id: "PE-08" title: "Visitor Access Records" family: "PE" family_name: "Physical and Environmental Protection" sort_id: "pe-08" priority: "P2" implementation_level: "organization" enhancements: - pe-8.1 - pe-8.2 - pe-8.3
Maintain visitor access records to the facility where the system resides for {{ insert: param, pe-08_odp.01 }};
Review visitor access records {{ insert: param, pe-08_odp.02 }} ; and
Report anomalies in visitor access records to {{ insert: param, pe-08_odp.03 }}.
Guidance
Visitor access records include the names and organizations of individuals visiting, visitor signatures, forms of identification, dates of access, entry and departure times, purpose of visits, and the names and organizations of individuals visited. Access record reviews determine if access authorizations are current and are still required to support organizational mission and business functions. Access records are not required for publicly accessible areas.
Assessment Objective: visitor access records for the facility where the system resides are maintained for {{ insert: param, pe-08_odp.01 }};
Assessment Objective: visitor access records are reviewed {{ insert: param, pe-08_odp.02 }};
Assessment Objective: visitor access records anomalies are reported to {{ insert: param, pe-08_odp.03 }}.
Physical and environmental protection policy
procedures addressing visitor access records
visitor access control logs or records
visitor access record or log reviews
system security plan
privacy plan
privacy impact assessment
privacy risk assessment documentation
other relevant documents or records
Organizational personnel with visitor access record responsibilities
organizational personnel with information security and privacy responsibilities
Organizational processes for maintaining and reviewing visitor access records
mechanisms supporting and/or implementing the maintenance and review of visitor access records