Visitor Log template: The record of each visit to the non-public areas of a facility, with the visitor, the person visited, the times, the badge and the escort, its retention and review, and the anomalies reported, limited to the elements the privacy risk assessment allows, as SP 800-53 PE-8 requires.
The record of each visit to the non-public areas of a facility, with the visitor, the person visited, the times, the badge and the escort, its retention and review, and the anomalies reported, limited to the elements the privacy risk assessment allows, as SP 800-53 PE-8 requires.
Fill in: time period for which to maintain visitor access records for the facility where the system resides Typical: 2 years, or longer where the organization’s records retention schedule requires
Record every visitor to a non-public area when they arrive, check their identification, and issue a visitor badge that looks different from permanent badges and is valid only for that day (PE-8a, PE-3d).
Escort and control visitors Fill in: circumstances requiring visitor escorts and control of visitor activity Typical: at all times in non-public areas, for every visitor and for anyone without a physical access authorization for the area, including maintenance personnel who are not on the authorized maintenance list. Record the escort; the escort stays with the visitor until they leave the non-public area (PE-3d).
Record the departure time and collect the badge when the visitor leaves. A badge that is not returned is disabled and reported as an anomaly.
Keep the records for Fill in: time period for which to maintain visitor access records for the facility where the system resides Typical: 2 years, or longer where the organization’s records retention schedule requires (PE-8a).
Review the records Fill in: the frequency at which to review visitor access records Typical: at least monthly and record the review in section 3 (PE-8b).
Report anomalies to Fill in: personnel to whom visitor access records anomalies are reported to Typical: the facilities manager and the security operations team (PE-8c). An anomaly that suggests a security incident is reported under the incident response plan.
A person who visits so often that they need regular access should be authorized under PE-2 and added to the physical access list instead.
Field
What to record
Visit ID
A unique ID, or the line number on a paper log
Date
Date of the visit
Visitor
Name and organization
Identification checked
The type of identification checked, for example a driver’s license or a government ID card; not its number, unless section 2 allows it
Person visited
Name and organization of the person visited
Purpose
Why the visitor came, for example a meeting, a delivery or maintenance
Areas
The non-public areas the visitor entered
Badge
The visitor badge number issued, and whether it was returned
Escort
Name of the employee who escorted the visitor (PE-3d)
For a facility whose systems are under the Privacy baseline, the log collects only these elements, identified in the privacy risk assessment: Fill in: elements identified in the privacy risk assessment to limit personally identifiable information contained in visitor access logs Typical: the visitor’s name and organization, the person visited, the purpose of the visit, the date and times of entry and departure, the badge issued and the escort; the type of identification checked, but not its number or a copy of it unless a law or regulation requires one (PE-8(3)). Record the decision in the minimization entry of the privacy impact assessment, and remove any field, form or system setting that collects anything else. On a paper log, use one sheet per visitor, or a cover, so that visitors cannot read earlier entries.
The National Archives and Records Administration’s General Records Schedule 5.6 (GRS Transmittal 35, May 2024), items 110 and 111, covers visitor processing records: destroy when 5 years old for areas requiring the highest level of security awareness, including Facility Security Level V, and when 2 years old for all other facility security areas, including Facility Security Levels I to IV, with longer retention allowed if required for business use. Under the Privacy Act, records retrieved by an individual’s name or other identifier are a system of records (5 U.S.C. § 552a(a)(5)), and an agency must give each individual it asks for information in one the notice that § 552a(e)(3) describes. As of October 2026.
The “Records kept for” value shall be at least 5 years for a Facility Security Level V facility and at least 2 years for any other, as GRS 5.6 items 110 and 111 set, unless the agency’s approved records schedule sets a different period. (PE-8a)
Where the log is retrieved by a visitor’s name or other identifier, it shall be covered by a published system of records notice, and the sign-in form or visitor management system shall present the Privacy Act statement that 5 U.S.C. § 552a(e)(3) requires. (PE-8(3))
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.