NIST SP 800-53 Rev 5 binds US federal systems, and reaches other organizations through contracts and flow down clauses. For everyone else it is a reference catalog: a detailed, public description of what a control can look like. PE-7, Visitor Control, no longer exists as its own control in Rev 5. NIST marks it withdrawn and records that it was incorporated into PE-2 and PE-3.
If an older questionnaire or a customer template still lists PE-7, you need to know where the content lives now.
What it means in practice
Visitor handling did not disappear. PE-2 covers physical access authorizations. PE-3 covers enforcing them, and its text includes escorting visitors and controlling visitor activity. Visitor access records are a separate control, PE-8.
So when someone asks for PE-7 evidence, show the PE-3 escort procedure and the PE-8 visitor records.
Evidence to collect
- Your visitor policy, with the escort rule.
- Sample visitor logs.
- Evidence that visitors are identified and badged as visitors.
Common gaps
- Questionnaires answered "not applicable" because the ID is withdrawn, when the substance still applies.
- Visitor logs kept, but no written escort rule.
How to implement it
Keep one visitor procedure. Reference PE-3 for escort and activity control, and PE-8 for the records. When a customer cites PE-7, answer by pointing to those two and note the withdrawal. Mappings from other frameworks can still cite the old ID, so check any mapping you rely on.
Quick check
Can I answer PE-7 with not applicable?
Better to explain that it was withdrawn and show the PE-3 and PE-8 evidence. The practice still applies.
