PS-3 Visitor Access

What is PS-3 Visitor Access Control about?

Visitor access control is about ensuring that there are proper procedures in place to host visitors in your office.

Unexpected visitors wandering through the office put your employees, visitors, and intellectual property at risk; as such, it is critical to do proper vetting before letting any external person into your organization.

Available tools in the marketplace

The following listing is “crowdsourced” from our customer base or from external research. TrustCloud does not personally recommend any of the tools below, as we haven’t used them.

Tools

IdentiSys

SecureID

Johnson Controls

Evolis

Available templates

TrustCloud has a curated list of templates, internally or externally sourced, to help you get started. Click on the link for a downloadable version.

• An available template from secureFR
• A copy of an available template policy from the Michigan

Control implementation

To implement this control,

1. You have to define and document the practices for your visitors. Without a policy that dictates the specific conditions under which visitors are allowed into your office and facility, such as what times of day visitors are allowed in and which specific areas of the facility are off-limits,
2. You need to implement physical controls such as a visitor log to record office access, and visitor badges are a good way to start. An automated physical security system can be implemented to record physical access to your office. Badges for employees, distinguished from visitor badges, can be installed.

What evidence do auditors look for?

Most auditors, at a minimum, are looking for the below-suggested action.

1. Documented process of your physical security controls
2. A most recent visitor log or access entry log for your office

Evidence example

For the suggested action, an example is provided below:

1. Documented process for your physical security controls.
   The following screenshot shows a sample of the “Physical Protection Policy”.
   
2. A most recent visitor log or access entry log for your office.
   The following screenshot shows a sample visitor log template.