9.3.3 Visitor badges or identification are surrendered or deactivated before visitors leave the facility or at the date of expiration
Visitor badges or identification are surrendered or deactivated before visitors leave the facility or at the date of expiration.
5
artefacts
2
held by a system
1
at each review
moderate
to go live
Physical access / facilities
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Visitor log entries recording departure and badge return · Physical access / facilities
- Configuration of the access system showing visitor badge expiry · Physical access / facilities
periodic reviewEvidence produced at each review
- Evidence of deactivation at the date of expiration for badges not returned · Physical access / facilities
governing documentDocuments that govern the control
- Observation of visitors leaving the facility showing badges surrendered or deactivated on departure · Policy repository / GRC workspace
- Badge stock reconciliation showing issued badges are accounted for · Policy repository / GRC workspace
First move
Start with the 2 of 5 artefacts that already live in a system (Physical access / facilities); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Badges collected at reception but never deactivated in the access system, so a retained badge still opens doors
- No expiry configured, so a badge taken away remains valid indefinitely
- Departure not recorded, so unreturned badges are not identified
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet9.3.2 Procedures are implemented for authorizing and managing visitor access to the CDE, including: • Visitors are authorized before entering. • Visitors are escorted at all times. • Visitors are clearly identified and given a · 9.3.4 Visitor log retention