Facility Security Clearance, formerly List X
List X visitor requirements: what the FSC guidance asks of your reception
You are the Facility Security Controller, or you report to one, and the Security Adviser’s next visit will include the front desk. The MOD’s Facility Security Clearance guidance asks for effective arrangements for the identification and control of visitors, and the 2014 List X requirements ask for records of all foreign visitors. Both are quoted below from GOV.UK, and beside them is what an iPad at the door records towards each, and the two things it does not hold.
Sign in on a demonstration kiosk, then open the fire roll call on your phone. Do not enter real details: everything typed is deleted within the hour.
From £150 a month plus VAT, iPad and stand included. We are not security advisers or consultants.
What the guidance asks
Four paragraphs from the FSC guidance, and one from the List X requirements
Section 22 of the FSC guidance is headed Controlling Visits to FSC Premises and section 23 covers visitors with a statutory right of entry. The 2014 document, still published, adds the one line about foreign visitor records that the 2024 guidance does not repeat in the same words.
FSC Guidance 22.2
Identification and control of visitors
In areas of FSC premises where classified work is undertaken or assets are held, the Supplier shall ensure that visitors do not have access to the areas or information which they have no authority to access. Accordingly, the Supplier shall implement effective arrangements for the identification and control of visitors. Differing security measures are likely to be required, for example, access control systems, doors, locks, escorts, etc.
The paragraph your visitor arrangements are held to. It asks for effective arrangements and gives examples rather than a specification. Identification is who this person is and who let them in; control is where they may go and who is with them. A record answers the first and evidences the second.
FSC Guidance 22.1
Need to know, clearance and release approval
Visitors shall not be allowed access to any classified assets or areas, unless the Facility Security Controller is assured that: such individuals have a ‘need to know’; hold the appropriate security clearance and that prior release approval has been granted by the relevant authority. Where only part of a Supplier’s premises is used for classified work, the arrangements shall limit visitors without security clearance or the need to know to areas used for non-classified work.
Three assurances, all the Facility Security Controller’s to obtain before the visit. None of them is a system’s act. What a system can do is show, afterwards, which visitors were admitted, by whom, and what they were told before they went in.
FSC Guidance 22.3 and 22.4
Who counts as a visitor
Other visitors may include customers, potential customers, maintenance Suppliers, the constituency’s Member of Parliament, or students and journalists etc, who wish to examine working conditions or industrial processes.
22.3 lists the visitors who may need access to classified work: officials sponsored by the Contracting Authority, officials from the ISAC, other FSC Supplier employees, subcontractor employees, officials with statutory right of entry, overseas visitors, and system and hardware engineers. 22.4 adds everyone else. The maintenance Supplier and the engineer are the ones a reception book tends to forget.
FSC Guidance 23.3
HSE inspectors still sign the book
The right of entry to premises accorded to inspectors under the Act does not excuse them from compliance with the Supplier’s security measures for controlling visitors, such as identifying themselves and signing the visitor’s book.
The one place the guidance names the visitor’s book, and it names it as the Supplier’s own measure. 23.2 says the difficulty of an official needing access to classified areas may often be resolved by escorting such visitors. An inspector on the record with a named escort is 23.3 done as written.
List X Requirements, paragraph 46(h)
Records of all foreign visitors
The Security Controller must maintain records of all foreign visitors to the site and these must be made available to Security Advisers on request and to members of DE&S DHSY/PSYA IVCO.
From the 2014 document, in its criteria for an Un-cleared Visitor Area, which GOV.UK still publishes. A record of every visitor is the easy half; knowing which of them were foreign visitors is a judgement the Security Controller makes and records, and the page below says what the kiosk does and does not hold towards it.
Quoted from the MOD Facility Security Clearance (FSC) Policy and Guidance for UK Defence, version 1.4, March 2024, and from Security Requirements for List X Contractors, version 10.0, April 2014, both on GOV.UK and both read on 26 September 2026. The detailed standards for your own site reach you through the ISAC and your Company Security Instructions; JSP 440 is not public and nothing here comes from it. Nothing in either document tells you to buy anything: 22.2 gives locks and escorts as examples, and 23.3 treats the visitor’s book as a perfectly good measure. What a book cannot do is show, a year on, exactly which instructions a maintenance engineer accepted before a named escort took them through.
The record
What the kiosk holds towards identification and control, and what it does not
Each line below describes what the kiosk’s code does, not what a brochure would like it to. Two of the limits matter more at a cleared site than anywhere else, and they are stated rather than hidden.
- IdentificationName, company, the member of staff they have come to see and, if they drove in, a vehicle registration. Name, company and host are required, so nobody at the desk can skip them. The sign in time is stamped by the server, not typed.
- Control: the host, and the escort colourA host is required on every sign in and is told by name in Microsoft Teams or Slack the moment the visitor arrives. With the badge module, the label carries a clearance level you define, a label and a colour of your own choosing, so an escorted visitor and a cleared engineer look different on the floor, and where the site requires approval nothing prints until a named approver enters a PIN.
- What they were toldYour visitor security instructions, the ones your Company Security Instructions say every visitor receives, go on the screen as the site policy. Nobody signs in without accepting them, and the record keeps who accepted which exact wording and when, fingerprinted so it can be shown after the wording changes.
- NationalityNot recorded. The form has no nationality field and the kiosk stores no answers to anything; it shows one text and records that it was accepted. The foreign visitor records paragraph 46(h) asks for are the Security Controller’s to keep, and the kiosk record gives them the name, the organisation, the date, the host and the times to file them against.
- Clearance and release approvalNot checked by the kiosk. Need to know, clearance and prior release approval under 22.1 are assurances the Facility Security Controller obtains before the visit. The record shows who was then admitted and by whom.
- Retained, and exportedYou set one retention period for the company, anywhere from one day to two years, with a year the default, and records are deleted automatically when it expires. The register exports for any date range as a file that opens without our software, with name, company, host, signed in and signed out.
- Where it livesIn the European Union, in Ireland, on ISO 27001 certified infrastructure, under a data processing agreement supplied as standard, with every sub-processor listed on the security page. Whether a cleared site may hold its visitor register with a third party processor outside the UK is a question for your Facility Security Controller and the ISAC, and we would rather you asked it before the call than after.
The kiosk does not make a site compliant, cleared or approved. It produces a timestamped record for the paragraphs named on this page, and the Security Adviser decides what that record is worth.
The visitor management kiosk in fullThe same door, under a US prime’s CMMC requirementsForeign person visitors under ITAR, for the export control officerWhat the HSE inspector asks to see once they have signed inWhere the data lives, and who touches it
On the day
What the Security Adviser asks at reception, and what you put in front of them
| What you are asked | What you show them |
|---|---|
| Show me your arrangements for identifying and controlling visitors. | The kiosk at the door, the instructions every visitor accepts on it, the host named on every visit, and the register behind it, on screen or exported. |
| Who was on site on this date, and who let them in? | A list filtered to that day with the host against each name, exported to a file the adviser can keep. |
| How do you know a visitor received the security instructions? | The acceptance stored against their name, with the time and the fingerprint of the exact text they were shown. |
| How is an escorted visitor told apart from a cleared one on the floor? | With the badge module, the clearance label and colour on the printed badge, set when the approver released it. |
| Did the HSE inspector sign in? | Yes, on the same kiosk, with the same instructions and a named escort, as 23.3 expects. |
Escorts, made visible
A badge printed only after a named approver’s PIN
The visitor signs in and waits. The host is told, walks over and enters a PIN on the kiosk. No approval, no badge. The clearance label and colour on the label are yours to define, which is how an escorted visitor is told apart from a cleared engineer on the floor.
The badge module is an add-on at £150 a month plus VAT, label printer included. The platform works without it. The player loads from YouTube only when you press play; nothing is sent to Google before that. What happens when you do.
Before you ask
The questions Facility Security Controllers ask
Is List X still the right term?
The MOD’s current policy document is the Facility Security Clearance (FSC) Policy and Guidance for UK Defence, version 1.4 of March 2024, which uses Facility Security Clearance and Supplier throughout. The 2014 document, Security Requirements for List X Contractors version 10.0, is still published on GOV.UK without a withdrawal notice, and its paragraphs 18 and 19 say what the FSC guidance now says at 22.1 and 22.2. People still search for List X, which is why this page uses both.
Does the FSC guidance require a visitor book?
Not in those words. Paragraph 22.2 requires effective arrangements for the identification and control of visitors and lists access control systems, doors, locks and escorts as examples. The book appears once, at 23.3, as an example of the Supplier’s own measures that even an HSE inspector must comply with. What form your arrangements take is yours to decide with the ISAC; what the record has to be able to do is show who was identified, by whom, and what they were told.
Do HSE inspectors have to sign in at a cleared site?
Yes. Paragraph 23.3 says the right of entry under the Health and Safety at Work Act does not excuse an inspector from the Supplier’s security measures for controlling visitors, such as identifying themselves and signing the visitor’s book, and 23.2 says access to areas holding classified assets may often be resolved by escorting them. The HSE inspection page on this site covers what the inspector will then ask to see.
Does the kiosk record a visitor’s nationality?
No. The sign in form is name, company, host and a vehicle registration, and the kiosk stores no answers to anything, so it cannot hold a nationality even if your instructions ask visitors to state one. The records of all foreign visitors that paragraph 46(h) asks the Security Controller to maintain stay the Security Controller’s; the kiosk gives them a name, an organisation, a date, a host and both times for each visit to keep those records against.
Can visitors be shown the security instructions before they go in?
Yes. One wording per site goes on the screen as the site policy, and nobody signs in without accepting it. The wording is stored as served and fingerprinted, so a year later you can show which exact text a visitor accepted even after you have changed it. It is a text panel and one button: no signature, no questions, and no routing of anyone who declines. What happens to a visitor who will not accept is reception’s decision.
Where is the visitor data held, and is that acceptable for a cleared site?
In the EU, in Ireland, on ISO 27001 certified infrastructure, under a data processing agreement, with every sub-processor named on the security page. We do not know whether your FSC and the ISAC will accept a third party processor outside the UK for a visitor register at your site, and we will not guess. Ask them first; if the answer is no, a paper book kept in a secure cabinet is the right tool and we will say so.
Being straight with you
What this does not do
- We are not the Ministry of Defence, the ISAC, a Security Adviser or a security consultancy. This is general information about two published documents, not security advice.
- The detailed physical standards for a cleared site reach you through the ISAC and your own Company Security Instructions. JSP 440 is not public and nothing here is taken from it.
- The kiosk records no nationality and checks no clearance. Need to know, clearance and release approval are the Facility Security Controller’s assurances, and the foreign visitor records are the Security Controller’s to keep.
- It is not an access control system. It does not open doors, hold keys or stop anyone walking past it. It records who came through the door it sits by, and who they came to see.
- Visitor data is processed in the EU, in Ireland, by the sub-processors the security page lists. Whether that is acceptable for your site is a question for your FSC and the ISAC, and the answer may be no.
- If your Security Adviser has raised a specific point, bring their wording to the call and we will tell you honestly whether this closes it.
Sources
Check any of this yourself
- MOD, Facility Security Clearance (FSC) Policy and Guidance for UK Defence, v1.4Published March 2024, free on GOV.UK. Sections 22 and 23 are quoted from it. Read 26 September 2026.
- Security Requirements for List X Contractors, version 10.0April 2014, published on GOV.UK on 1 April 2014 and still there without a withdrawal notice. Paragraph 46(h) is quoted from it. Read 26 September 2026.
- GOV.UK, Security requirements for List X contractorsThe publication page for the 2014 document, where any withdrawal or replacement notice would appear.
General information about published government documents, not security advice. Paragraph numbers move between versions; confirm against your own copy and your ISAC Security Adviser.
Also asked of sites like yours
The other things somebody may ask you to evidence
Each of these is a page about one standard, one duty or one visitor, written the same way as this one: what it actually asks for, what an iPad at reception records towards it, and where it does not help.
Every standard on one page: the clause numbers, the version and the date each was read, on one printable table.
- GDPR and the visitor book
- CMMC physical security
- ITAR visitor log
- Def Stan 05-138 visitor access
- ISO 27001 visitor access
- PCI DSS visitor log
- AEO visitor access control
- CTPAT visitor log
- TISAX visitor management
- TAPA FSR visitor log
- BRCGS visitor control
- BRCGS packaging visitor control
- BRCGS storage and distribution visitors
- BRCGS unannounced audit
- Visitor control non-conformity
- SALSA visitor control
- IFS Food visitor hygiene
- UFAS feed mill visitor control
- GMP visitors in production areas
- GDP wholesale visitor control
- Fire roll call
- Contractor management
- Construction work in occupied premises
- HSE inspection records
- ISO 45001 contractor control
- Visitor NDA sign in
- Visitor record retention
- What a visitor log must contain
- Standards calendar
- Sign in sheet template
- Visitor health questionnaire template
- Contractor induction template
- Permit to work template
- Hot work permit template
- Fire drill record template
Advise sites on this standard? Referral terms are on one page.
Next step
Ask your FSC and the ISAC first, then bring their answer to the call
Fifteen minutes on the phone. Tell us what your Security Adviser said about reception and whether a third party processor in Ireland is acceptable for your register. If it is not, we will say so and stop there.
Book a 15 minute callNo site visit needed and nothing to install. If it is not a fit we will say so on the call.
Would rather email? [email protected]
Not the person who signs it off? Send them the one page business case