Visitor Access Records PE-8

Source: NIST SP 800-53 Rev.5, Physical and Environmental Protection family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

PE-8 (Visitor Access Records) is about keeping a record of who visits the facility where the system lives — the room, closet, or rack that holds the server — how long you keep that record, reviewing it, and reporting anything that looks off. A visitor here means anyone who is not a regular, authorized occupant of the space. It is a Low-baseline Physical and Environmental Protection control.

What good looks like

• Keep a visitor log for the space that holds the server — date, name, who they came to see, and time in and out.
• Set a retention period (how long you keep the records, for example one year) and decide where they live.
• Review the log on a schedule and report anything odd — a visit with no host, an after-hours entry — to whoever owns the space.
• For a home or small lab, a paper sign-in sheet or a simple shared spreadsheet is enough; the point is that a record exists and gets looked at.
• Remember this is a physical record, not a Linux log — the server itself does not enforce or produce it.

Framework mapping

• NIST CSF 2.0 — PR.AA-06 — Physical access to assets is managed, monitored, and enforced commensurate with risk

How to move it toward Implemented

• Write a one-page visitor procedure: what counts as a visitor, what you record, the retention period, and the review cadence (for example, quarterly).
• Start the log — a paper sign-in sheet or a dated spreadsheet — and record every non-occupant who enters the space that holds the server.
• Run and save a dated review of the log, noting any anomalies and what you did about them.
• Attach that procedure and the latest review as hardening evidence on the asset, naming PE-8 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.