Escort Visitors

A visitor is anyone without permanent access authorization, and every visitor gets an escort.

Objective [a] means an authorized person accompanies visitors through the controlled area. [b] means their activity is watched. The escort satisfies both when they stay with the visitor from sign-in to sign-out, because escorting is monitoring.

This requirement can never sit on a POA&M.

A POA&M, a plan of action and milestones, is the document that defers a few unmet requirements past the assessment. 32 CFR 170.21(a)(2)(iii) lists PE.L2-3.10.3, PE.L2-3.10.4, and PE.L2-3.10.5 among the six Level 2 requirements barred from one. A Not Met on any of them denies even a conditional CMMC status. Escorting visitors is also one of the cheapest requirements in the rule to meet, which makes it a bad place to lose an assessment.

Regular vetted outsiders are not visitors. Define them as authorized personnel.

The cleaning crew, a badged subtenant, and contractors with standing access can be vetted, trained as needed, added to the facility access list as third-party personnel, and issued credentials. The escort duty then applies to actual visitors. What you cannot do is wave regulars through without either vetting or escort.

Make visitors identifiable at a glance.

A visitor badge or a distinct lanyard tells every employee who should have an escort. Pair it with a trained norm that employees stop and redirect an unescorted stranger. In a small office where everyone knows everyone, the written procedure still exists even when a badge adds little.

The friend in the hallway is the test.

An employee's friend walking unescorted toward the lunchroom is exactly the situation this requirement addresses. The procedure that passes: walk them back to reception, sign them in, and assign an escort. Then treat the door that let them in as the finding it is.