CMMC Practice PE.L1-3.10.3

Escort Visitors: Escort visitors and monitor visitor activity.

Monarch ISC Guidance

Imbedded in this control is the need to control the facility perimeter to limit access. Many facilities will employ an unlocked front door which allows entry into vestibule, then all doors from there in are locked. Otherwise you must lock the external door and force guests to call in or ring an entry bell. Guests then must sign an entry log noting name, company, date and time of entry, and who they are here to see. Guests should also log their exit times. Provide guests with a temporary badge clearly indicating they are visitors/guests which should be worn at all times. Badges could be simple stickers or pre-made badges. If you have a large number of visitors on each day, the organization should consider putting expiration dates on the badges. There are some temporary badges which will even change color after a day. Finally, the guest must be escorted at all times. You can measure the effectiveness of this control by reviewing the visitor logs for completeness. The organization may also conduct regular physical entry penetration tests. A third party contractors can be hired who are trained in social engineering techniques designed to attempt physical entry to the facility.

Security Catapult

Be prepared for CMMC

Our Q&A assessment tool is designed by security advisors for MSPs and DoD contractors of all sizes.

Try now for free

Security Catapult

Understand your gaps

See compliance gaps, compliance scores and proactive security tasks in a single interface.

Try now for free

Security Catapult

Validate NIST SP 800-171

Based on your CMMC answers, we let you know where you stand on NIST.

Try now for free

Security Catapult

Build a plan of action

Track your burn down and stay on top of security needs.

Try now for free

Security Catapult

Build your policy

Say goodbye to maintaining a security policy. We do it for you.

Try now for free

Discussion From Source

NIST SP 800-171 R2 Individuals with permanent physical access authorization credentials are not considered visitors. Audit logs can be used to monitor visitor activity.