PE.L2-3.10.3 Escort visitors: requirements and evidence

What PE.L2-3.10.3 asks for when a visitor walks into a CUI facility

If your CMMC Level 2 scope includes a facility where CUI is handled, every visitor who walks through the door is inside your assessment boundary. PE.L2-3.10.3 asks you to escort visitors and monitor their activity, and to make sure non-employees wear visitor badges or stay with an escort at all times. The requirement is short, but assessors test it by watching how the rule works on an ordinary Tuesday, not by reading the policy binder. The risk it addresses is simple: an unaccompanied person can see screens, paper, whiteboards and equipment that display or store CUI, plug in a device, or photograph a workstation. Escorting and monitoring are the controls that keep an outsider from seeing or touching anything they should not.

This requirement is the Level 2 form of a Level 1 safeguard. The Level 1 version, PE.L1-b.1.ix, comes from FAR 52.204-21 and covers the same escort practice for Federal contract information rather than CUI. The assessment objectives in NIST SP 800-171A for 3.10.3 are the same at both levels, so a facility that cannot show escorting at Level 1 will not pass it at Level 2. Under the scoring in 32 CFR 170.24 it carries one point, but it belongs to the six requirements that can never be placed on a POA&M, so it must be fully met before you can reach Conditional or Final Level 2 status. Confirm the current point and POA&M treatment against the eCFR text before you build a plan around them.

In practice the hard part is informal access. Familiar faces, such as a former employee, a board member or a regular courier, are often waved through without a badge, and staff stop challenging people they recognize. Contractors and cleaning crews move between rooms on their own schedules, and deliveries get dropped at a loading dock where no one records who came in. Start by listing every route a non-employee can take into the space, then decide who escorts, how the escort is recorded, and what happens when an escort is unavailable. Your evidence should show visitor badges, sign-in records and escort assignments for a sample of real visits. Ask your assessor early which records they expect for visits that were not escorted.

Which visitors, areas and sites fall under visitor escort rules

Before anyone can be escorted, the organization has to decide which rooms hold CUI systems, who counts as a visitor, and how shared public space is handled. Each decision below changes how far the escort requirement reaches, and each should be written down in the system security plan and checked against the facility layout.

Rooms that hold CUI systems

Start by mapping every room, closet, rack and workstation area that processes, stores or transmits CUI, including network closets and wiring rooms that carry CUI traffic. Escort rules apply to these spaces even when the CUI system sits in a shared room. Confirm the map against the system boundary in the system security plan, because a room missed here is a room where visitors can wander unescorted during an assessment.

Vendors and delivery staff

Facilities vendors, HVAC technicians, cleaners, couriers and equipment delivery staff are visitors when they are not authorized for the CUI area. Their presence is often the most common gap because they arrive on short notice. Decide in advance who signs them in, who escorts them, and whether they wear a visitor badge while inside the controlled area.

Auditors, contractors and other-site staff

Assessors, subcontractors and employees from sister sites or corporate offices count as visitors unless the organization has specifically authorized them for the CUI area. Agree on a written escort process for each group, and confirm that contractors who hold their own access badges are still handled under the visitor rules when they lack authorization for the room.

Familiar employees who are not authorized

The assessment guide is explicit that people staff know well still need a badge or an escort if they are not authorized for the area. Treat a colleague from another department or a former employee as a visitor for escort purposes. Write this rule into the visitor procedure so that staff do not waive escorts informally.

Publicly accessible areas in the facility

Lobbies, reception areas, shared corridors and meeting rooms that connect to CUI spaces are where visitors can move around unnoticed. NIST SP 800-171A lists safeguards for publicly accessible areas within the facility as potential evidence for this requirement. Map the route from the entrance to each CUI room, and decide where visitors can wait, where badges are issued, and where an escort must take over.

Remote and alternate sites

Some CUI work happens outside the main facility, such as a branch office, a shared building or a secured suite leased by another tenant. Each site that houses CUI systems needs its own escort rules and visitor records, and the organization should confirm which of its sites fall within the assessed scope. Ask the assessor early whether a given location belongs in the boundary.

How an assessor tests visitor escorts under NIST SP 800-171A

This table compares the two assessment objectives NIST SP 800-171A sets for PE.L2-3.10.3, showing how an assessor tests each, what evidence to have ready and where organizations usually fall short. Read each row as a question the assessor will ask, then check your own visitor process against it. Both objectives must be satisfied with evidence in final form before the requirement can be scored MET.

Assessment area	Escorting visitors	Monitoring visitor activity
What the assessor tests	Whether visitors are identified, badged and accompanied by an authorized escort in every area where CUI systems or records are present	Whether the escort or other staff can observe what visitors do and whether that activity is recorded or reviewed
Processes	Written visitor procedure covering check-in, badge issue, escort assignment, and rules for visitors who are familiar to staff	Procedure defining who watches visitors, how activity is noted, and who reviews sign-in records
Mechanisms and devices	Badge stock, badge color or marking for visitors, and locks or doors that force visitors through a staffed point	Cameras, sign-in logs or electronic readers at entry and exit points, and alarms for publicly accessible areas
Evidence requested	Current visitor procedure, badge issuance records, escort assignment records and dated samples of signed-in visitors	Physical access control logs, camera or reader configuration, retention settings and records of reviews performed
Points examined on site	Entry and exit points, reception areas and any route from public space into areas holding CUI	Publicly accessible areas inside the facility, lobbies, loading areas and places where escorts could be drawn away
Common finding: employees treated as exempt	Long-tenured staff or contractors who walk without badges and no written exception rule	Unclear whether the escort monitors activity or only walks alongside the visitor
Common finding: draft or undated evidence	Procedure marked as draft, or badge logs that cannot be tied to a specific date and visit	Log exports without retention settings or review records showing anyone looked at them
Readiness check to confirm	Ask your assessor or consultant which sample of visits and areas they will select before the assessment	Confirm with your own facility team which logs and devices exist today and which are only planned

How to implement visitor escorts in six steps

This sequence takes an organization from undefined visitor handling to a documented, repeatable escort process that produces the badge records, sign-in entries and exception logs an assessor will test against PE.L2-3.10.3.

Define which areas require escorts
The facility owner and security lead map the site and mark which zones are public, which are general employee space, and which hold systems, equipment or media that process CUI. Each zone gets a written rule for whether a non-employee may enter alone, must wear a visitor badge, or must be escorted at all times. The output is a zone map or access matrix approved by a named owner. Assessors will ask for it first, and they will compare it against what staff actually do on a walkthrough.
Write the visitor and escort procedure
The compliance lead writes a procedure that covers who counts as a visitor, how visitors are registered, what badge they wear, who may act as an escort, and what an escort must do while accompanying a visitor. The procedure should state that visitors, including people staff know well, are not to move through the facility unescorted. The output is a dated, versioned document with an owner and an approval record. Assessors compare the written rule with observed practice, so the wording must match what happens at the door.
Set up badge issuance and visitor sign-in
The reception or security function configures a visitor register, either a paper log or an electronic record, and a badge process that distinguishes visitors from employees. Each visit records the visitor's name, organization, host, arrival and departure times, and badge number. Badges are returned at departure and reconciled against the register. The output is a sample set of completed sign-in entries and badge logs. Confirm with your assessor which format and retention they expect, since the sign-in and logging requirements interact with this step.
Assign escort responsibilities and train escorts
The security lead names escorts by role for each zone, confirms that each escort has authority to stop and redirect a visitor, and records which individuals are authorized to escort. Escorts receive training on the procedure, including what to do when a visitor leaves the escort's line of sight and how to report incidents. The output is an escort roster and signed or logged training records for each escort. Keep the roster current as staff change roles, because an escort who has left the company or changed duties is an unmanaged gap.
Monitor visitor activity and record exceptions
During each visit, the escort keeps the visitor in view and watches for activity outside the purpose of the visit, such as photography of restricted areas, access to unauthorized rooms, or attempts to connect devices. Any deviation, badge loss, unescorted visitor or refused escort request is written down with the time, people involved and action taken. The output is an exception log that links back to the visitor register. Assessors test whether monitoring is performed in practice, so exceptions should be recorded rather than resolved informally.
Review the process on a schedule
The compliance lead reviews the zone map, procedure, register and exception log on a recurring schedule the organization sets and documents, and tests a sample of visits against the procedure. Findings produce updates to the procedure or training, and the review record shows what changed and who approved it. The output is a dated review record with sampled evidence attached. Confirm the review frequency with your assessor and your own policy, and keep the review record in the same evidence set as the procedure so both can be presented together.

Which evidence passes a visitor escort test

An assessor testing PE.L2-3.10.3 looks for records that show visitors were escorted and their activity was monitored, not just a policy that says so. The cards below cover the artifacts that usually carry that proof, what the assessor checks in each, and how to keep them current between assessments.

Written visitor and escort procedure

This is the document that defines who counts as a visitor, when a visitor badge is required, who may escort, and how monitoring works in each area of the facility. Assessors compare every other artifact against it, so gaps or contradictions show up quickly. Check that it names the facility areas covered, lists the escort and monitoring duties for reception and employees, and carries a version number and approval date. Review it after any move, new entrance, or change in visitor policy.

Visitor logs or electronic sign-in records

SP 800-171A lists physical access control logs or records as potential evidence for 3.10.3, so the sign-in record is often the first thing an assessor requests. Each entry should show the visitor's name, organization, host, arrival and departure times, and badge number. The assessor checks completeness, meaning no blank departure times or missing days, and that entries match the escort and badge records. Confirm the retention period with your own policy and keep the log in final form, not a draft spreadsheet.

Badge issuance and return records

These records show that each non-employee received a visitor badge and returned it at the end of the visit, which is the visible control behind the requirement that visitors wear badges or be escorted at all times. The assessor checks that badge numbers in the issuance log match the sign-in record and that unreturned badges are followed up. Keep a count reconciliation for each day or shift so gaps are visible rather than discovered during the assessment.

Escort assignment records

Escort assignment records tie each visitor to a named employee who was responsible for them during the visit. The assessor checks that an escort was assigned for every visitor entry, that the escort was an authorized employee, and that the assignment covers the full time the visitor was in a restricted area. An illustrative gap would be a visitor who signed in at 9:00 with no escort listed until 10:30. Use a sign-in form field or badge scan so the assignment cannot be left blank.

Monitoring or camera review records

Where the facility uses cameras, sensors or guards to watch visitor activity, the review records show that someone actually looked at the footage or alerts and acted on anything unusual. The assessor checks that the camera coverage matches the areas named in the procedure, that review logs are dated and signed, and that retention of footage matches the defined period. If your facility does not use cameras for this purpose, describe the monitoring method you do use and keep evidence of it, such as escort walk logs.

Training records for escorts and reception staff

Escorts and reception staff must know the visitor rules well enough to apply them, including the point that employees a visitor knows well still count as visitors who need a badge or escort. Training records show who was trained, on which version of the procedure, and when. The assessor checks that every current escort and receptionist appears in the roster and that records are updated when the procedure changes or new staff join. Confirm your own training frequency with your policy owner.

Why a visitor escort gap blocks Conditional or Final Level 2 status

PE.L2-3.10.3 cannot be carried on a plan of action and milestones. Under 32 CFR 170.21, this requirement is one of six that may never be placed on a POA&M, so it must be MET before an organization can reach Conditional or Final Level 2 status. For planning, that changes the order of work. A missing escort practice is not a remediation item to schedule after the assessment. It has to be closed, with evidence in final form, before the assessor arrives. Any other requirement that is short of MET can be documented and tracked over time, but this one cannot be deferred that way.

The requirement carries 1 point under 32 CFR 170.24, so it is small in the score but decisive in status. A contractor can have a strong overall score and still fail to reach Conditional status if this one objective set is not satisfied. Because the self-assessment result is posted to SPRS and the Affirming Official attests to it, the score entered for PE.L2-3.10.3 must reflect what is actually in place. Scoring it as MET on the strength of a policy that nobody follows is the kind of inaccuracy that creates exposure later, not just a failed assessment.

Before scoring, confirm three things in writing: who escorts visitors in each facility where CUI is handled, where visitor badges are issued and collected, and how visitor activity is recorded while the visitor is on site. Test those controls by walking through a visit with someone outside the team, then retain the sign-in records, badge logs and escort assignments as the evidence an assessor will request. Your own assessor or Registered Practitioner Organization can confirm how the evidence will be judged. The DoW CIO CMMC Assessment Guide, Level 2 describes the expectation that non-employees wear badges or be escorted at all times.

What meeting visitor escort requirements costs in money and effort

This table lists each cost component of escorting visitors and monitoring their activity, who is paid for it, whether it is one-time or recurring, and what drives it up or down. Use it to structure a quote request and to separate setup spend from the ongoing staff and evidence work that an assessor will test.

Cost component	Who is paid or who spends time	One-time or recurring	What drives it up or down
Escort procedure and visitor policy	Internal compliance or security lead, sometimes an implementation partner drafting text	One-time to write, recurring to review	Number of facility zones and restricted areas; fewer, clearly defined zones keep the procedure short
Badge and sign-in tooling	Vendor for licenses or hardware; internal or partner staff for configuration	One-time setup, recurring license or consumables where used	Badge technology (printed passes versus electronic readers), number of visitor entry points, and whether the tool is commercial or open source
Open-source visitor logging	Internal platform team or implementation partner for hosting, hardening and backup	One-time build, recurring hosting and patching	Existing infrastructure to host it in, and the staff time to maintain it; confirm each tool's capabilities before selecting it
Reception and escort staff time	Internal reception, security or facilities staff	Recurring, every visit	Visitor volume, escort ratio, and how many restricted areas require an escort at all times
Staff training on escort duties	Internal training owner; external trainer if purchased	One-time for initial sessions, recurring for new hires and refreshers	Headcount who may act as escorts and turnover among reception and facilities staff
Evidence upkeep	Internal compliance or security staff who keep sign-in records, escort logs and badge inventories current	Recurring	Retention period the organization defines, number of sites, and whether logs are exported to a central store
Internal or external review before assessment	Internal reviewer or independent consultant; the consultant prepares evidence but does not assess it	Recurring around each assessment cycle	Number of sites in scope and how many evidence samples the review covers; ask for a fixed-scope quote
Assessor sampling time	Independent assessor or certification body, billed by the assessment provider	One-time per assessment cycle	Number of facilities, visitor records sampled, and whether live observation of escort practice is requested

Who does what for visitor escorts: your team, a partner and the assessor

Your organization owns PE.L2-3.10.3. Visitor escorting is an operational control that happens on your premises, so the people who staff reception, the employees who host visitors and the managers who set the rules must carry it out every day. No outside party can make those decisions for you or stand in for an escort.

Procedure ownership: Your security or facilities lead defines who counts as a visitor, when a badge is required, how long a visitor may be unescorted (usually not at all for CUI areas) and what happens when an escort leaves.
Reception and badging: Your staff check identification, issue visitor badges and record arrival and departure times.
Escort duty: Named employees accompany visitors at all times and monitor their activity in areas where CUI is processed or stored.
Records: Your team keeps sign-in records, badge logs and any exception approvals in a location it controls.
Staff awareness: Employees who host visitors know the rules, including that people they know well still need a badge or an escort.

Check that the procedure names an accountable owner and that the people who perform escorts can show you the current version.

Common gaps in visitor escort controls and how to close them

Most visitor escort failures are not missing policies. They are gaps between the written rule and daily practice, in how people are identified, escorted, logged and trained. Each card below names one gap, the action that closes it, and the evidence an assessor would expect to see.

Familiar faces treated as staff

Regular vendors, auditors, former employees and contractors often walk in without a badge because staff recognize them. The CMMC Assessment Guide Level 2 is explicit that visitors, even people employees know well, should not walk around unescorted. Close the gap by defining who counts as a visitor, requiring a visitor badge for every non-employee, and making the badge rule apply to the front desk and to people who visit often. Evidence: the written visitor definition and a sample of badge issuance records.

Escorts who leave visitors alone

An escort who hands a visitor off to a colleague, or who walks ahead to a meeting, breaks the requirement to escort visitors and monitor their activity. Escorts should be named employees with the authority and attention to stay with the visitor for the full visit, and the escort assignment should be recorded at sign-in. Confirm that escorts are trained on what monitoring means in your facility. Evidence: escort assignments on visitor logs and escort acknowledgment records.

Incomplete or missing sign-in records

Sign-in sheets with blank time-out fields, unreadable names or no record for after-hours visits leave an assessor with no proof that visitors were escorted. Require every entry to capture name, organization, host, escort, badge number, time in and time out, and have the front desk reconcile open entries at close of business. Electronic badge readers can help, but confirm they record visitor identity and not just a door event. Evidence: complete visitor logs covering normal and after-hours visits.

No rule for publicly accessible areas

Lobbies, loading docks, conference rooms and shared break areas are often left outside the escort rule, so visitors move freely in and near spaces where CUI-bearing systems or documents are visible. Define which areas are publicly accessible, which areas visitors may enter only with an escort, and where screens and printers must be shielded from visitor sight lines. SP 800-171A names safeguards for publicly accessible areas within the facility as relevant evidence. Evidence: a floor plan marking zones, and photos or walkthrough notes showing the safeguards in place.

Badges that are never returned

A visitor badge that leaves with the visitor is a credential that stops being tied to a person and a visit. Set a return step at sign-out, track unreturned badges as exceptions, and review the badge inventory on a schedule. The same discipline supports PE.L2-3.10.5 for keys and badges. Evidence: badge issuance and return logs, with a documented follow-up for every badge not returned.

Procedures that exist but are not followed

A visitor policy that sits in a binder does not satisfy an assessor who asks staff to describe the process and sees something different. Train front desk staff, escorts and facility managers on the procedure, record that training, and test the process with spot checks. Assessors test whether the procedure is implemented, so the evidence must come from operations, not only from the policy. Confirm your own training and spot-check cadence with your assessor before the assessment.

Questions buyers and practitioners ask about visitor escorts

How much effort does escorting visitors take to implement?

Effort is usually modest in policy and daily routine, but it depends on how many visitors the facility sees and how many areas hold CUI systems. The main drivers are the number of entry points, the size of the building, how often outside people come on site, and whether the escort rule is already part of how staff work. A written visitor procedure, a badge scheme that clearly marks non-employees, a sign-in step, and a short briefing for reception and staff cover most of the work. Organizations with frequent contractors, deliveries or vendor maintenance spend more time on schedules and escort assignments. Ask any partner to break the effort into policy, training, process setup and evidence collection so the scope is visible before work starts.

Can a small organization implement visitor escorts in-house?

Yes, in many cases a small organization can write and run the visitor escort process itself, because the requirement is about behavior and records rather than specialized technology. The practical question is whether someone is clearly responsible for visitor handling every day, including when the usual front-desk person is absent. A small team should define who may escort, how visitors are identified, where they may go, and what happens when an escort is unavailable. Outside help is most useful for reviewing whether the procedure would satisfy the two assessment objectives in NIST SP 800-171A, and for preparing evidence in a form an assessor can test.

What does the escort requirement ask of staff day to day?

Staff must recognize who is a visitor, keep them with an escort, and make sure visitors wear badges or are escorted at all times. The CMMC Assessment Guide for Level 2 is explicit that visitors should not walk around the facility unescorted, and that this applies even to people employees know well. Staff need to challenge unbadged people in restricted areas, know who to call when a visitor is unaccompanied, and understand that a visitor's activity is monitored while on site. Training should be short, role-based and repeated for new hires and reception staff, with attendance or acknowledgment recorded as evidence.

How long does it take to prepare escort evidence?

The time needed depends on how much of the evidence already exists and how many facilities and visitor flows must be documented. Drivers include whether visitor sign-in records are kept consistently, whether the procedure is written and approved, whether badge and escort practices match the written rule, and whether samples of recent visits can be pulled quickly. Evidence must be in final form to count, so drafts and undated notes will not help. Ask any implementation partner for a schedule tied to the written scope, and confirm with your assessor what samples and time periods they expect to review before you commit to a date.

Does an employee from another site count as a visitor?

It depends on whether that person is authorized for the area they enter and whether they have been granted access under your physical access rules. An employee from another site who is not known to local staff, or who lacks authorized access to the restricted area, should be treated as a visitor and escorted or badged accordingly. The CMMC Assessment Guide's reasoning that familiar people should still be escorted applies here, so the safest approach is to define in your procedure which roles are authorized without escort, and to document how staff verify that status. Confirm the boundary with your assessor, because the test is whether unescorted movement is controlled, not whether the person works for the company.

Does video monitoring alone satisfy the escort requirement?

No. Video monitoring can support the monitoring part of visitor oversight, but the requirement also expects visitors to be escorted or badged and kept under control while on site. Cameras record what happened, while escorts and badges shape what happens. A camera covering an entrance does not show who accompanied a visitor into a restricted room or whether the visitor stayed with that person. If you use video, document where cameras cover visitor routes, how footage is reviewed or retained, and how it links to the sign-in record. Confirm with your assessor how they will test the monitoring objective, since SP 800-171A lists access control logs and entry points as potential evidence.

What can an implementation partner do for the escort assessment, and what can it not do?

An implementation partner can help you define the visitor procedure, align it with the escort and monitoring objectives in NIST SP 800-171A, set up sign-in and badge practices, train staff, and organize evidence so it is complete and in final form. DeployOpen prepares systems, controls and evidence for compliance assessments as part of a fixed-scope engagement, and scope, deliverables and timelines are agreed in writing first. DeployOpen does not issue assessment reports, attestations or certifications. Only an independent assessor, such as a certified third-party assessment organization for Level 2 certification, can determine whether the requirement is MET. The organization remains responsible for operating its controls every day.

How DeployOpen prepares visitor escort controls and evidence

DeployOpen helps defense contractors prepare the systems, procedures and records behind PE.L2-3.10.3 Escort visitors inside the client's own facilities and infrastructure. The organization owns its visitor policy and controls, while an independent assessor, not DeployOpen, judges whether the requirement is met.

How we scope

Written scope names the facilities, visitor entry points and access systems covered by the escort requirement.
Scope lists who escorts visitors, how visitor badges are issued, and where escort records are kept.
Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.

How we build

Configure visitor sign-in and badge workflows in the open-source platforms the client operates.
Set up monitoring records that show who escorted each visitor and when visitor activity was observed.
Test the escort procedure against the SP 800-171A objectives, covering escorting and monitoring of visitor activity.

How we hand over

Document the visitor escort procedure, roles and evidence locations so staff can operate it without us.
Deliver a test record showing the escort workflow was exercised and the results were captured in final form.
Provide an evidence map linking each assessment objective to the artifact that demonstrates it.

How we support

Ongoing support is available as a retainer for reviewing visitor logs, updating procedures and retesting after changes.
Retesting can follow facility changes, new entry points or staffing changes that affect escort coverage.
Confirm with your assessor which evidence format and retention period they will accept before work begins.