New Blog Post · 5-minute read
They had firewalls. They had encrypted servers. They did not have a visitor record they could hand an assessor.
Picture a machine shop. Call it "Precision Aero"; it is not a real company, and this is a scenario built from the assessment requirements rather than from any customer of ours. Its CEO thought they were ready. They had the firewalls. They had the encrypted servers. They even had a shiny new tablet at the front desk where visitors typed in their names.
Then the auditor arrived.
He didn't ask for the server logs first. He walked to the front desk, pointed at the "Visitor Management" app, and asked one question:
"How do you verify that the 'John Smith' who signed in ten minutes ago isn't on the Consolidated Screening List?"
The Office Manager shrugged. "We check IDs."
The auditor smiled, the kind of smile that costs money. "Show me the time-stamped proof of that check against the federal database for every visitor in the last six months."
Silence.
Most managers don't realize that in 2026, CMMC Level 2 and ITAR aren't about doing the work; they are about proving the work.
If your Visitor Management System (VMS) does not check visitors against the International Trade Administration’s Consolidated Screening List and keep the result in an append-only audit log, you have nothing to show when someone asks.
A manual sign-in sheet produces no record of a screening decision, because no screening happened. With no "Audit-Ready Evidence" to hand over, the finding lands on the contract.
In SecurePoint USA demos, we meet managers who think a digital log is a "secure" log.
A paper log is a data breach waiting to happen. Anyone can read who was there before them: competitors, foreign agents, or just curious eyes. It leaves no digital trace of who approved whom.
If a visitor can delete their entry, or if you can’t prove who approved a foreign national's entry, you have a "Single Point of Failure." Consumer-grade apps don't meet the evidence bar a regulated facility needs.
CMMC Level 2 requirements are no longer suggestions. Restricted Party Screening is a separate export-control practice, and if your front desk system cannot screen visitors at the point of entry, you are carrying that risk yourself.
Remediation after a finding means legal review and emergency consulting, on a schedule set by someone else, to close a gap that a visitor system records as a matter of course.
Is your front desk a gateway or a trap?
Or get it sent to your inbox
Occasional notes on sanctions, export controls, and visitor compliance when we publish them.
Get occasional notes on sanctions, export controls, and visitor compliance when we publish them.
No spam. Unsubscribe anytime.
Related posts
More guidance on sanctions, export controls, and visitor management for regulated facilities.
As the United States celebrates its 250th anniversary, the battle to protect U.S. sovereignty has shifted from factory floors to digital and physical perimeters. Here is why securing the supply chain is the modern patriotic duty.
CMMC Level 2 and DFARS 252.204-7012 require defense contractors to limit, escort, and log physical visitor access to CUI areas. Here's exactly what the visitor-log requirement covers (NIST SP 800-171 controls 3.10.1, 3.10.3, and 3.10.4) and what assessment-ready evidence looks like.
A possible U.S.-Iran framework involving the Strait of Hormuz, sanctions waivers, and nuclear talks shows why defense contractors need real-time screening, human review, and audit-ready visitor and vendor logs.
