visitor activity
163651·updated Oct 4, 2026A physical-protection control category covering the full set of supervisory and monitoring measures applied to any person who lacks permanent access authorization while that person is present inside a controlled facility or secure area. It is distinguished from general access control by its temporal and custodial character: the organization must actively manage what the non-credentialed individual does — where they go, what they touch or observe, and whether they depart without incident — rather than merely verifying identity at entry. In NIST frameworks it sits within the Physical Protection control family; individuals with permanent physical access authorization credentials are explicitly excluded from the visitor category, and audit logs are a recognized mechanism for carrying out the monitoring obligation. In practice, implementation encompasses identifying and signing in visitors, escorting them, controlling which areas they may enter (especially where sensitive systems or data reside), logging their presence and movements, and applying additional safeguards to protect controlled information during and after their presence.
Source
Escort visitors, and control visitor activity.the sentence this term was read in
generalized from a web lookup of the quoted expression, with 1 reviewed place(s) it is used as the term Verdict: compositional.
- 3.10.3: Escort visitors and monitor visitor activity - CSF Tools
- PE.L1-B.1.IX Manage Visitors & Physical Access
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
A physical-protection control category covering the full set of supervisory and monitoring measures applied to any person who lacks permanent access authorization while that person is present inside a controlled facility or secure area. It is distinguished from general access control by its temporal and custodial character: the organization must actively manage what the non-credentialed individual does — where they go, what they touch or observe, and whether they depart without incident — rather than merely verifying identity at entry. In NIST frameworks it sits within the Physical Protection control family; individuals with permanent physical access authorization credentials are explicitly excluded from the visitor category, and audit logs are a recognized mechanism for carrying out the monitoring obligation. In practice, implementation encompasses identifying and signing in visitors, escorting them, controlling which areas they may enter (especially where sensitive systems or data reside), logging their presence and movements, and applying additional safeguards to protect controlled information during and after their presence.
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- visitor activities
- possessive
- visitor activity's
- pluralpossessive
- visitor activities'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.Increment 2: attested in NIST SP 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A physical-protection control category covering the full set of supervisory and monitoring measures applied to any person who lacks permanent access authorization while that person is present inside a controlled facility or secure area. It is distinguished from general access control by its temporal and custodial character: the organization must actively manage what the non-credentialed individual does — where they go, what they touch or observe, and whether they depart without incident — rather than merely verifying identity at entry. In NIST frameworks it sits within the Physical Protection control family; individuals with permanent physical access authorization credentials are explicitly excluded from the visitor category, and audit logs are a recognized mechanism for carrying out the monitoring obligation. In practice, implementation encompasses identifying and signing in visitors, escorting them, controlling which areas they may enter (especially where sensitive systems or data reside), logging their presence and movements, and applying additional safeguards to protect controlled information during and after their presence.Drafted by the propose-term web lookup (PD-018); a curator confirms or replaces it.