Reference
Visitor log requirements by US regulation
Which US rules require a visitor log, what it has to record, and how long to keep it. 8 regimes in one table, with a free CSV.
Quick answer. Of the 8 regimes below, 4 require a visitor log with set contents: PCI DSS, NERC CIP-006, state cannabis rules and the CTPAT program. Retention runs from 90 days (NERC CIP) and three months (PCI DSS) to four years (West Virginia cannabis). HIPAA, SOC 2, ISO 27001 and OSHA do not require a log, but it is the usual evidence for the controls they do require.
Reviewed 2026-10-18. Federal and program rules plus one state example; your state, auditor or insurer can require more. Not legal advice.
| Regime | Applies to | Visitor log required | What it must record | Retention |
|---|---|---|---|---|
| PCI DSS v4.0.1 Requirement 9.3.4 |
Facilities and sensitive areas where cardholder data is stored, processed or transmitted | Yes | Visitor name and organization, date and time of the visit, name of the person authorizing access | At least three months, unless law restricts it |
| NERC CIP-006-6 R2.2, R2.3 |
Physical Security Perimeters of high and medium impact BES Cyber Systems | Yes | Date and time of initial entry and last exit, visitor name, point of contact responsible for the visitor | At least 90 calendar days |
| State cannabis rules State law (example: West Virginia; Ohio similar) |
Licensed cannabis cultivation, processing and dispensary sites | Yes | Full name, badge number, arrival and departure time, purpose including areas entered and staff seen; ID checked and copied | Four years in West Virginia; varies by state |
| CTPAT Minimum Security Criteria CBP, physical access controls |
Facilities of companies in the CTPAT program | Yes (program condition) | Details of the visit, after photo identification; escort and temporary badge expected | Not specified |
| HIPAA Security Rule 45 CFR 164.310(a)(2)(iii) |
Covered entities and business associates | No (addressable; procedures 'including visitor control') | Not specified | Not specified for visitor records |
| SOC 2 AICPA Trust Services Criteria |
Service organizations undergoing a SOC 2 audit | No (auditors test your own procedure) | Whatever your procedure says | Your stated policy |
| ISO/IEC 27001:2022 Annex A 7.2, Physical entry |
Organizations certified to ISO 27001 | No (entry controls required, log format not prescribed) | Not specified | Your stated policy |
| OSHA 29 CFR 1910.38(c)(4) |
Employers required to have an emergency action plan | No (plan must account for employees after evacuation) | Not specified | Not specified |
Free to reuse with a link to this page (CC BY 4.0).
What the table shows
- A common core of fields. Where a regime sets fields, it asks for the visitor's name, who they are with, when they arrived and left, and who authorized or hosted them.
- Retention is set by the strictest regime that applies. A utility with a card payment room answers to both NERC CIP and PCI DSS, so its log needs the longer of the two periods and the union of the fields.
- Frameworks without a rule still test the log. SOC 2 and ISO 27001 auditors check that your own visitor procedure was followed every day of the period, so gaps count against you even where no format is mandated.
Frequently asked
Which US regulations require a visitor log?
Of the 8 regimes in this table, 4 require a visitor log with set contents: PCI DSS for cardholder data areas, NERC CIP-006 for utility Physical Security Perimeters, state cannabis rules, and the CTPAT program for its members. HIPAA, SOC 2, ISO 27001 and OSHA do not require one, although a log is the usual way to evidence the controls they do require.
How long do visitor logs have to be kept?
It depends on the regime: at least 90 calendar days under NERC CIP-006, at least three months under PCI DSS, and four years under West Virginia's cannabis rules. Most other regimes set no period, so the retention you state in your own policy is what an auditor holds you to.
Does HIPAA require a visitor log?
No. 45 CFR 164.310(a)(2)(iii) is an addressable implementation specification that requires procedures to control and validate access 'including visitor control'. A visitor log is the common way to evidence that control, not a stated requirement.
What fields should a visitor log record?
Across the regimes that set fields, the common core is the visitor's name, their organization, the date and time in and out, and the person who authorized or is responsible for them. Cannabis rules add badge number, purpose, areas entered and a copy of government ID.
Where BeckonDesk fits
BeckonDesk records every visit with the visitor's name, company, host, time in and out and badge, screens them against sanctions lists at sign-in, and keeps the record for the retention period you set, so the log matches whichever regime applies to your site.
Related reading
See it on your own site.
A 30-minute walkthrough of sign-in, screening, and the record an auditor asks for. 30-day free trial, no credit card.