Guides
Visitor and contractor management, in practice.
23 guides on what the regulations actually require, how to evaluate a system before you buy, and how to run sign-in, contractor compliance and evacuation roll call at the gate. Written for the people who own the process.
Choosing a system
For anyone evaluating visitor management, comparing vendors, or writing a requirements list.
-
Visitor management system requirements: the 18-point checklist
The 18 requirements to evaluate before buying, and the questions vendors hope you will not ask.
-
Evacuation roll call vs the paper visitor book
Why paper books fail in three predictable ways when the alarm sounds, and what marshals actually need at the muster point.
What the regulations require
The duties behind the visitor record: OSHA, OFAC, CFATS, FSMA, and what insurers ask at renewal.
-
Visitor log requirements: OSHA, CFATS, FSMA, and insurer expectations
What US regulations actually require for visitor logs at industrial and regulated facilities.
-
Employee accountability after evacuation: what OSHA 1910.38 requires
29 CFR 1910.38(c)(4) requires procedures to account for all employees. Why a printed roster fails it.
-
OFAC visitor screening: what facilities must do at check-in
What OFAC actually requires, how the SDN list works, and how to screen every arrival without slowing the queue.
Contractors at the gate
Insurance, inductions and competency, enforced at physical entry rather than in a spreadsheet.
-
Contractor proof of insurance: what to ask for and how to verify it
The five fields to check on every certificate, US and UK terminology differences, and how to verify a document is genuine.
-
Contractor insurance verification at the gate
How to make policy expiry the blocker at entry, without slowing the queue.
-
Contractor site induction: what to cover and when it expires
What an induction must cover, how long it stays valid, and the events that should trigger re-induction.
-
Contractor certificate of insurance: what to check before site entry
The endorsements that decide whether you are covered, and why a valid COI at signing proves nothing about today.
-
Why OSHA can cite you for your contractor's violation
The multi-employer citation policy, what reasonable care means, and the records that evidence it.
-
Contractor prequalification is not site access control
Networks qualify a company months ahead. They do not verify the person at your gate today.
-
Permits for outside contractors: hot work, confined space, and lockout
Three regimes that decide whether work may start, and why the permit belongs at the entry point.
Evacuation and roll call
Running the headcount: assembly points, drill procedure, and accounting for everyone on site.
-
Fire drill roll call procedure: step by step from alarm to all-clear
What to prepare before the alarm, the sequence from sweep to muster to count, and what to record for the fire log.
-
Accounting for everyone in a fire evacuation: what the Fire Safety Order requires
The UK duty is real but it is not what most vendors claim. What articles 9 and 15 ask for, and why Martyn’s Law is not yet your obligation.
-
Emergency assembly point setup: an 11-point checklist
Location criteria, signage, zoning for large sites, accessibility, and the link that turns a muster area into a roll call.
-
Emergency mustering best practices for employee accountability
Six practices that make the headcount work, reconciling employees, visitors and contractors into one count.
Records, retention and privacy
What you must keep, for how long, and the exposure in the book on the front desk.
-
How long do you have to keep visitor logs?
PCI DSS says three months, NERC CIP 90 days, state cannabis rules four years. What each regime actually requires.
-
The paper sign-in sheet is a privacy problem
Every visitor reads the personal data of everyone before them. Why that is a disclosure, repeated daily.
-
Does HIPAA require a visitor log?
No. What 45 CFR 164.310(a) actually says, and why Addressable is not the same as optional.
Audits and standards
What assessors test when visitor access comes up, framework by framework.
-
PCI DSS Requirement 9: visitor controls for offices and server rooms
The three fields the log must carry, the three-month retention, and how badges must behave.
-
NERC CIP-006 visitor control: the four fields your log must carry
The standard names the fields and the retention period. What that means at a Physical Security Perimeter.
-
SOC 2 and ISO 27001: what auditors test about visitor access
Neither prescribes fields. Both test whether the control actually ran all period. Consistency beats completeness.
-
Cannabis facility visitor logs: the strictest rules in the country
Badge numbers, ID photocopies retained with the log, areas visited, four-year retention.
Front desk and gatehouse operations
Running the process day to day, for the arrivals that are not office visitors.
See it on your own site.
A 30-minute walkthrough of sign-in, screening, and a live evacuation roll call. 30-day free trial, no credit card.