Information resource owners with responsibility over infrastructure equipment shall: a. Maintain visitor access records to the facility where the information resource resides for one year; and b. Review visitor access records at least monthly.
Failure to protect facilities through sufficient physical entry controls may result in unauthorized parties accessing the organization's facilities.
The organization:
a. Maintains visitor access records to the facility where the information system resides for [Assignment: organization-defined time period]; and
b. Reviews visitor access records [Assignment: organization-defined frequency].
Visitors are escorted at specific times and a log of entry/exit is maintained.
The state organization maintains visitor access records to the facility where the information system resides (except for those areas within the facility officially designated as publicly accessible).
Obtain physical and environmental protection policy; procedures addressing facility access records; security plan; facility access control records; other relevant documents or records and ascertain if :
(I)the organization defines in the security plan, explicitly or by reference, the frequency of review for visitor access records;
(ii)the organization maintains visitor access records to the facility where the information system resides (except for those areas within the facility officially designated as publicly accessible) that includes:
-name and organization of the person visiting.
-signature of the visitor.
-form of identification.
-date of access.
-time of entry and departure.
-purpose of visit.
-name and organization of person visited .
(iii)designated officials within the organization review the visitor access logs in accordance with organization-defined frequency.
