Aerospace and defence
Visitor control for aerospace and defence suppliers
A visitor signs in on an iPad and waits at reception until a member of your staff approves them. Then a badge prints with their name, their host and their clearance level, and the access log is timestamped and retrievable when the prime’s questionnaire or the assessor asks.
Sign in on a demonstration kiosk, then open the fire roll call on your phone. Do not enter real details: everything typed is deleted within the hour.
From £599 setup and £150 a month plus VAT, iPad and stand included. Secure Badge and Approval is £150 a month on top.
Who this is for
A UK site with security clauses flowing down from its customer
UK manufacturers building for a US prime or for the MOD, with the security requirements written into the contract. Some have a List X area, some hold ITAR controlled technical data, and many have a controlled area and an open one under the same roof. Every visitor has a host, and the customer’s questionnaire asks how the site knows who was in the building.
What gets asked at reception
Five sets of rules that reach the front desk
A US prime’s flow-down
NIST SP 800-171 section 3.10 asks for visitors to be escorted and their activity monitored, and for audit logs of physical access that are still retrievable months later. CMMC Level 2 assesses against it.
CMMC physical security, requirement by requirementWhat a CMMC visitor log has to hold
The MOD, for a List X site
The Facility Security Clearance guidance asks a cleared site for effective arrangements for the identification and control of visitors, and keeps visitors out of areas they have no authority to access.
The MOD, for any defence supplier
Def Stan 05-138 Issue 4, control 1503, applies at Cyber Risk Profile Levels 1 to 3: visitor access and exit shall be logged and visitors shall wear visitor ID badges, and badges should differ from staff badges, visitors should be escorted and badges should come back at the end of the day. Your contract sets your level.
Your export control officer
DDTC’s compliance guidelines list six things a Technology Control Plan visitor record should show. The kiosk records three of them, and the page says which.
The customer’s programme team
Visitors to a programme area are often asked to accept a non-disclosure agreement before they go in, and the customer may ask you to show who did.
What the kiosk does
Approved, badged and on the record before they leave reception
Held at reception until approved
With the Secure Badge and Approval module, a visitor signs in and waits. A member of your staff comes to the kiosk, picks their name and enters their PIN to authorise the visit. No approval, no badge.
A badge that says who they are
Once the visit is approved the badge prints with the visitor’s name, company, who they are visiting, the date and their clearance level. Colour coded lanyards separate escorted visitors from cleared contractors.
The access log, timestamped
Name, company, host, and the time in and out, searchable by name, company or date and exported when somebody asks. Your NDA and site rules are accepted on screen first, and the record keeps the exact wording.
A roll call on a phone
When the alarm goes, your fire marshal opens the live list on their phone at the muster point and sees every visitor and contractor currently signed in.
The visitor management kiosk in fullThe visitor management system for manufacturersHosting, sub-processors and the DPA
See it work
A visitor badge, approved and printed
A demonstration on our own unit, sign in through to the printed badge, with staff PIN approval before the badge is issued.
The player loads from YouTube only when you press play. Nothing is sent to Google before that. What happens when you do.
What it costs
One price, in public
Setup from £599, then £150 a month plus VAT for the platform, with the iPad, the stand, hosting and support included. Secure Badge and Approval is £150 a month on top, with the label printer included. Nothing is charged per visitor or per user.
Every price, and what is not charged forThe one page business case, for whoever signs it off
Being straight with you
What this does not do
- The kiosk records no nationality and checks no clearance. Need to know, clearance and the foreign visitor records are the Facility Security Controller’s to keep.
- Visitor data is processed in the EU, in Ireland. Whether that is acceptable for a cleared site is a question for your FSC and your customer, and the answer may be no.
- We are not assessors, and no kiosk makes anyone compliant. It keeps the evidence those controls ask for, and your assessor decides the rest.
Before you ask
The questions defence suppliers ask on the first call
Does the kiosk record a visitor’s nationality?
No. The sign in form is name, company, host and vehicle registration, and there is no nationality field. For an ITAR or List X site the nationality record stays with your security or export control officer, and the kiosk record gives them the name, the organisation, the date and the host to file it against.
Where is the data held?
In the European Union, in Ireland, on ISO 27001 certified infrastructure, with every sub-processor listed on the security page. Put that to your Facility Security Controller and your customer before the call rather than after.
Who approves a visitor?
A named member of your staff, at the kiosk, by picking their name and entering their PIN, with the Secure Badge and Approval module. Until then the visitor waits at reception and no badge prints, and if nobody comes in time your Teams or Slack channel is told the visitor is still waiting. The module is £150 a month plus VAT on top of the platform.
Will this make us CMMC compliant?
No, and we would not sell you a kiosk that claimed to. It produces a timestamped record of physical access and, with the badge module, of who approved each visitor. Whether your controls as a whole meet the requirement is the assessor’s decision.
Also asked of sites like yours
The other things somebody may ask you to evidence
Each of these is a page about one standard, one duty or one visitor, written the same way as this one: what it actually asks for, what an iPad at reception records towards it, and where it does not help.
- GDPR and the visitor book
- CMMC physical security
- List X visitor control
- ITAR visitor log
- Def Stan 05-138 visitor access
- ISO 27001 visitor access
- PCI DSS visitor log
- AEO visitor access control
- CTPAT visitor log
- TISAX visitor management
- TAPA FSR visitor log
- BRCGS visitor control
- BRCGS packaging visitor control
- BRCGS storage and distribution visitors
- BRCGS unannounced audit
- Visitor control non-conformity
- SALSA visitor control
- IFS Food visitor hygiene
- UFAS feed mill visitor control
- GMP visitors in production areas
- GDP wholesale visitor control
- Fire roll call
- Contractor management
- Construction work in occupied premises
- HSE inspection records
- ISO 45001 contractor control
- Visitor NDA sign in
- Visitor record retention
- What a visitor log must contain
- Standards calendar
- Sign in sheet template
- Visitor health questionnaire template
- Contractor induction template
- Permit to work template
- Hot work permit template
- Fire drill record template
Next step
Tell us what your customer’s questionnaire asks about visitors
Fifteen minutes on the phone. Which flow-downs you work under, where the controlled areas are, and how visitors get in today. We will tell you straight whether a kiosk is worth your time, and whether EU hosting rules it out.
Book a 15 minute callNo site visit needed and nothing to install. If it is not a fit we will say so on the call.
Would rather email? [email protected]
Not the person who signs it off? Send them the one page business case