Visitors escorted and monitored

CMMC 2.0 PE.L1-3.10.3 (NIST 800-171r2 3.10.3) requires that visitors to facilities where FCI is processed or stored are escorted and monitored. Unescorted visitors in areas containing workstations, servers, or printed FCI can observe screens, photograph documents, or access unlocked machines without any technical barrier. This control has no software implementation — it is a procedural and physical control assessed through facility inspection. Even when this check is automatically skipped in a code audit, the absence of visitor management procedures is a direct CMMC assessment finding during a physical review.

Add visitor management procedures to the SECURITY.md physical security section. These documented procedures are reviewed during CMMC formal assessments as evidence of policy:

## Visitor Policy (PE.L1-3.10.3)
- All visitors must sign in at reception with government-issued ID
- Visitor badges issued and visibly worn throughout the visit
- Visitors escorted by an authorized employee in all secure areas
- Visitor access limited to areas necessary for their stated purpose
- Visitor log retained for a minimum of 90 days

Store the visitor log — physical or digital — where it can be produced on request during a C3PAO assessment.