NIST SP 800-53 Rev 5 LOW PE-8: Visitor Access Records

What else in your programme already covers this

This control maps to 17 controls across 12 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

SOC 2 · 3 controls

SOC2-CC6.4 Restricts physical access to facilities and protected information assets (for example, data center facilities, back-up media storage, and other sensitive locations) to authorized personnel to meet the entity's objectives
SOC2-CC7.1 Detection and monitoring procedures for security events are in place
SOC2-P6.2 Records of personal information disclosures are maintained

NIST Cybersecurity Framework 2.0 · 2 controls

NIST-CSF-DE.CM-02 The physical environment is monitored to find potentially adverse events
NIST-CSF-PR.AA-06 Physical access to assets is managed, monitored, and enforced commensurate with risk

NIST SP 800-53 Rev 5 · 2 controls

NIST800-PE-8 Visitor access records
SP800-53-PE Physical and Environmental Protection Family

PCI DSS 4.0 · 2 controls

9.3.2 Procedures are implemented for authorizing and managing visitor access to the CDE, including: • Visitors are authorized before entering. • Visitors are escorted at all times. • Visitors are clearly identified and given a
9.3.4 Visitor log retention

C5 (Germany) · 1 control

C5-PS-04 Physical site access control

CMMC 2.0 · 1 control

PE.L2-3.10.4 Physical Access Logs

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 1 control

CCM-LOG-12 Access Control Logs

HIPAA Security Rule · 1 control

164.310(a)(2)(iii) Access Control and Validation Procedures (Addressable)

ISO 27001:2022 · 1 control

7.2 Physical entry

ISO 27002:2022 · 1 control

7.2 Physical entry

NIST SP 800-171 Rev 3 · 1 control

03.10.07 Physical Access Control

NIST SP 800-66 Rev 2 · 1 control

164.310(a)(2)(iii) Access Control and Validation Procedures (Addressable)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.