Identify the places and responsibilities
List the relevant offices, equipment areas, storage locations, and other work settings. Establish which protections the organization controls and which a landlord or other provider performs. Ask who can approve access, issue keys or badges, and review access changes.
A general statement that a building is secure is not enough to explain the organization’s own environment. Identify where contract information or relevant equipment may be exposed, and discuss actual working practices with the people using those spaces. Resolve scope questions through the official scoping guidance rather than assuming every location has identical treatment.
Follow a visitor through the process
Describe how a visitor is recognized, authorized, escorted where required, and monitored. Review how visitor activity and physical access are recorded and how the organization controls access devices. Compare the written procedure with what reception staff and employees actually do.
A fictional office might have a visitor log at the front desk but an unmonitored side entrance used for deliveries. The useful finding is the difference between the described process and the operational path. Work with the responsible owner to correct the gap, then verify the revised process rather than only editing the procedure.
Review shared and remote work arrangements
Ask how employees protect relevant equipment and information when working away from the main office. Consider shared spaces, unattended devices, printing, storage, and equipment transported between locations. Base the review on the actual scope and requirements, not on an assumption that home or shared offices are automatically excluded.
Where another party provides a physical protection, document enough of the arrangement to understand who performs it and how the organization confirms it. A lease or service description may be useful context, but it does not automatically establish that all applicable safeguards are satisfied.
Keep records proportional and current
Maintain the records needed to explain access, visitors, devices, and changes without creating unnecessary public copies of personal information. Identify the owner and controlled storage location. Review the process after a move, renovation, lost badge, staffing change, or other event that affects access.
The FAR clause establishes the safeguarding requirements. This working-session structure is a practical suggestion for understanding them. Connect the findings to the Level 1 readiness checklist and use the applicable objectives when reaching an assessment conclusion.
Sources & further reading
- FAR 52.204-21: the basic safeguarding clause ↗
- 32 CFR 170.15: Level 1 self-assessment ↗
- 32 CFR 170.19: assessment scoping ↗
Published October 24, 2026. Government and company references were checked while preparing this page. General information and practical workflow suggestions; confirm the requirements and services that apply to your organization.
