The question asks to identify the option that is not a "physical separation method." Physical separation methods are controls designed to prevent or deter unauthorized physical access. Guards, biometric locks, and signage are all controls that actively create or enforce a physical or logical separation to restrict access. In contrast, monitoring via CCTV is a detective control. It is used to observe and record activity within a physical space to identify policy violations or suspicious events, but it does not, by itself, create a physical barrier or separation.

A. Signage: This is an administrative control that communicates access restrictions (e.g., "Authorized Personnel Only"), thereby establishing a boundary and contributing to the enforcement of physical separation.
C. Biometric locks: An iris scanner is a technical control that physically prevents unauthorized individuals from entering a secured area, directly enforcing separation by acting as a locked barrier.
D. Guards: Guards are an operational control that physically controls entry points, verifies authorization, and enforces access policies, creating a human-enforced method of separation. ---

1. NIST Special Publication 800-53, Revision 5, Security and Privacy Controls for Information Systems and Organizations. This document is a foundational source for CMMC practices.

Control PE-3 (Physical Access Control): This control family describes enforcing physical access authorizations at entry/exit points using physical access control systems (e.g., locks, guards, electronic devices like biometrics). This supports that options C and D are separation methods.

Control PE-6 (Monitoring Physical Access): This control is distinct from PE-3 and describes monitoring physical access to detect and respond to incidents. It explicitly lists "surveillance equipment" (like CCTV) as a method for monitoring, separating it from the act of access control/separation.

2. CMMC Model Version 2.0, CMMC Practices, December 2021.

Domain: Physical Protection (PE), Practice C029 (PE.L2-3.10.1): "Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals." The assessment objectives for this practice often include verifying the presence of locks, guards, and other mechanisms that enforce the limit, distinguishing them from monitoring.

3. CMMC Assessment Process (CAP), Version 2.0, Scoping Guidance for CMMC Assessments, December 2021.

Section 3.2, Security Protection Assets: This section discusses the need to protect facilities where CUI is processed, stored, or transmitted. The methods described for protection align with preventive controls like locks and guards (separation) and detective controls like cameras (monitoring), treating them as distinct but complementary functions.