9.3.4 Visitor log retention
Visitor logs are retained for at least three months unless restricted by law, and include visitor name, firm, sponsor, date, and time in and out.
5
artefacts
2
held by a system
1
at each review
moderate
to go live
Physical access / facilities
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Sample visitor logs containing required fields · Physical access / facilities
- Secure storage location for logs · SIEM / log platform
periodic reviewEvidence produced at each review
- Periodic log review evidence · SIEM / log platform
governing documentDocuments that govern the control
- Retention policy specifying three months · Policy repository / GRC workspace
- Procedure for legal hold scenarios · Policy repository / GRC workspace
First move
Start with the 2 of 5 artefacts that already live in a system (Physical access / facilities); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Logs missing required fields
- Retention below three months
- Logs unsecured
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet9.3.3 Visitor badges or identification are surrendered or deactivated before visitors leave the facility or at the date of expiration · 9.4.1 Media with cardholder data physically secured