidence of enforcement, and clear escalation when those requirements are not met. For CMMC teams, physical security is a lived control, not a paperwork control.

Access logs only matter when they can be reconciled with real-world occupancy: badge trails, camera records, and sign-in logs should make it possible to prove who was in the space when sensitive information was visible. Where those records are missing or inconsistent, assessors will treat the control as weak even if the organisation believes the site is secure. Practitioners should use physical evidence as a governance signal, not just an audit artifact.

What this signals

Physical security debt: GCC High programmes accumulate risk when teams modernise the tenant faster than they modernise the workspace around it. That gap is operational, not theoretical, because assessors will test whether physical access controls exist where CUI is actually handled.

For IAM and compliance leads, the practical shift is to treat physical access, visitor control, and telework rules as part of the same governance surface as account and device control. If those records do not line up, the control environment is weaker than the cloud architecture suggests.

For practitioners

• Define every CUI handling area Create a documented inventory of offices, rooms, and alternative work sites where employees can view or process CUI, then assign a control owner for each location.
• Tighten visitor and badge governance Require escorted access in controlled areas, maintain visitor sign-in records, and revoke keys or badges immediately when personnel leave or no longer need access.
• Document clean desk and screen rules Set requirements for unattended workstations, printed CUI, locked storage, and screen privacy so assessors can see how physical exposure is prevented.
• Apply telework safeguards to remote locations Require secure workspace setup, company-managed devices, and handling rules for printed CUI at home or in any alternative work site.
• Reconcile physical and logical access records Compare badge logs, visitor records, and sign-in evidence with Entra ID activity to find cases where someone accessed systems without the expected physical presence.

Key takeaways

• GCC High reduces provider-side exposure, but it does not remove the customer’s duty to secure the physical places where CUI is handled.
• Office access, visitor escorting, access logs, badges, and remote work safeguards are all part of the PE control family that assessors expect to see.
• Teams that only harden the tenant without governing workspaces and physical access are likely to leave a CMMC gap open.

Key terms

• Physical Security Scope: The physical security scope is the set of locations, rooms, devices, and handling areas where sensitive information can be seen, stored, or processed. In GCC High and CMMC programmes, the scope usually includes offices, conference rooms, home workspaces, and any place where Controlled Unclassified Information can be exposed.
• Alternative Work Site: An alternative work site is any location outside the primary office where people can process or view protected information, including a home office or coworking space. The control challenge is that policy, device management, and physical privacy expectations must remain enforceable even when supervision is indirect.
• Workspace Access Log: A workspace access log records logins, device activity, and other account events inside a collaboration platform. Security teams use it to spot unfamiliar devices, unusual sign-ins, and potential account abuse. Logs are useful only when reviewed regularly and paired with response actions such as forced sign-out or credential reset.
• Clean Desk Habit: A clean desk habit is the practice of keeping sensitive papers, devices, and credentials out of sight and securely stored when not in use. It reduces exposure to casual viewing, loss, and mishandling. In mature programmes, it is treated as a simple but important control supported by routine employee discipline.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.