Example, read only. A sample company whose own team runs its CMMC program here, reviewed by a credentialed officer and kept current.
PE.L1-3.10.3 · FAR 52.204-21 (b)(1)(ix), escort clause · NIST SP 800-171 3.10.3 · 3 controls rolled up
Escort Visitors
Escort visitors and monitor visitor activity
Reviewed by a credentialed officer on June 12, 2026. The officer advises and never signs; this corroborates your own self assessment and certifies nothing. The finding, and the affirmation, stay yours.
Who is accountable for this safeguard
They get the reminder when this evidence goes stale. Carries into next year's cycle.
What it means
When a non-employee visits, someone keeps an eye on them the whole time they're near contract info.
Why it matters
This is the most common-sense control and usually the easiest: don't leave a visitor alone near contract info. A short written rule plus a visitor log is enough.
The proof on file
- visitor-escort-sign-entry.jpgUploaded, checked by Charlie · June 2, 2026Sufficient
Every uploaded file is checked by Charlie the moment it arrives, so a gap is caught on the spot, not at the assessment. Pulls from Microsoft 365 and references to the Policy Center and registers come straight from where they live, so they skip that check.
The narrative on file
Visitors sign in at the front office and are escorted at all times while inside. The escort requirement is posted at the entry and recorded in the visitor log kept at the front desk.
You answer in plain English. Charlie drafts the narrative for your System Security Plan, and you confirm it.
What makes it pass
- A written escort policy is included (or referenced) and signed by the owner
- At least one recent visitor-log page with date, name, company, escort, time-in, time-out per visitor
- Cleaning crews / vendors / maintenance show up in the log when relevant
Assessment objectives, NIST SP 800-171A
The team at Cedar Ridge Machine Works, LLC confirmed this safeguard MET. The evidence above is a living document: refresh rosters, devices, and accounts whenever the business changes and the safeguard stays current. The single signature happens in Attest & file, once all 17 are met.
Next safeguard →Need the exact clicks?Any business, step by step
- 1Write a one-page Visitor Escort Policy: non-employees must sign in, be escorted at all times in spaces where FCI is handled, and sign out on departure
- 2Post the policy at the entry to covered spaces
- 3Maintain a visitor log capturing at minimum: date, visitor name, company, purpose, escort, time-in, time-out
- 4Owner signs the policy
Capture: Signed policy + a representative recent page of the visitor log.
This is one of 17
Answer in plain English, file the proof, confirm it MET.
The team at Cedar Ridge Machine Works, LLC walked all 17 the same way. The platform explains each one in plain English and tells you what proof to grab or pulls it from Microsoft 365, Charlie drafts the paperwork with you, a credentialed officer reviews it, and your team confirms each one MET. The self assessment stays your act. Start free for 30 days, no credit card, or book a free advisory call if you would rather talk it through first.