Independent DIB implementation resource — not affiliated with or endorsed by the U.S. Department of WarView the official DoW campaign ↗
Brilliant at the BasicsDIB Resource Center
3.10.3OFFICIAL STATEMENT BELOWDERIVED REQUIREMENTPENDING NIST SME REVIEW

3.10.3 — Visitor escort and monitoring

3.10 Physical Protection · NIST SP 800-171 Rev. 2 · The heading label is this site's navigational shorthand; the official language is the statement below.

Official requirement statement (verbatim)

Escort visitors and monitor visitor activity.

NIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems ↗NIST SP 800-171A — Assessing Security Requirements for CUI ↗
Independent interpretation

What this requirement is after

People who are not authorized personnel do not wander. Visitors sign in, are visibly distinguishable from staff, and have an escort who is responsible for them from arrival to departure in any area where systems or CUI live.

Across revisions

Rev. 3 withdraws the standalone slot (03.10.03); visitor escort and activity monitoring fold into the consolidated Physical Access Control requirement, 03.10.07.

Mapped practices

Brilliant at the Basics practices that support this requirement

No practice maps to this requirement — deliberately.

The campaign’s twenty practices are a priority list, not a control catalog, and none of them works this requirement’s substance directly. It still applies to you if it is in your contract’s scope: address it through your own implementation and the related artifacts below, and treat the absence of a mapping here as honesty, not permission to skip it.

Doing the work

Implementation considerations and evidence

Implementation considerationsIndependent guidance — tailor to your environment
  • Define who counts as a visitor — delivery drivers, vendor technicians, customer auditors, family. Anyone unscreened and unauthorized is one.
  • Keep escort responsibility explicit: the person who signs a visitor in owns them until sign-out, not 'someone nearby'.
  • Vendor maintenance personnel are the common gap; escort duties here interlock with maintenance-personnel supervision under 3.7.6.
What operating evidence looks likeRecords worth retaining, not a submission checklist
  • Sampled visitor-log entries with arrival, departure, and escort recorded
  • The visitor badge or identification method in use
  • The written escort expectation and who it binds
Artifacts

Templates and worksheets with a mapped relationship

No artifact in the library names this requirement yet. The library index groups everything by category and practice.

The other revision

Where this lands in Rev. 3

Provenance

Sources and review status

Primary sourcesNIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems · NIST SP 800-171A — Assessing Security Requirements for CUI
Review statusPending NIST SME review
Content version1.0
Updated