Guides

What is a visitor management system? The parts, and who needs which.

A visitor management system replaces the paper visitor book with software that records who comes on site, tells the person they came to see, and keeps a record you can search later. This guide takes one apart so you can see which parts your site needs.

Quick answer. A visitor management system (VMS) records each person who visits a site: who they are, who they came to see, and when they arrived and left. Around that record sit optional parts: pre-registration, host notification, badges, screening against watchlists and sanctions lists, contractor compliance checks, evacuation roll call, and retention rules for the records. A small office may only need sign-in and host alerts. A plant with contractors on site every day, or a regulated facility, usually needs most of the list.

The basic job

Every system starts with the visit record. At minimum it holds the visitor's name and company, the person they are visiting, and the time in and out. That record answers the questions you get asked after the fact: who was here on a given day, who let them in, and whether they were still in the building at 4:15 pm.

A paper book collects the same fields, badly: unreadable handwriting, missing sign-out times, and earlier visitors' names on show to everyone who signs in after them. More in the paper visitor book and privacy.

The parts of a visitor management system

1. Sign-in and sign-out

A tablet kiosk in reception, a receptionist typing details at the front desk, or the visitor's own phone after scanning a code. Good systems let you set fields per visitor type, take a signature on an NDA or site rules, and ask questions that can stop entry. Sign-out matters just as much: if leaving isn't recorded, the on-site list is wrong and so is everything built on it. Who needs it: every site. See visitor sign-in kiosk.

2. Pre-registration

The host adds an expected visitor in advance. The visitor gets an email with a pass, reception sees today's arrivals, and any checks can run before the day rather than at the desk. Some systems create these entries from meeting invitations in the host's calendar. Who needs it: offices with a lot of booked meetings, and any site where screening or paperwork needs lead time. See visitor pre-registration.

3. Host notification

A message to the host when their visitor arrives, by email or a chat tool, so nobody has to phone around the building. Who needs it: any site where visitors wait in reception for someone to collect them.

4. Badges and passes

A printed label or card showing the visitor's name, host and visitor type, often with a code for signing out. Some systems also give the visitor a pass on their phone. Who needs it: sites where staff must be able to tell a visitor from an employee at a glance. See visitor badge printing.

5. Screening

Checking names against your own list of people who are not allowed in and, where your risk assessment calls for it, against government sanctions lists. A close match holds the visitor until someone reviews it. No US regulation requires sanctions screening of people at physical entry. OFAC expects a risk-based compliance program, and many sites with export, defense or financial exposure choose to include visitors and contractors in it. Who needs it: those sites, and anyone who has had to ban a person from the premises. See sanctions screening.

6. Contractor compliance

Contractors are not ordinary visitors. They work on site, often unsupervised, and need in-date insurance, licenses and certificates, a completed site induction, and sometimes a permit for hazardous work. The system checks these at sign-in and refuses entry with a reason when something has lapsed. Who needs it: manufacturing, warehousing, utilities and any building with regular maintenance contractors. See contractor compliance and permits to work.

7. Evacuation roll call

A live list of everyone signed in, which fire marshals can open outside the building and mark people safe or missing. Under 29 CFR 1910.38(c)(4), an OSHA emergency action plan must include procedures to account for all employees after evacuation. Visitors and contractors aren't employees, but they are in the building, and your count has to include them in practice. Who needs it: any site where more than a handful of people come and go each day. See evacuation roll call.

8. Records and retention

Searchable history, exports, and automatic deletion after a period you choose. Rules differ. PCI DSS v4.0 requirement 9.3.4 asks for a visitor log for the facility and sensitive areas, kept for at least three months unless otherwise restricted by law. NERC CIP-006-6 requirement R2 part 2.3 asks for visitor logs to be kept for at least ninety calendar days. Privacy law pushes the other way, against keeping personal data longer than needed. Who needs it: everyone, and regulated sites most of all. See how long to keep visitor logs.

Many systems add more: courier and parcel logging (deliveries and mailroom), employee sign-in for fire roll call and timesheets (staff sign-in), lobby welcome screens, and connections to door controllers and directories (integrations).

Who needs which parts

Typical patterns, not rules. Start from your own risks and obligations.

Type of site	Usually needs	Often optional
Small office, one reception	Sign-in, host notification, records	Badges, screening, contractor checks
Corporate office with many meetings	Pre-registration from calendars, host notification, badges, roll call	Contractor checks, screening
Manufacturing plant or warehouse	Contractor compliance, permits, roll call, badges	Calendar pre-registration
Data center or card-data facility	Badges, host approval, visitor log with set retention	Sanctions screening
Defense supplier or exporter	Screening, pre-registration so screening runs early, records	Lobby screens
Several sites	Central admin with per-site settings, per-site user access	Depends on each site

What a visitor management system does not do

It doesn't lock doors. Doors belong to your access control system. A VMS can send it a signal on sign-in or sign-out, but the door system decides what happens.
It doesn't replace people. A held visitor still needs someone with authority to deal with them, and a roll call still needs marshals.

What to check before buying

Questions that separate systems quickly:

What happens at reception when the internet drops: do sign-ins stop, or only some actions?
Which lists does screening use, are published aliases included, and how old can each list get?
Can you export every record yourself, as a file, without asking support?
Can you set a retention period, and does the system actually delete records when it passes?
Can fire marshals open the roll call on their own phones without installing anything?
What hardware is needed: which tablets, which printers, which badge sizes?
How is it priced: per location, per host or per visitor, and what does the next site cost?

The longer version, with what a good answer sounds like, is the visitor management system requirements checklist.

How BeckonDesk handles this

BeckonDesk covers the eight parts above in one plan at $79 per location per month. Visitors sign in on a browser-based tablet kiosk, at the front desk, or on their own phone from the kiosk's QR code. Visitors can be pre-registered one at a time, in groups from a spreadsheet, or from Microsoft 365 calendar meetings. Hosts get an email, and arrivals can also post to a Teams or Slack channel. Badges print through the browser's print dialog on cards, labels or paper, and visitors also get a pass on their phone. Names and companies are screened against your own watchlist and five public sanctions lists. Contractor sign-in is refused when a certificate, the company's insurance or an induction has lapsed, and any live permit to work is shown at sign-in. Fire marshals open the roll call by scanning a QR code on their own phones. You set how long records are kept, and reports export as CSV. Deliveries and staff sign-in are included.

What it doesn't do: there are no visitor photos, no camera ID scanning and no native mobile apps. Sign-ins need a connection (only sign-outs queue offline), and the kiosk is English only. There is no SMS, and staff sign in with a BeckonDesk account rather than through your own identity provider, though Microsoft Entra ID directory sync and SCIM provisioning are available. The roll call has no muster-point filtering, and reports are CSV rather than PDF. The trial is 30 days with every feature and no card.

Frequently asked

Is a visitor management system the same as access control?

No. Access control decides which doors open for which credentials. A visitor management system records who visits, checks them and tells their host. The two can be connected, so that a sign-in or sign-out sends a signal to the door system.

Is a visitor management system required by law?

No US law requires visitor management software. Some rules require a visitor log or a way to account for people: PCI DSS v4.0 requirement 9.3.4 for card-data facilities, NERC CIP-006-6 for Physical Security Perimeters, and 29 CFR 1910.38(c)(4) for accounting for employees after an evacuation. Software makes those records complete and searchable.

What hardware does a visitor management system need?

Usually a tablet at reception and, if you print badges, a label or card printer. Some systems run in a web browser and need no app install. BeckonDesk runs on any tablet with a browser and prints badges through the browser's print dialog.

Sources

29 CFR 1910.38, Emergency action plans (OSHA)
PCI DSS v4.0, requirement 9.3.4 (PCI Security Standards Council document library)
NERC CIP-006-6, Physical Security of BES Cyber Systems, requirement R2
A Framework for OFAC Compliance Commitments (2019)

Try every part on your own site.

Sign-in, pre-registration, screening, contractor checks and roll call in one plan at $79 per location per month. 30-day trial, every feature, no card.

Start free trial Book a walkthrough