Visitor records by standard

Visitor records by standard: what each auditor asks to see

One row per standard: the clause numbers that reach a reception desk, what the document says in its own words, the version, and the day it was read. Each row links to a page that quotes the clause in full and says what a record can and cannot show for it. The table prints as a landscape sheet with the dates on it.

Go to the table

Written for consultants and the managers they advise. We are not assessors, auditors or consultants, and nothing on this page is compliance advice.

The table

21 standards, grouped by who is being audited

The kiosk produces a timestamped record for the clauses named here, and the auditor decides what that record is worth. Nothing on this page is compliance advice: each row is what the document says, read on the date shown, with the page that quotes it in full.

Read across the table: How long to keep visitor records (what each document says about how long, in its own words); What a visitor log must contain (which document names which field, in a matrix); Standards calendar (when each new issue applies, and what it changed at reception). Choosing a system rather than checking one? The requirements checklist puts these clauses beside each line of a specification.

Food, drink, packaging and pharmaceutical production

Standard	Version and date read	Clauses	What it asks for	Page
BRCGS Global Standard Food SafetySource, free	Issue 9, published 1 August 2022; audits against it since 1 February 2023Read 26 September 2026.	4.1.4; 7.3.2	“Policies and systems shall be in place to ensure that access to the site by staff, contractors and visitors is controlled. A visitor recording system shall be in place. Contractors and visitors, including drivers, shall be made aware of the procedures for access to the site.” (4.1.4)The Standard itself is sold on the BRCGS Store. The wording is quoted from BRCGS’s own free Issue 9 auditor checklist and self-assessment tool, F904a, version 1, 1 August 2022, which reproduces every requirement under its clause number. 7.3.2 asks visitors, before entering open food areas, to complete a health questionnaire or otherwise confirm they have no symptoms that may put product safety at risk.	The clause in full
BRCGS Global Standard Packaging MaterialsSource, free	Issue 7, published 28 October 2024; audits from April 2025; Position Statement P708 amends 4.4.1 from 10 August 2026Read 26 September 2026.	4.4.2; 4.4.1; 6.4.2	“Processes shall be in place to ensure only authorised personnel have access to manufacturing and storage areas, and access to the site by personnel, contractors and visitors shall be controlled. A visitor reporting system shall be in place.” (4.4.2)The Standard itself is sold on the BRCGS Store. The wording is quoted from BRCGS’s free Issue 7 audit checklist P701a, version 1, 28 October 2024. 6.4.2 asks visitors and contractors to complete a health questionnaire or otherwise confirm they are free of symptoms before entering manufacturing, packing or storage areas.	The clause in full
BRCGS Global Standard Storage and DistributionSource, free	Issue 4, published 2020; audits against it since 1 May 2021Read 26 September 2026.	4.2.2; 4.2.4; 8.2.7	“Access to the site by employees, contractors and visitors shall be controlled and a visitor reporting system shall be in place.” (4.2.2) “Contractors and visitors, including drivers, shall be made aware of all procedures for access to premises and the requirements of the areas they are visiting.” (4.2.4)The Standard itself is sold on the BRCGS Store. The wording is quoted from BRCGS’s free SD401 site self-assessment tool, version 4, 6 May 2021.	The clause in full
SALSA Food & Drink Production Audit StandardSource, free	Issue 7, June 2026; all audits against it from 1 September 2026Read 26 September 2026.	1.2.7; 4.2.3; 4.3.3	“The business shall have a procedure for establishing the health status of food handlers and for the notification by employees, temporary employees, contractors and visitors of any relevant infectious disease or condition with which they may be suffering or have been in contact with.” (1.2.7)Issue 7 has no visitor clause and asks for no visitor book by name. 4.2.3 asks the food defence plan for security measures that keep unauthorised people out of production and storage areas; 4.3.3 asks for a procedure for visitor tours and tastings.	The clause in full
IFS FoodSource, free	Version 8, April 2023; mandatory for audits from 1 January 2024Read 26 September 2026.	3.2.2 (KO N° 3); 4.21.2; 3.2.3	“KO N° 3: The requirements for personal hygiene shall be understood and applied by all relevant personnel, contractors and visitors.” (3.2.2)No requirement asks for a visitor book by name. 4.21.2 asks the food defence plan to include a policy of access by employees, visitors and contractors; 3.2.3 asks that compliance with the hygiene requirements is monitored at least once in every three months.	The clause in full
UFAS Scheme Rules and StandardSource, free	2024, Version 1.1, effective from 1 April 2025Read 26 September 2026.	F 1.2; F 1.4; F 1.5; F 1.6	“The Participant must ensure that appropriate and proportionate security measures are planned and implemented to monitor and prevent unauthorised access at all times wherever this is deemed necessary to maintain feed safety.” (F 1.2)F 1.2 itself says nothing about visitors; the Standard’s own Interpretation paragraph under it lists control of visitors and contractors among the measures. F 1.4 to F 1.6 ask that employees, contractors and visitors, including vehicle drivers, are made aware of the rules on eating, drinking, smoking and vaping, wear suitable workwear, and are advised not to enter when suffering from a communicable enteric disease.	The clause in full
EU GMP, EudraLex Volume 4, Part 1Source, free	Chapter 2, Personnel, in operation since 16 February 2014; Chapter 3, Premises and Equipment, since 1 March 2015Read 26 September 2026.	Chapter 2, paragraph 2.13; Chapter 3, paragraph 3.5	“Visitors or untrained personnel should, preferably, not be taken into the production and quality control areas. If this is unavoidable, they should be given information in advance, particularly about personal hygiene and the prescribed protective clothing. They should be closely supervised.” (2.13)Both paragraphs say should, and neither asks for a record. 3.5 asks that steps are taken to prevent the entry of unauthorised people. The MHRA inspects UK sites against the same text.	The clause in full

Information and data security

Standard	Version and date read	Clauses	What it asks for	Page
UK GDPR, with the Data Protection Act 2018Source, free	Regulation (EU) 2016/679 as it applies in UK law, legislation.gov.uk, latest available (revised)Read 26 September 2026.	Article 5(1)(c), (e) and (f); Article 5(2); Article 6(1)(f); Articles 13 and 15	Personal data shall be “processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage”. (Article 5(1)(f))Law, not a standard, and it has no rule about visitor books. The principles apply to any register of people, on paper or on screen; a paper book is lawful, and hard to run well against five of them.	The clause in full
ISO/IEC 27001Source, sold by the publisher	2022 edition, third edition, Annex A restructured to 93 controlsNot read at source.	Annex A 7.2, with 7.1, 7.3, 7.4 and 7.6	A 7.2, Physical entry: secure areas protected by appropriate entry controls and access points. The guidance in ISO/IEC 27002:2022 7.2 is where visitors are named: expected, signed in, escorted where appropriate, signed out, with the record kept, protected and reviewed.ISO sells both documents and neither has been read at source. The control number and title are as ISO’s contents list prints them; the rest is a description, not a quotation, and an auditor’s copy governs.	The clause in full
PCI DSS, Requirements and Testing ProceduresSource, free after registration	Version 4.0.1, June 2024Read 26 September 2026.	9.3.1 to 9.3.4	“Visitor logs are used to maintain a physical record of visitor activity both within the facility and within sensitive areas, including: The visitor’s name and the organization represented. The date and time of the visit. The name of the personnel authorizing physical access. Retaining the log for at least three months, unless otherwise restricted by law.” (9.3.4)The Council’s library asks for a licence agreement before the PDF opens. 9.3.2 asks that visitors are authorised before entering, escorted at all times and given identification that expires; 9.3.3 that it is surrendered or deactivated on leaving.	The clause in full
TISAX, VDA ISASource, free	VDA ISA 6.0.3, the basis of assessments starting after 1 April 2024; VDA ISA 2027 dated 1 July 2026Read 26 September 2026.	3.1.1 (should); 8.1.7, prototype protection (8.1.8 in ISA 2027)	“Visitor management policies (including registration and escorting of visitors) are defined.” (3.1.1, should) “Registration obligation for all visitors. Documented non-disclosure obligation prior to access. Publication of security and visitor regulations.” (8.1.7)3.1.1 asks for policies to be defined, at should level; the record is how an assessor sees them applied. 8.1.7 applies only to sites assessed for prototype protection.See also the non-disclosure record 8.1.7 asks for.	The clause in full
Defence Standard 05-138, Cyber Security for Defence SuppliersSource, free	Issue 4, 14 May 2024Read 27 September 2026.	1503; 1500	“The Supplier shall ensure the following controls are applied to all visitors visiting the organisation's premises: i) Visitor access and exit shall be logged ii) All visitors shall wear visitor ID badges at all times. Visitor badges should visually differ from employee badges iii) All visitors should be appropriately escorted at all times while on the premises iv) Visitor badges should be returned to the organisation at the end of the day.” (1503)1503 and 1500 apply at Cyber Risk Profile Levels 1, 2 and 3, not Level 0; the profile is assigned on the contract. 1500 asks the supplier to review physical access logs regularly or after an incident.	The clause in full

Supply chain and defence

Standard	Version and date read	Clauses	What it asks for	Page
CMMC, with NIST SP 800-171Source, free	32 CFR 170.14 (2025 edition) names NIST SP 800-171 Revision 2, February 2020, with updates as of 28 January 2021Read 26 September 2026.	3.10.1; 3.10.3; 3.10.4; 3.10.5	“Escort visitors and monitor visitor activity.” (3.10.3) “Maintain audit logs of physical access.” (3.10.4) The discussion under 3.10.4: “Audit logs can be procedural (e.g., a written log of individuals accessing the facility), automated (e.g., capturing ID provided by a PIV card), or some combination thereof.”NIST withdrew Revision 2 on 14 May 2024 in favour of Revision 3, which consolidates these as 03.10.07. The CMMC rule as published still names Revision 2, so Revision 2 is what an assessment reads.	The clause in full
List X: MOD Facility Security Clearance Policy and GuidanceSource, free	Version 1.4, March 2024; with Security Requirements for List X Contractors, version 10.0, April 2014Read 26 September 2026.	FSC guidance 22.1 to 22.4 and 23.3; 2014 requirements paragraph 46(h)	“In areas of FSC premises where classified work is undertaken or assets are held, the Supplier shall ensure that visitors do not have access to the areas or information which they have no authority to access. Accordingly, the Supplier shall implement effective arrangements for the identification and control of visitors.” (22.2)Arrangements, not a named system: the visitor’s book appears once, at 23.3, as an example of the Supplier’s own measures. Paragraph 46(h) of the 2014 document requires records of all foreign visitors. The Facility Security Controller and the ISAC decide what is acceptable.	The clause in full
ITAR: DDTC Compliance Program GuidelinesSource, free	The PDF on DDTC’s compliance portal, file dated 2 December 2022; the document prints no version numberRead 26 September 2026.	Element 3, section C (Technology Control Plans); Element 6	“TCPs should also address how organizations will keep records regarding foreign-person visitors at their facilities. For example, organizations could document all foreign person visits and any special conditions attached to the visits.” The six items such records should indicate begin with the visitor’s name and nationality.Guidance on a compliance programme, not the regulation: the guidelines say of themselves that the ITAR prevails. They state no retention period for a visitor record.	The clause in full
AEO: HMRC customs technical handbook, security and safety (AEOS)Source, free	GOV.UK guidance page dated 17 July 2025; with C118-6, guidance notes to section 6 of the questionnaire, updated 22 January 2024Read 26 September 2026.	Handbook 11.6, 11.9 and 11.4; C118-6 sections 6.1 and 6.2	“The process of access to business premises (buildings, production areas, warehouses, and so on) should be regulated for staff, visitors, other persons, vehicles and goods.” (11.6) “Customs will look for evidence of how and when you tell both staff and visitors about your procedures.” (C118-6, 6.1)Guidance, and it names no log: it asks for regulated access, documented procedures and evidence, and 11.1 says procedures will always be checked on site. C118-6 asks how you control or record visitors with private vehicles.	The clause in full
CTPAT Minimum Security CriteriaSource, free	Foreign Manufacturers, March 2020; U.S. Importers, October 2021Read 26 September 2026.	Foreign Manufacturers 10.1 to 10.4; U.S. Importers 3.4 and 3.5	“Visitors, vendors, and service providers must present photo identification upon arrival, and a log must be maintained that records the details of the visit.” (10.2, Must)A UK site cannot join CTPAT; it is asked because a US importer must, under 3.5, check that its business partners meet the criteria. 10.2 states no retention period. Escorting and temporary identification are should; the log and the photo ID are must.	The clause in full
TAPA Facility Security Requirements (FSR)Source, free	FSR 2026, Issue1.2026, effective 15 September 2026Read 26 September 2026.	4.1.1; 4.1.4 to 4.1.7; 9.4.1	“All visitors to the office area registered and log maintained for minimum of 30 days. Visit details, such as which individual will be visited, what is the reason for the visit, must be traceable through the information recorded in the visitor log.” (4.1.5, levels A, B and C)4.1.4 asks for government-issued photo ID at the door, and 4.1.6 for badges reconciled on leaving and the log checked daily, at levels A and B. Sites certified before 15 September 2026 will know these as 7.3.1 to 7.3.7 of FSR 2023.	The clause in full
EU Guidelines on Good Distribution Practice of medicinal products for human useSource, free	2013/C 343/01, 5 November 2013, OJ C 343, 23 November 2013Read 27 September 2026.	3.2	“Unauthorised access to all areas of the authorised premises should be prevented. Prevention measures would usually include a monitored intruder alarm system and appropriate access control. Visitors should be accompanied.” (3.2)The guidelines name no visitor log. A UK wholesale dealer follows them because MHRA Guidance Note 6, Appendix 2, says the licence holder shall comply with the guidelines on Good Distribution Practice, footnoting 2013/C 343/01.	The clause in full

Health, safety and fire

Standard	Version and date read	Clauses	What it asks for	Page
ISO 45001Source, sold by the publisher	2018 edition, the only editionNot read at source.	8.1.4.2; 6.1.2.1; 8.2	Contractors (8.1.4.2): co-ordinate procurement with contractors so that the hazards and risks arising from their work on the site are identified, assessed and controlled. Hazard identification (6.1.2.1) considers the people with access to the workplace, contractors and visitors named. Emergency planning (8.2) communicates the planned response to contractors and visitors.ISO sells the standard and it has not been read at source; the clause numbers are as its contents list prints them and the rest is a description, not a quotation. There is no visitor or contractor management section and no clause asks for a log.	The clause in full
Regulatory Reform (Fire Safety) Order 2005Source, free	SI 2005/1541 as printed on legislation.gov.uk, latest available (revised)Read 26 September 2026.	Article 15(1)(a) and (b); 15(3); Article 2	The responsible person must “establish and, where necessary, give effect to appropriate procedures, including safety drills, to be followed in the event of serious and imminent danger to relevant persons” and “nominate a sufficient number of competent persons to implement those procedures in so far as they relate to the evacuation of relevant persons from the premises”. (15(1)(a) and (b))The Order never says roll call. The Home Office guide for factories and warehouses (May 2006) does: carry out a roll call at the assembly point, note who is unaccounted for, and pass that to the fire and rescue service on arrival. Article 2 makes relevant persons anyone lawfully on the premises, visitors and contractors included.	The clause in full

Six pages in the same family are not standards and have no row: Contractor management (HSE guidance on managing contractors, in five steps); Construction work in occupied premises (the client’s duties under CDM 2015 and the asbestos information duty in regulation 4 of the Control of Asbestos Regulations 2012, read 28 September 2026); HSE inspection records (the powers in section 20 of the 1974 Act and what an inspector asks to see); Visitor NDA sign in (a capability rather than a standard: acceptance of a wording, recorded); BRCGS unannounced audit (BRCGS079, the protocol for unannounced audits under the three BRCGS standards above, read 27 September 2026); Visitor control non-conformity (the 28 day corrective action procedure in Part III of BRCGS Food Safety Issue 9, for a finding against 4.1.4 or 7.3.2, read 27 September 2026).

A quotation is the document’s own words and keeps its spelling. Where a row says the document was not read at source, the wording is a description and your own copy governs. Clause numbers move between issues; check the version in the second column against the one your auditor is working from.

Asked often

Standards people ask about that have no visitor clause

Four documents that come up in the same conversations and ask for nothing at reception. Each answer was written from the document on the day shown, and nothing is here that was not read.

Does SOC 2 require a visitor log?

No criterion asks for one. CC6.4 of the AICPA’s Trust Services Criteria reads: “The entity restricts physical access to facilities and protected information assets (for example, data center facilities, backup media storage, and other sensitive locations) to authorized personnel to meet the entity’s objectives.” Its three points of focus are creating or modifying physical access, removing it, and periodically reviewing it. None names visitors or a log. Read on 26 September 2026 from TSP Section 100, 2017 Trust Services Criteria, in the copy that includes the March 2020 updates; the 2022 edition with revised points of focus sits behind the AICPA’s free login and was not read, so check CC6.4 in that copy before you rely on this line.

AICPA, 2017 Trust Services Criteria (with revised points of focus, 2022), free after registration.

Does COMAH 2015 require a roll call or a visitor record?

Schedule 4 of the Control of Major Accident Hazards Regulations 2015 lists what an internal emergency plan must include. Item (d) is “the arrangements for limiting the risks to persons within the establishment including how warnings are to be given and the actions persons are expected to take on receipt of a warning.” No item in Part 1 or Part 2 names visitors, a roll call, a headcount or a register of who is on site. Read on legislation.gov.uk on 26 September 2026.

COMAH Regulations 2015, Schedule 4, free.

Does Martyn’s Law apply to a factory, and does it ask who is on site?

The Terrorism (Protection of Premises) Act 2025 applies to premises wholly or mainly used for one of the uses in its Schedule 1: shops, food and drink, entertainment and leisure, sports grounds, libraries and museums, halls, visitor attractions, hotels, places of worship, health care, stations, aerodromes, childcare and education, and public authority services to the public. Factories, offices and warehouses are not on the list. The public protection procedures in section 5 are for evacuating people, moving them, keeping them in or out and informing them; nothing asks who is present. The duties in Part 1 are not yet in force: the two commencement instruments made so far, SI 2026/320 and SI 2026/622, brought in the guidance power and two Security Industry Authority provisions, and the notification regulations, SI 2026/793, start only when section 9 does, on a day not yet appointed. Read on legislation.gov.uk on 26 September 2026.

Terrorism (Protection of Premises) Act 2025, Schedule 1, free.

Does CQC Regulation 9A require a visitor record?

No. Regulation 9A of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, inserted by SI 2023/1402 and in force from 6 April 2024, requires a care home, hospital or hospice to facilitate visits and accompaniment for service users unless there are exceptional circumstances, and to take necessary and proportionate precautions so that visits are safe. It names no record, log or register of visitors. Read on legislation.gov.uk on 26 September 2026.

Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, regulation 9A, free.

Using it

Hand the sheet over, not a file

Print, or choose Save as PDF in the print dialog. Everything but the table is hidden, the sheet is landscape, and the dates read are on it.
There is no PDF to download, deliberately. A file in a downloads folder cannot be corrected, and a clause table with a date on it is the kind of thing that gets corrected.
Each page linked in the last column quotes the clause in full, with the source, and says plainly what a record at reception can show for it and what stays a job for a person.

Being straight with you

What this page is not

Not compliance advice, and not a substitute for the standard. We are not assessors, auditors or consultants, and the auditor’s copy governs.
Not a claim that a kiosk makes a site compliant, certified or audit ready. It produces a timestamped record for the clauses named, and the auditor decides.
Not complete. A standard is added when its document has been read and its page written, which is why two rows say they were not read at source and why ISO 27002’s guidance is described rather than quoted.

Also asked of sites like yours

The other things somebody may ask you to evidence

Each of these is a page about one standard, one duty or one visitor, written the same way as this one: what it actually asks for, what an iPad at reception records towards it, and where it does not help.

Next step

Bring the clause to the call

Fifteen minutes on the phone. Read us the clause you or your client has been asked about, and we will tell you straight whether a kiosk produces the record it asks for.

Book a 15 minute call

No site visit needed and nothing to install. If it is not a fit we will say so on the call.

Would rather email? [email protected]

Not the person who signs it off? Send them the one page business case