PE.2.003 — Escort and Monitor Visitors

What PE.2.003 means in plain English

When someone who does not work for you visits your office or shop — a vendor, a repair person, a customer — they should never wander around on their own near your computers or files. Have someone walk with them at all times, especially near areas where CUI is stored. Keep a visitor log at the front desk: who they are, who they are visiting, what time they arrived and left. It is simple but assessors absolutely check for this.

The assessment question

“Do you require all visitors to sign in, wear identification, and be escorted by an authorized employee when in areas where CUI systems or data are present?”

How to implement PE.2.003

1. Create a visitor sign-in log at your main entrance: a simple paper logbook or tablet app (Envoy has a free tier) that captures visitor name, company, host employee, date, time in, and time out.
2. Issue temporary visitor badges (stick-on adhesive badges cost about $10 for 100) that are visually distinct from employee badges, so everyone can see who is a visitor.
3. Write a short Visitor Policy: all visitors must be signed in, badged, and escorted at all times in areas containing CUI. Post the policy at the entrance.
4. Brief all employees: if they see someone without a badge or escort, they should politely ask who they are visiting and walk them to the front desk.

Evidence your assessor will ask for

• Visitor sign-in log (physical or digital) with entries showing escort assignments
• Written Visitor Policy describing escort requirements and badge procedures
• Photo of visitor badge system in use
• Employee awareness documentation showing staff know the visitor escort procedure

More Physical Protection controls