CCI-000947

Maintain visitor access records to the facility where the system resides for an organization-defined time period.

Implementation Guidance

Determine if visitor access records for the facility where the system resides are maintained for [PE-08_ODP[01]; time period for which to maintain visitor access records for the facility where the system resides is defined].

Validation Procedures

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing visitor access records; visitor access control logs or records; visitor access record or log reviews; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentation; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with visitor access record responsibilities; organizational personnel with information security and privacy responsibilities]. Test: [SELECT FROM: Organizational processes for maintaining and reviewing visitor access records; mechanisms supporting and/or implementing the maintenance and review of visitor access records].

The controls below (if any) were marked by NIST as being related to CCI-000947.