Visitor log fields
What a visitor log must contain, by standard
For the manager choosing how to record visitors, and for the auditor checking the record that was chosen. Six documents name the fields a visitor log should hold, and they do not agree. The matrix below puts them side by side in their own words, with the clause number on every cell, and underneath it says which fields a kiosk records and which stay a job for a person at the desk.
Sign in on a demonstration kiosk, then open the fire roll call on your phone. Do not enter real details: everything typed is deleted within the hour.
From £150 a month plus VAT, iPad and stand included. We are not assessors or consultants.
The matrix
Which standard names which field
A cell is filled only where the document names the field, and it holds the document’s words, not ours. An empty cell means that document does not name the field, which is not the same as saying an auditor will never ask. Each clause number links to the page that quotes the clause in full. Read 26 September 2026.
| Field | PCI DSSv4.0.1, June 2024 | CTPATForeign Manufacturers MSC, March 2020 | ITAR guidanceDDTC Compliance Program Guidelines | TAPA FSRFSR 2026, effective 15 September 2026 | TISAXVDA ISA 6.0.3 | List XRequirements v10.0, 2014; FSC guidance v1.4, 2024 |
|---|---|---|---|---|---|---|
| A record of each visit | 9.3.4“Visitor logs are used to maintain a physical record of visitor activity” | 10.2“a log must be maintained that records the details of the visit” | Element 3, C“keep records regarding foreign-person visitors at their facilities” | 4.1.5“All visitors to the office area registered and log maintained” | 8.1.7“Registration obligation for all visitors.” | 46(h)“maintain records of all foreign visitors to the site” |
| Visitor name | 9.3.4“The visitor’s name” | 10.2“Visitor’s name” | Element 3, C“The visitor’s name” | Not named | Not named | Not named |
| Company or organisation | 9.3.4“the organization represented” | Not named | Element 3, C“The name and affiliation of the organization represented” | Not named | Not named | Not named |
| Host, or who authorised access | 9.3.4“The name of the personnel authorizing physical access” | 10.2“Company point of contact” | Element 3, C“Persons, physical areas, and room numbers visited” | 4.1.5“which individual will be visited” | Not named | Not named |
| Date | 9.3.4“The date and time of the visit” | 10.2“Date of the visit” | Element 3, C“The date of the visit” | Not named | Not named | Not named |
| Time in | 9.3.4“The date and time of the visit” | 10.2“Time of arrival” | Not named | Not named | Not named | Not named |
| Time out | Not named | 10.2“Time of departure” | Not named | Not named | Not named | Not named |
| Purpose of the visit | Not named | Not named | Element 3, C“Purpose of the visit with specific emphasis on products or services discussed” | 4.1.5“what is the reason for the visit” | Not named | Not named |
| Photo ID checked | Not named | 10.2“Verification of photo identification (type verified such as license or national ID card)” | Not named | 4.1.4“identified using government-issued photo-ID” | Not named | Not named |
| Nationality | Not named | Not named | Element 3, C“The visitor’s name and nationality or nationalities” | Not named | Not named | Not named |
| Badge issued and worn | 9.3.2“given a badge or other identification that expires” | 10.2“should be issued temporary identification … must be visibly displayed at all times” | Element 7 checklist“do visitors always wear badges that clearly indicate they are non-U.S. Persons?” | 4.1.7“All visitors visibly display badges or passes” | Not named | Not named |
| Badge returned | 9.3.3“surrendered or deactivated before visitors leave the facility or at the date of expiration” | Not named | Not named | 4.1.6“All visitor badges must be reconciled as the visitor leaves the premises” | Not named | Not named |
| Rules or non-disclosure accepted | Not named | Not named | Not named | Not named | 8.1.7“Documented non-disclosure obligation prior to access.” | Not named |
| Escort | 9.3.2“Visitors are escorted at all times.” | 10.2“All visitors should be escorted.” | Element 7 checklist“Are foreign person visitors always escorted by a U.S. person employee of your organization?” | 4.1.7“escorted by company personnel” | Not named | Not named |
- PCI DSS names 9 of the 14
- CTPAT names 9 of the 14
- ITAR guidance names 9 of the 14
- TAPA FSR names 7 of the 14
- TISAX names 2 of the 14
- List X names 1 of the 14
Two notes an auditor would make. The ITAR items are guidance for a Technology Control Plan, written as should and could, and the DDTC says the ITAR prevails over it. List X paragraph 46(h) asks for records of foreign visitors in an Un-cleared Visitor Area, and the 2024 FSC guidance names the visitor’s book once, at 23.3, as an example of a Supplier’s own measures.
Named no field, and so not in the matrix: BRCGS Food, BRCGS Packaging, BRCGS Storage and Distribution, SALSA, IFS Food, UFAS, EU GMP, AEO. Each asks for a visitor recording system, controlled access or information given to visitors, and each page quotes it. ISO/IEC 27002:2022 7.2 is left out because ISO sells it and we have not read it at source.
The kiosk
The same fields: what the kiosk records, and what stays by hand
The sign in form is fixed: name, company, the person being visited, and a vehicle registration if the visitor gives one. Everything else below is what the code does with it, and where the honest answer is nothing, it says so.
| Field | The kiosk records | Done by a person |
|---|---|---|
| A record of each visit | Every sign in, stored with the company and site. A sign in taken while the Wi-Fi is down waits on the iPad and is sent when it returns. | Anyone who does not use the kiosk is not on its record. |
| Visitor name | Required on every sign in, as the visitor types it. | Checking the name against a document. |
| Company or organisation | Required on every sign in. | Nothing, unless your procedure verifies it. |
| Host, or who authorised access | Required on every sign in, picked from your staff list where you have one. With the badge module and approval switched on, the member of staff whose PIN released the badge is in the badge audit log. | The areas and rooms visited, which ITAR guidance also lists. |
| Date | Stamped on every sign in. | Nothing. |
| Time in | Stamped by the server on a live sign in; the iPad’s time, within limits, for one taken while the Wi-Fi was down. | Nothing. |
| Time out | The time the visitor signs out at the kiosk, or is signed out by staff on the dashboard, or by the automatic sign out at 23:59 UTC. The record does not say which. | Making sure people sign out. |
| Purpose of the visit | No field for it. The host is recorded; the reason is not. | Recording the purpose, and for ITAR a summary of the visit. |
| Photo ID checked | Not recorded. The kiosk does not scan or check identity documents. | Looking at the document and the face, and noting the type seen. |
| Nationality | No field for it. A site can put a line in its own wording, which the visitor accepts, but no answer is stored. | Establishing and recording nationality, and for List X which visitors are foreign. |
| Badge issued and worn | With the badge module, each badge request, approval, refusal and print is in the badge audit log. Without it, no badge. | Seeing the badge is worn. |
| Badge returned | Not recorded. The sign out time is; the badge coming back is not. | Collecting the badge and reconciling it against the log. |
| Rules or non-disclosure accepted | Every sign in carries acceptance of your wording, with the fingerprint of the exact text on the screen. | Nothing at the door. Whether acceptance on a screen is enough is your procedure’s call. |
| Escort | Not recorded. | Escorting, and noting who did. |
A delivery drop-off is logged separately, with the time and the courier company. It is not a sign in and is not on the fire roll call. The kiosk does not make a site compliant, certified or audit ready; it produces a timestamped record for the fields it holds, and the auditor decides what that record is worth.
Before you ask
Four questions about the fields
What fields does a visitor log need?
It depends on the standard. PCI DSS 9.3.4 names four things: the visitor’s name and organisation, the date and time, the person authorising access, and keeping the log for at least three months. CTPAT 10.2 lists six fields, including time of departure and verification of photo ID. ITAR guidance lists six items for foreign-person visitors, beginning with name and nationality. TAPA FSR 2026 asks that the log shows which individual was visited and the reason for the visit.
Does a visitor log need a sign out time?
Of the standards in this matrix, only CTPAT 10.2 names “Time of departure” as a field. The guidance beside PCI DSS 9.3.4 calls in and out times a best practice rather than a requirement. TAPA FSR 2026 4.1.6 asks for badges reconciled as the visitor leaves and the log checked daily, which is hard to do without one.
Does the kiosk record the purpose of the visit?
No. It records who the visitor came to see, not why. TAPA FSR 2026 4.1.5 and the ITAR guidance both name the purpose, so a site working to either needs another place to record it.
Does the kiosk check photo ID?
No. It does not scan or check identity documents and has no field for the type of ID seen. Where CTPAT 10.2 or TAPA FSR 4.1.4 applies, a person at the desk checks the document.
How long to keep the log, by standardEvery standard on one pageHow often paper is the breach: the ICO’s figures
Also asked of sites like yours
The other things somebody may ask you to evidence
Each of these is a page about one standard, one duty or one visitor, written the same way as this one: what it actually asks for, what an iPad at reception records towards it, and where it does not help.
Every standard on one page: the clause numbers, the version and the date each was read, on one printable table.
- GDPR and the visitor book
- CMMC physical security
- List X visitor control
- ITAR visitor log
- Def Stan 05-138 visitor access
- ISO 27001 visitor access
- PCI DSS visitor log
- AEO visitor access control
- CTPAT visitor log
- TISAX visitor management
- TAPA FSR visitor log
- BRCGS visitor control
- BRCGS packaging visitor control
- BRCGS storage and distribution visitors
- BRCGS unannounced audit
- Visitor control non-conformity
- SALSA visitor control
- IFS Food visitor hygiene
- UFAS feed mill visitor control
- GMP visitors in production areas
- GDP wholesale visitor control
- Fire roll call
- Contractor management
- Construction work in occupied premises
- HSE inspection records
- ISO 45001 contractor control
- Visitor NDA sign in
- Visitor record retention
- Standards calendar
- Sign in sheet template
- Visitor health questionnaire template
- Contractor induction template
- Permit to work template
- Hot work permit template
- Fire drill record template
Advise sites on this standard? Referral terms are on one page.
Next step
Bring the field list you have been given
Fifteen minutes on the phone. Read us the fields your customer or auditor has asked for, and we will tell you straight which ones the kiosk records and which stay with your reception.
Book a 15 minute callNo site visit needed and nothing to install. If it is not a fit we will say so on the call.
Would rather email? [email protected]
Not the person who signs it off? Send them the one page business case