PE.L2-3.10.3
Escort Visitors [CUI Data]
Requirement
Assessment objectives
An assessor checks each lettered objective separately. The letters in brackets elsewhere on this page, such as [a] or [b,c], refer to these.
Determine if:
- avisitors are escorted; and
- bvisitor activity is monitored.
From the CMMC Level 2 Assessment Guide v2.13 · publisher approved 2026-10-31.
How to implement
Anyone who is not authorized for your CUI areas, including friends, family, vendors and delivery drivers, is a visitor: an employee escorts them the whole time and their activity is watched. Make visitors easy to spot with distinct, expiring badges, keep them out of areas with CUI unless there is a reason, and check the area after they leave. A small office can meet this with a sign-in book, visitor badges and a clear escort rule.
The minimum for a small organization · Expert CMMC's reading, not official text
Visitors are escorted [a] and what they do is watched [b] whenever they are in areas with CUI systems or media, and they can be told apart from staff. Staff who stay with their visitors, a sign-in log naming the host, and visitor badges that look different are the usual way.
Required outcome: what the requirement or its objectives call for. Recommended way: one common way to get there. Going further: worth doing, more than this practice asks.
- 1Required outcomeProcessHave an employee escort every visitor in areas with CUI systems or media from arrival until they leave, give visitors a badge that sets them apart from staff, and watch what they do while they are there.[a][b]
You can tell it worked when the visitor log names an escort for every visitor who entered a controlled area, and visitors wear badges staff can tell apart from their own.
- 2
- 3Recommended wayProcessEscort: the host meets the visitor at the entrance after sign-in, stays with them in controlled areas, and walks them out. Restrict visitors to conference rooms or public areas when there is no business need in CUI areas.[a]
- 4Recommended wayTechnicalMake visitors distinguishable: distinct-color badges, preferably dated or self-expiring (time-expiring badges change color after a day), collected at sign-out.[b]
- 5Recommended wayProcessMonitor activity: escorts keep CUI covered and screens locked while visitors are present; cameras cover entrances and controlled areas; review the area after the visitor departs and review visitor logs monthly for gaps such as missing sign-outs.[b]
- 6
Evidence to collect
Artifacts that show the practice is implemented and operating. Tags show which assessment objectives each one supports.
A process you started recently is shown honestly by its dated procedure, the first record it produced and the date it began. No evidence row needs more history than the process has existed, and the review periods shown are suggestions unless a guide page or regulation is named beside them.
policy · Suggested: current version, reviewed on the schedule you set
Named in the assessment guide · p.192 PE.L2-3.10.3 Examine: "Physical and environmental protection policy"
Policy section defining visitors, escort requirements, badges and monitoring.
Visitor log with host or escort[a]
log · Suggested: every entry since the process started
Named in the assessment guide · p.192 PE.L2-3.10.3 Examine: "physical access control logs or records"
Sign-in book or visitor-management export showing visitor, host, purpose and times in and out.
Visitor badge sample[b]
screenshot · Suggested: current
Example
Photo of the visitor badge showing it differs from employee badges.
Camera coverage of entrances and controlled areas[b]
screenshot · Suggested: current configuration
Example
Screenshot of camera views and retention settings.
Monthly visitor log review[b]
record · Suggested: most recent three months
Example
Dated note of the review and follow-up on anomalies.
record · Suggested: within the last year
Example
Awareness training content covering escort and challenge, with completion records.
How assessors check
- Examine
- Physical access policy and visitor procedures, visitor logs, badge samples, camera configuration, review records.
- Interview
- Reception staff, employees who host visitors, the facility manager.
- Test
- Arrive as a visitor (assessors often do) and observe whether you are signed in, badged and escorted; walk without an escort and see whether staff challenge you.
Tools and products
Named options a contractor can adopt, with an honest cost tier. The industry standard is listed even when it is expensive, alongside what is free and acceptable for a very small shop.
Very low cost; expiring badges visibly change after a day so they cannot be reused.
Industry-standard lobby sign-in with host notification and badge printing.
Integrates visitor sign-in with Verkada cameras and doors; worth it only if you already run Verkada.
Low-cost cameras with local recording for monitoring visitor areas.
Costs nothing: add the escort, badge and challenge expectations to the annual security awareness session and keep the completion record.
Editorial mentions, not endorsements. Pricing and tiers change; confirm with the vendor and check FedRAMP or GCC High availability where CUI is involved.
Common pitfalls
- Visitors signed in at reception and then left to find their own way.
- Visitor badges identical to employee badges, or no badge at all.
- Cleaning crews and building maintenance after hours with no escort or record.
- Friday family lunches in a work area with CUI on screens.
Platform notes
Microsoft 365 (GCC / GCC High)
Not applicable for the physical controls; Microsoft handles physical security of its data centers (inherited).
Google Workspace
Not applicable for the physical controls; Google handles physical security of its data centers (inherited).
On-premises or MSP-managed
MSP and vendor technicians on-site are visitors unless you have authorized them; see MA.L2-3.7.6 for supervising maintenance personnel. After-hours cleaning should be scheduled when someone you have authorized is present or limited to areas without CUI.
Related practices: PE.L1-b.1.ix, PE.L2-3.10.4, PE.L2-3.10.1, MA.L2-3.7.6, AT.L2-3.2.1
Editorial implementation guidance published November 12, 2026. It is not part of the official requirement and does not replace the assessment guide.
Crosswalk
Full crosswalkThe NIST requirements this practice is built on, what NIST made of each in the newer edition, and the SP 800-53 controls behind them, each from an official NIST or DoD table. Open any one to read it and see every CMMC practice it supports.
NIST SP 800-171 Rev 2
3.10.3SP 800-171 Rev 3
03.10.0703.10.03 withdrawn; incorporated intoSP 800-53 Rev 4
PE-3SP 800-53 Rev 5
PE-3DSPE-5SHow these were reachedHide how these were reached
- PE-3 · Physical Access Control
- D SP 800-171 Rev 2 Appendix D → SP 800-53 Rev 4 control → NIST's Rev 4 → Rev 5 comparison · via 800-53 Rev 4 PE-3 → 800-53 Rev 5 PE-3
- S source control of the SP 800-171 Rev 3 or SP 800-172 Rev 3 requirement (NIST OSCAL) · via 800-171 Rev 3 03.10.07 → 800-53 Rev 5 PE-3NIST: 03.10.07 also: 3.10.4, 3.10.5 incorporated into
- PE-5 · Access Control for Output Devices
- S source control of the SP 800-171 Rev 3 or SP 800-172 Rev 3 requirement (NIST OSCAL) · via 800-171 Rev 3 03.10.07 → 800-53 Rev 5 PE-5NIST: 03.10.07 also: 3.10.4, 3.10.5 incorporated into
Rev 5 paths: D SP 800-171 Rev 2 Appendix D → SP 800-53 Rev 4 control → NIST's Rev 4 → Rev 5 comparison; S source control of the SP 800-171 Rev 3 or SP 800-172 Rev 3 requirement (NIST OSCAL); C SP 800-172 (Feb 2021) Appendix C. NIST also names this Rev 3 requirement as the successor of other withdrawn requirements: open “How these were reached” under the Rev 5 controls for which, in NIST's words.
Where each link comes from (7 links from 5 official documents)
32 CFR Part 170 Office of the Federal Register / GPO
- PE.L2-3.10.3 → 3.10.3“Level 2 security requirement”32 CFR 170.14(c)(1) numbering (REQ is the NIST SP 800-171 R2 requirement number) and 170.14(c)(3)
Further discussion
Practice guide notes
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Escort visitors and monitor their activities.
Implementation example
Example from the source assessment guide (not a mandatory implementation): Coming back from a meeting, you see the friend of a coworker walking down the hallway near your office. You know this person well and trust them, but are not sure why they are in the building. You stop to talk, and the person explains that they are meeting a coworker for lunch, but cannot remember where the lunchroom is. You walk the person back to the reception area to get a visitor badge and wait until someone can escort them to the lunch room [a]. You report this incident and the company decides to install a badge reader at the main door so visitors cannot enter without an escort [a].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Physical and environmental protection policy; procedures addressing physical access control; system security plan; physical access control logs or records; inventory records of physical access control devices; system entry and exit points; records of key and lock combination changes; storage locations for physical access control devices; physical access control devices; list of security safeguards controlling access to designated publicly accessible areas within facility; other relevant documents or records
Common mistakes
Issuing a visitor badge while allowing unmonitored access to protected areas.
Track this in a workspace
The compliance workspace tracks each objective, its evidence and the tasks to close gaps. It is open to invited contractors while in pilot: request access below.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Source: DoD CIO · https://dodcio.defense.gov/CMMC/