Def Stan 05-138, Issue 4

Def Stan 05-138 control 1503: visitor access management

The MOD’s cyber security standard for its suppliers reaches the front door in one control. At Levels 1 to 3, control 1503 says visitor access and exit shall be logged and visitors shall wear badges, and that badges should look different, visitors should be escorted and badges should come back at the end of the day. This page quotes it line by line, with what a sign in record shows and what stays with you.

Try it yourself, no sign-up

Sign in on a demonstration kiosk, then open the fire roll call on your phone. Do not enter real details: everything typed is deleted within the hour.

Book a 15 minute call What 1503 says

From £599 setup and £150 a month plus VAT, iPad and stand included. Secure Badge and Approval is £150 a month on top.

What the standard says

Two controls, and the clauses that decide whether they are yours

Def Stan 05-138 is a table of controls, each marked with the Cyber Risk Profile levels it applies to. The levels below are read from that table. Shall and should are the standard’s own words, and they are kept apart here.

Control 1503, Levels 1, 2 and 3

Visitor access management

The Supplier shall ensure the following controls are applied to all visitors visiting the organisation’s premises: i) Visitor access and exit shall be logged ii) All visitors shall wear visitor ID badges at all times. Visitor badges should visually differ from employee badges iii) All visitors should be appropriately escorted at all times while on the premises iv) Visitor badges should be returned to the organisation at the end of the day.

Four lines, and they are not all the same strength. Logging access and exit is a shall, and so is wearing a badge. Badges that look different from staff badges, an escort, and badges returned at the end of the day are shoulds.

Control 1500, Levels 1, 2 and 3

Physical access controls

Examples of such controls include but are not limited to: … vi) Visitor escort vii) Physical access logs viii) Authorised access lists. The Supplier shall review physical access logs regularly or in the event of a physical or cybersecurity incident.

The control above 1503. It asks the supplier to restrict and monitor physical access to where Data is stored or processed, lists examples, and then asks for the log to be reviewed, regularly and after an incident.

Clause 2.4

Evidence, not intention

The supplier shall, for each control requirement referenced in Clause 3, ensure they have a documented and implemented control in place with auditable evidence.

Why a visitor log that exists only on a clipboard is a weak answer. The control has to be documented, in place and evidenced.

Clauses 2.1, 2.2 and 2.8

Your contract decides

The CSM Risk Assessment Process assigns a Cyber Risk Profile (CRP). … Suppliers shall refer to contract documentation, including the latest version of DEFCON 658 and the Security Aspects Letter (where issued), for full contractual definition of these terms.

Issue 4 has four profiles, Level 0 to Level 3. The profile comes from the risk assessment on the contract, not from the supplier. Level 0 has three controls and 1503 is not one of them, so whether 1503 applies to you is in your own contract.

Quoted from Defence Standard 05-138 Issue 4, Cyber Security for Defence Suppliers, 14 May 2024, read on 27 September 2026. The standard’s own spelling is kept inside the quotations. The standard is UK; for a supplier to a US prime, the counterpart is on theCMMC physical security page.

Line by line

Control 1503, what the record shows, and what stays with you

1503	What the record shows	What stays with you
(i) Visitor access and exit shall be logged	The time in and the time out for every visitor, with their company and the person they came to see. Visitors sign out at the kiosk, or staff sign them out on the dashboard.	A visitor who forgets to sign out is signed out automatically at 23:59 UTC, so their record shows that time, not a real exit. The record does not say which of the three set the time.
(ii) All visitors shall wear visitor ID badges; badges should visually differ from employee badges	With Secure Badge and Approval, a printed badge with the visitor’s name, company, who they are visiting, the date and the clearance label your site defines. It prints in black on a monochrome label, so any colour coding is on the lanyard.	How your staff badges look, and whether visitors wear theirs. The kiosk prints visitor badges only.
(iii) All visitors should be appropriately escorted	The named host on every record and, with the badge module, on the printed badge.	The escort itself. The kiosk cannot see whether the host stayed with them.
(iv) Visitor badges should be returned at the end of the day	Nothing. The kiosk does not record a badge being handed back.	Collecting badges at sign out, and counting them back.

And for 1500. The visitor history, filtered by date, name or company and exported with name, company, who they visited, signed in and signed out, is a physical access log you can review. The review, and the record that you did it, are yours.

Secure Badge and Approval, step by step List X visitor requirements ITAR visitor log for UK sites

1503 (ii), made visible

A visitor badge, approved and printed

The visitor signs in and waits. A member of staff enters a PIN on the kiosk to approve the visit, and the badge prints with the visitor’s name, who they are visiting and the date.

The badge module is an add-on at £150 a month plus VAT, label printer included. The platform works without it. The player loads from YouTube only when you press play; nothing is sent to Google before that. What happens when you do.

Before you ask

The questions defence suppliers ask about 1503

Does Def Stan 05-138 require a visitor log?

At Cyber Risk Profile Levels 1, 2 and 3, yes. Control 1503 of Issue 4 says visitor access and exit shall be logged, and control 1500 says the supplier shall review physical access logs regularly or in the event of a physical or cybersecurity incident. Level 0 has three controls, and neither is among them.

Which Cyber Risk Profile applies to us?

The one your contract gives you. Issue 4 says the MOD’s risk assessment process assigns the profile, and clause 2.8 sends suppliers to their contract documentation, including DEFCON 658 and any Security Aspects Letter. We cannot tell you your level; your contract can.

Do visitor badges have to be a different colour?

Control 1503 says visitors shall wear visitor ID badges at all times and that visitor badges should visually differ from employee badges. It does not say how. With the badge module, the kiosk prints a visitor badge with the visitor’s name, host, date and the clearance label you define, in black on a monochrome label; colour, if you use it, is on the lanyard.

Does the kiosk record badges being returned?

No. Line (iv) of 1503 says visitor badges should be returned at the end of the day. The kiosk records when the visitor signed out, and nothing about the badge. Collecting and counting badges is done by your people.

How do we review the physical access log?

Filter the visitor history by date, name or company, and export it: name, company, who they visited, signed in and signed out, in UK time. The review 1500 asks for is yours to do and to record. Retention is one period for the company, from one day to two years, a year by default.

Is this the same as CMMC?

No. Def Stan 05-138 is the MOD’s standard for UK defence suppliers. CMMC is the US Department of Defense programme, with its own physical security requirements, and it has its own page on this site.

Being straight with you

What this does not do

We are not the MOD, an assessor or a consultancy, and this is general information about a published standard, not contract or security advice.
The kiosk does not make a supplier meet 05-138 or any control in it. It keeps a record towards 1503 and 1500, and whoever assesses you decides what that record is worth.
It checks no ID and records no nationality or clearance. Those stay with your security lead.
It does not record a badge coming back.
Visitor data is processed in the European Union, in Ireland. Whether that fits your contract and any Security Aspects Letter is a question for your security lead and your customer.

Everything else the kiosk does not do

Sources

Check any of this yourself

Defence Standard 05-138 Issue 4, Cyber Security for Defence SuppliersDated 14 May 2024, free from GOV.UK. Clauses 2.1, 2.2, 2.4 and 2.8 and controls 1500 and 1503 in Table 1 are quoted. Read 27 September 2026.
Cyber security for defence suppliers (Def Stan 05-138, Issue 4)The MOD’s page for Issue 4, updated 3 December 2025. It says the standard “is applicable to all Ministry of Defence (MOD) procurements, MOD suppliers and their subcontract suppliers, which have a relationship to one or more MOD contracts”. Read 27 September 2026.

General information about a published standard, not contract or security advice. Control numbers can move between issues; confirm against the issue your contract names. The Ministry of Defence has no connection with Noon Elite.

Also asked of sites like yours

The other things somebody may ask you to evidence

Each of these is a page about one standard, one duty or one visitor, written the same way as this one: what it actually asks for, what an iPad at reception records towards it, and where it does not help.

Every standard on one page: the clause numbers, the version and the date each was read, on one printable table.

Advise sites on this standard? Referral terms are on one page.

Next step

Bring your contract’s security requirements to the call

Fifteen minutes on the phone. Tell us your Cyber Risk Profile and how visitors get into your building today, and we will tell you straight which lines of 1503 a kiosk keeps a record for, and which it does not.

Book a 15 minute call

No site visit needed and nothing to install. If it is not a fit we will say so on the call.

Would rather email? [email protected]

Not the person who signs it off? Send them the one page business case