Navigate

PE-8

PE-8: Visitor Access Records

a: Maintain visitor access records to the facility where the system resides for [time period for which to maintain visitor access records for the facility where the system resides is defined;];

b: Review visitor access records [the frequency at which to review visitor access records is defined;] ; and

c: Report anomalies in visitor access records to [personnel to whom visitor access records anomalies are reported to is/are defined;].

Supplemental

Visitor access records include the names and organizations of individuals visiting, visitor signatures, forms of identification, dates of access, entry and departure times, purpose of visits, and the names and organizations of individuals visited. Access record reviews determine if access authorizations are current and are still required to support organizational mission and business functions. Access records are not required for publicly accessible areas.

CIA Levels
Confidentiality	low
Integrity	low
Availability	low

Overlays
DAF Baseline, Privacy (accountability), Privacy (high), Privacy (low), Privacy (moderate), Privacy Control Baseline (CNSSI 1253)

CSF Categories
PR.AC-2

Related Controls

The controls below (if any) were marked by NIST as being related to PE-8.

Control	Description
PE-2	a: Develop, approve, and maintain a list of individuals with authorized access to the facility where the system resides; b: Issue authorization credentials for facility access; c: Review the access list detailing authorized facility access by individuals [frequency at which to review the access list detailing authorized facility access by individuals is defined;] ; and d: Remove individuals from the facility access list when access is no longer required.
PE-3	a: Enforce physical access authorizations at [entry and exit points to the facility in which the system resides are defined;] by: 1: Verifying individual access authorizations before granting access to the facility; and 2: Controlling ingress and egress to the facility using [one or more of "{{ insert: param, pe-03_odp.03 }} "/"guards"]; b: Maintain physical access audit logs for [entry or exit points for which physical access logs are maintained are defined;]; c: Control access to areas within the facility designated as publicly accessible by implementing the following controls: [physical access controls to control access to areas within the facility designated as publicly accessible are defined;]; d: Escort visitors and control visitor activity [circumstances requiring visitor escorts and control of visitor activity are defined;]; e: Secure keys, combinations, and other physical access devices; f: Inventory [physical access devices to be inventoried are defined;] every [frequency at which to inventory physical access devices is defined;] ; and g: Change combinations and keys [one of ] and/or when keys are lost, combinations are compromised, or when individuals possessing the keys or combinations are transferred or terminated.
PE-6	a: Monitor physical access to the facility where the system resides to detect and respond to physical security incidents; b: Review physical access logs [the frequency at which to review physical access logs is defined;] and upon occurrence of [events or potential indication of events requiring physical access logs to be reviewed are defined;] ; and c: Coordinate results of reviews and investigations with the organizational incident response capability.

Enhancements

The controls below (if any) add on to the requirements of PE-8.

Control	Description
PE-8(1)	Maintain and review visitor access records using [one of ].
PE-8(2)
PE-8(3)	Limit personally identifiable information contained in visitor access records to the following elements identified in the privacy risk assessment: [elements identified in the privacy risk assessment to limit personally identifiable information contained in visitor access logs are defined;].

Related CCIs

The CCIs below are tied to PE-8.

CCI	Definition
CCI-000947	Maintain visitor access records to the facility where the system resides for an organization-defined time period.
CCI-000948	Review visitor access records in accordance with organization-defined frequency.
CCI-000949	Defines the frequency with which to review the visitor access records for the facility where the system resides.
CCI-002952	Defines the time period to maintain visitor access records to the facility where the system resides.
CCI-004251	Report anomalies in visitor access records to organization-defined personnel.
CCI-004252	Defines the personnel who are to report anomalies in visitor access records.