Skip to content
ControlVerdict
Sign in
PE.L2-3.10.3CMMC Level 2Level 2

Escort Visitors [CUI Data]

Submit your own example

Practice statement

Escort visitors and monitor visitor activity.

Quoted verbatim from NIST SP 800-171 Rev. 2 §3.10.3.Source

The source document’s non-normative “Discussion” section is not reproduced here. ControlVerdict quotes normative text verbatim or omits it — it never paraphrases a standard. Follow the source link above for the full context.

Assessment Objectives(2)

An assessor determines each objective separately. “Mostly implemented” is not a result — every objective below has to stand on its own.

  1. [a]

    visitors are escorted; and

    1 example covers this

  2. [b]

    visitor activity is monitored.

    1 example covers this

Objective text quoted verbatim from NIST SP 800-171A via the CMMC Level 2 assessment guide.

Implementation examples(1)

Submit your own example
  • addresses
    PE.L2-3.10.3Escort Visitors [CUI Data]
    Escort visitors and monitor visitor activity.

    • [a]

      visitors are escorted; and

    • [b]

      visitor activity is monitored.

    Colored badge, named escort, and no unaccompanied minutes in engineering

    ControlVerdict Corpus@cv-corpusOSCJul 31, 2026
    Community is just starting — add yours. No verdicts yet.

    Implementation

    AO coverage. Addresses both Escort Visitors objectives: visitors are escorted, and visitor activity is monitored.

    Who is a visitor. Anyone without a permanent badge for the zone they are entering: customers, auditors, vendor technicians, candidates, family, and delivery drivers past the entry vestibule. Employees from a sister site are visitors in zone 2 unless they hold that badge group. Stating this explicitly is what stopped the 'they work here, sort of' judgment calls at the door.

    Before arrival. The host schedules the visit in the calendar with an escort named in the invite — if nobody is named, the visit is not scheduled. The kiosk pre-registers expected visitors so arrival is quick and the host is notified automatically instead of reception phoning around.

    On arrival. The visitor signs in at the kiosk, which captures name, organization, host, purpose, and time in, and prints a badge that is visibly different from an employee badge: bright color, large VISITOR text, and the date printed so a badge cannot be reused tomorrow. Non-disclosure acknowledgment is presented at the kiosk where the visit warrants it.

    Escorting. The escort meets the visitor at reception and stays with them for the entire visit, including restroom trips to the door and any time in a conference room. Visitors do not enter the engineering floor without a business need, and never enter the server room without the IT director's approval and a second escort. Before a visitor enters a work area, the host gives a two-minute notice so screens are locked and printed material is cleared — a practice that costs nothing and is the single most useful part of this control.

    Monitoring activity. The escort is the primary monitoring mechanism. It is reinforced by camera coverage of the entrance, engineering entrance, and closet door, by the temporary badge granting only the zones the visit requires, and by the sign-out step that records time out. Visitors are not given network access beyond the guest wireless, which has no route to any in-scope system.

    Sign-out. The escort returns the visitor to reception and the badge is surrendered and logged out. Badges not returned by end of day are deactivated automatically and flagged in the next-day review.

    Maintenance. Weekly review of visits that lack a sign-out time or an escort name; annual refresher for frequent hosts on escort expectations and the notice-before-entry practice.

    Accepted gap. After-hours deliveries and the overnight cleaning crew cannot be escorted. Deliveries are held in the vestibule until morning, and cleaning access excludes engineering and the server closet entirely by badge group, with those areas cleaned during business hours under escort.

    What the evidence looks like

    • Visitor management kiosk records for a recent month with host, purpose, and times
    • Sample temporary badge showing the visual distinction and printed date
    • Calendar invite convention or procedure requiring a named escort
    • Camera coverage map for visitor-accessible areas
    • Weekly exception review notes for missing sign-outs or escorts

    Environment

    Frequent customer, auditor, and vendor visits. Reception is staffed only during business hours, and visitors previously signed a paper book and wandered to the conference room on their own.

    Tools

Discussion(0)

No discussion on this control yet

Edge cases, scoping questions, and “would this pass?” scenarios belong here.

Sign in to start a thread.