CMMCpedia
Work with me

Requirements / Physical Protection (PE)

PE.L2-3.10.3

Escort Visitors

Official Source Material

SPRS score value
1 point.
POA&M eligibility
Not eligible. 32 CFR 170.21 names it.
Level 1
Also assessed at Level 1 as PE.L1-b.1.ix.

Facts: NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1, June 24, 2020, Annex A; 32 CFR Part 170, § 170.21 and § 170.24, eCFR text current as of September 17, 2026; CMMC Assessment Guide - Level 1, Version 2.13, September 2024.

Escort visitors and monitor visitor activity.

Determine if:

  1. [a] visitors are escorted; and
  2. [b] visitor activity is monitored.

Source: CMMC Assessment Guide - Level 2, Version 2.13, September 2024

Practitioner Guidance

How to meet it

A visitor is anyone without permanent access authorization, and every visitor gets an escort.

Objective [a] means an authorized person accompanies visitors through the controlled area. [b] means their activity is watched. The escort satisfies both when they stay with the visitor from sign-in to sign-out, because escorting is monitoring.

This requirement can never sit on a POA&M.

32 CFR 170.21(a)(2)(iii) lists PE.L2-3.10.3, PE.L2-3.10.4, and PE.L2-3.10.5 among the six Level 2 requirements barred from one. A Not Met on any of them denies even a conditional CMMC status. Escorting visitors is also one of the cheapest requirements in the rule to meet, which makes it a bad place to lose an assessment.

Regular vetted outsiders are not visitors. Define them as authorized personnel.

The cleaning crew, a badged subtenant, and contractors with standing access can be vetted, trained as needed, added to the facility access list as third-party personnel, and issued credentials. The escort duty then applies to actual visitors. What you cannot do is wave regulars through without either vetting or escort.

Make visitors identifiable at a glance.

A visitor badge or a distinct lanyard tells every employee who should have an escort. Pair it with a trained norm that employees stop and redirect an unescorted stranger. In a small office where everyone knows everyone, the written procedure still exists even when a badge adds little.

The friend in the hallway is the test.

An employee's friend walking unescorted toward the lunchroom is exactly the situation this requirement addresses. The procedure that passes: walk them back to reception, sign them in, and assign an escort. Then treat the door that let them in as the finding it is.

What falls short

  • A sign-in sheet with no escort. Logging a visitor feeds PE.L2-3.10.4 and leaves [a] here unmet, because nobody accompanied them.

Edge cases

  • Cleared personnel arriving under a visit authorization request, the notice their security office sends ahead to vouch for them, can be defined in your policy as authorized personnel rather than visitors. Word it as a definition of authorized personnel, not as an exemption from the escort policy, so the objective still reads as met.
  • An after-hours cleaning crew with nobody present works only when the crew is vetted as third-party personnel and CUI, Controlled Unclassified Information, is locked away: screens locked, media and papers in cabinets. If CUI stays out overnight, someone stays with them.

Over-engineering

  • A visitor management kiosk that prints photo badges. Objectives [a] and [b] are an escort who stays with the visitor and a record of what the visitor did.
  • Escort procedures written for the people who work in your space every week. Define regular vetted outsiders as authorized personnel, and escort everyone else.