Example, read only. A sample account that shows what finished CMMC looks like.
Safeguard 9 of 15 · PE.L1-b.1.ix
PE.L1-3.10.3 · FAR 52.204-21 (b)(1)(ix), escort clause · NIST SP 800-171 3.10.3 · 3 controls rolled up
Escort Visitors
Escort visitors and monitor visitor activity
What it means
When a non-employee visits, someone keeps an eye on them the whole time they're near contract info.
Why it matters
This is the most common-sense control and usually the easiest: don't leave a visitor alone near contract info. A short written rule plus a visitor log is enough.
How to do it, Any business
- 1Write a one-page Visitor Escort Policy: non-employees must sign in, be escorted at all times in spaces where FCI is handled, and sign out on departure
- 2Post the policy at the entry to covered spaces
- 3Maintain a visitor log capturing at minimum: date, visitor name, company, purpose, escort, time-in, time-out
- 4Owner signs the policy
Capture: Signed policy + a representative recent page of the visitor log.
The narrative on file
Visitors sign in at the front office and are escorted at all times while inside. The escort requirement is posted at the entry and recorded in the visitor log kept at the front desk.
You answer in plain English; Charlie writes the official narrative for your System Security Plan.
What makes it pass
- A written escort policy is included (or referenced) and signed by the owner
- At least one recent visitor-log page with date, name, company, escort, time-in, time-out per visitor
- Cleaning crews / vendors / maintenance show up in the log when relevant
Assessment objectives, NIST SP 800-171A
This is one of 15
Answer in plain English, drop the proof, confirm it MET.
Cedar Ridge Machine Works, LLC walked all 15 the same way. The platform explains each one in plain English, tells you exactly what to grab, checks it, and writes the paperwork, and you confirm each one MET. The self assessment stays your act. Start free, or book a call.