3.10.3

Discussion

Individuals with permanent physical access authorization credentials are not considered visitors. Audit logs can be used to monitor visitor activity.

NIST 800-171A Assessment Guidance

Examine

[SELECT FROM: Physical and environmental protection policy; procedures addressing physical access control; security plan; physical access control logs or records; inventory records of physical access control devices; system entry and exit points; records of key and lock combination changes; storage locations for physical access control devices; physical access control devices; list of security safeguards controlling access to designated publicly accessible areas within facility; other relevant documents or records].
Interview

[SELECT FROM: Personnel with physical access control responsibilities; personnel with information security responsibilities].
Test

[SELECT FROM: Organizational processes for physical access control; mechanisms supporting or implementing physical access control; physical access control devices].

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!

ID	Assessment Objectives
3.10.3[a]	Visitors are escorted.
3.10.3[b]	Visitor activity is monitored.