Assessment Objective
Determine if:
- PE-08a. visitor access records for the facility where the system resides are maintained for [Assignment: time period];
- PE-08b. visitor access records are reviewed [Assignment: frequency];
- PE-08c. visitor access records anomalies are reported to [Assignment: personnel].
Assessment Methods
Examine
- Physical and environmental protection policy
- procedures addressing visitor access records
- visitor access control logs or records
- visitor access record or log reviews
- system security plan
- privacy plan
- privacy impact assessment
- privacy risk assessment documentation
- other relevant documents or records
Interview
- Organizational personnel with visitor access record responsibilities
- organizational personnel with information security and privacy responsibilities
Test
- Organizational processes for maintaining and reviewing visitor access records
- mechanisms supporting and/or implementing the maintenance and review of visitor access records
Linked Issues
| Linktype | Issue |
|---|---|
| blocks | PE-08 [L] Visitor Access Records |