visitor activity

A physical-protection control category covering the full set of supervisory and monitoring measures applied to any person who lacks permanent access authorization while that person is present inside a controlled facility or secure area. It is distinguished from general access control by its temporal and custodial character: the organization must actively manage what the non-credentialed individual does — where they go, what they touch or observe, and whether they depart without incident — rather than merely verifying identity at entry. In NIST frameworks it sits within the Physical Protection control family; individuals with permanent physical access authorization credentials are explicitly excluded from the visitor category, and audit logs are a recognized mechanism for carrying out the monitoring obligation. In practice, implementation encompasses identifying and signing in visitors, escorting them, controlling which areas they may enter (especially where sensitive systems or data reside), logging their presence and movements, and applying additional safeguards to protect controlled information during and after their presence.