NIST SP 800-53 Rev 5 binds US federal systems, and reaches other organizations through contracts and flow down clauses. For everyone else it is a reference catalog: a detailed, public description of what a control can look like. PE-8, Visitor Access Records, has three parts. Maintain visitor access records to the facility where the system resides for a defined period. Review the records at a defined frequency. Report anomalies to defined personnel.
The guidance lists what a record can hold: names and organizations of visitors, signatures, forms of identification, dates of access, entry and departure times, purpose of the visit, and the name and organization of the person visited. Records are not required for publicly accessible areas.
What it means in practice
A paper sign in sheet counts if it is complete and kept. A tablet at reception counts too. What matters is that the record answers who came, when, why, and whom they saw, and that someone looks at it.
The review has a purpose, which the guidance states: confirm that access authorizations are current and still needed.
Evidence to collect
- Visitor records for a sample of dates.
- The retention period you set and where records are stored.
- Review sign offs with date and reviewer.
- An example of an anomaly, such as a visitor with no host, and its follow up.
The record lists three enhancements: PE-8.1 Automated Records Maintenance and Review, PE-8.2 Physical Access Records, and PE-8.3 Limit Personally Identifiable Information Elements. The last matters in practice, because a visitor log is also a store of personal data.
Common gaps
- Missing departure times.
- Handwriting nobody can read.
- Records kept but never reviewed.
- Retention longer than the stated period, or shorter.
How to implement it
Use a digital sign in if you can, so review and retention are easier. Collect only fields you need. Set the retention period, schedule a review, and name the person who receives anomaly reports.
Quick check
How long should visitor records be kept?
The control leaves the period to you. Pick one that fits your contracts and privacy duties, write it down, and follow it.
