# NIST 800-171 3.10.3 Escort visitors and monitor visitor activity.

- Source: https://support.icompaas.com/support/solutions/articles/62000229323-nist-800-171-3-10-3-escort-visitors-and-monitor-visitor-activity-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [NIST](https://support.icompaas.com/support/solutions/62000112528) › [800-171](https://support.icompaas.com/support/solutions/folders/62000168440)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description:**   

Individuals with permanent physical access authorization credentials are not considered visitors. Audit logs can be used to monitor visitor activity. 

  

**Priority**: High   

  

**Category**: Physical Security 

  

**Services Associated with AWS:**   

-   AWS CloudTrail (for monitoring access events)

  

**Objective Evidence:**   

-   Administrative: documented policies, standards & procedures
-   Administrative: supporting documentation to demonstrate how Physical Role Based Access Control (P-RBAC) is implemented
-   Administrative: supporting documentation to demonstrate visitor management practices

  

Possible Technology Considerations : 

-   Physical Access Control (PAC) 

  

**What needs to be answered :**  

Are all visitors to sensitive areas always escorted by an authorized employee? Are visitors escorted and monitored as required in security policies and procedures? 

-   Visitor Escorting and Activity Monitoring  
    Description: This check ensures that visitors to organizational facilities are properly escorted and their activities are monitored. It applies to individuals who do not possess permanent physical access authorization credentials.

  

**More Details:**   

No CUI stored in company facilities. All CUI storage done via AWS services.

## Related compliance guidance

- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): How the 800-53 catalogue, baselines and the Risk Management Framework fit together, and which controls take the most work in the cloud.
- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): If the driver is a DoD or federal contract handling CUI, 800-171 (and CMMC) is the scope you actually need.