Does your organization have a formal escort policy requiring all guests, vendors, and third parties to be accompanied by authorized personnel when accessing areas containing business-critical assets?

This control prevents unauthorized access to sensitive areas and reduces the risk of data breaches, theft, or sabotage by requiring continuous supervision of non-employees. Without proper escort procedures, visitors might inadvertently or deliberately access, damage, or compromise critical systems, infrastructure, or sensitive information.

Evidence of compliance could include: a documented visitor escort policy, visitor logs showing escort assignments, physical access control procedures that specify escort requirements, or security awareness training materials that cover visitor escort protocols.