Closing the CMMC Gap: Visitor Management for Defense Contractors
Status as of October 23, 2026: on July 13, 2026, DoD suspended CMMC Phase 2, which would have made third-party (C3PAO) certification a condition of award, along with later CMMC implementation milestones. Class Deviation 2026-O0025 directs contracting officers to remove or revise CMMC requirements; a solicitation may still require Level 1 (Self) or Level 2 (Self). Phase 1 self-assessment requirements, DFARS 252.204-7012, and the NIST SP 800-171 Rev. 2 baseline, including every requirement below, remain in force. Verify current status at dodcio.defense.gov.
How visitor management evidence maps to the CMMC Level 2 Physical Protection requirements, where it only supports them, and why five of the six cannot wait for a POA&M.
Five of Six Cannot Wait for a POA&M
CMMC Level 2 assesses the 110 security requirements of NIST SP 800-171 Rev. 2 for contractors that handle Controlled Unclassified Information (CUI). Six of them, the Physical Protection (PE) family, govern facility access, visitor escorts, and the logs of who came and went.
Five of the six cannot be placed on a Plan of Action & Milestones (POA&M). The CMMC rule (32 CFR 170.21) allows a Level 2 POA&M only with a score of at least 80 percent and only for requirements worth one point (one encryption requirement excepted), and it excludes the escort, physical-access-log and access-device requirements by name. Visitor management has to meet them when the assessment is scored, whether that is a self-assessment today or a C3PAO assessment if Phase 2 is reinstated.
Requirements a POA&M Cannot Hold
PE.L2-3.10.3 (Escort Visitors), PE.L2-3.10.4 (Audit Logs), and PE.L2-3.10.5 (Access Devices) are excluded by name; PE.L2-3.10.1 and PE.L2-3.10.2 are five-point requirements. Each has to be met when the assessment is scored. Only PE.L2-3.10.6, alternate work sites, can be closed out afterwards.
Physical Protection in CMMC Level 2
CMMC Level 2 aligns with NIST SP 800-171, Revision 2. Its requirements apply to contractors handling Controlled Unclassified Information (CUI) across 14 families.
The Physical Protection family holds six requirements that govern who may enter, how visitors are escorted, and how physical access is logged. Each is quoted below as NIST states it.
Limit Physical Access
Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.
Protect and Monitor the Physical Facility
Protect and monitor the physical facility and support infrastructure for organizational systems.
Escort Visitors
Escort visitors and monitor visitor activity.
Maintain Audit Logs
Maintain audit logs of physical access.
Control Physical Access Devices
Control and manage physical access devices.
Enforce Safeguarding at Alternate Sites
Enforce safeguarding measures for CUI at alternate work sites.
Why Traditional VMS Solutions Fall Short
Most of the visitor management market is built for corporate offices, co-working spaces, and commercial real estate. Those environments have very different security requirements than CUI-handling facilities. Vendors in this space typically optimize for visitor experience, not for the kind of evidence a CMMC assessor expects to see.
Hospitality-first VMS products excel at lobby check-ins, tablet UX, and notifications. That is a real product strength, not a critique. The point is that design goals matter, and a product whose design goal is visitor experience is unlikely to also satisfy the evidence-driven obligations in the PE family of NIST 800-171 without significant gaps.
The Critical Gaps
ITAR/EAR Screening
Generic VMS platforms typically do not capture citizenship or foreign-person status against ITAR. Without that data, a foreign national who reaches controlled technical data can create deemed-export exposure under 22 CFR § 120.50, even if the front desk had no way to know.
Restricted-Party Screening
Ask any visitor platform you evaluate whether it screens visitors against the OFAC SDN List and the export-control lists, and whether it keeps the record of what matched, who reviewed it, and why the visitor was admitted. A screen with no decision record leaves nothing to show an assessor.
Escort Enforcement
Many systems treat the escort as an optional field. PE.L2-3.10.3 is assessed on whether visitors are escorted and their activity monitored. If a visitor your policy says must be escorted can be checked in without one, the record cannot show that they were.
Audit Log Integrity
Many platforms let administrators edit or delete visit records. PE.L2-3.10.4 asks that physical-access logs be maintained, and NIST SP 800-171 3.3.8 asks, among other things, that audit information be protected from unauthorized modification and deletion. A log an administrator can quietly rewrite is weak evidence of either.
Badge Lifecycle
Printing a visitor badge is not the same as managing one. PE.L2-3.10.5 asks that physical access devices be controlled and managed; for visitor badges that means knowing which were issued and which came back.
Multi-Site Consistency
Where several facilities handle CUI, each is held to the same requirements. Per-location configuration with no shared baseline makes it hard to show that the same visitor rules ran at every site.
Commercial VMS platforms optimize for visitor experience. Defense contractors need systems that optimize for compliance evidence. These are fundamentally different design goals, and bolting compliance features onto a hospitality platform creates gaps that assessors are trained to find.
How SecurePoint USA Maps to CMMC Level 2
Control-by-control mapping showing where SecurePoint produces direct evidence, where it only supports, and where it claims nothing, for each Physical Protection requirement.
| CMMC Control | Requirement | SecurePoint USA | POA&M |
|---|---|---|---|
| PE.L2-3.10.1Limit Physical AccessSupporting | Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals. | Supporting. Pre-registration approval, host authorization and ID capture establish who is authorized, and badge issuance is gated on the evidence the site requires. SecurePoint authorizes the person; your facility enforces the physical boundary. | NoFive-point requirement |
| PE.L2-3.10.2Protect and Monitor the Physical FacilityDeployment-dependent | Protect and monitor the physical facility and support infrastructure for organizational systems. | Deployment-dependent. SecurePoint shows who is on site and for how long, and flags overdue check-outs. It does not monitor the facility itself: there is no CCTV or access-control-system integration and no location tracking. Facility monitoring remains yours. | NoFive-point requirement |
| PE.L2-3.10.3Escort VisitorsDirect evidence | Escort visitors and monitor visitor activity. | Direct. Escort assignment is recorded against the visit, escort start and end are captured as events, and where a site requires an escort the badge is gated on it. The escort record exports with the rest of the visit evidence. | NoExcluded by name, § 170.21(a)(2)(iii) |
| PE.L2-3.10.4Maintain Audit LogsDirect evidence | Maintain audit logs of physical access. | Direct. Append-only audit trail: update and delete are refused by the database rather than discouraged in the application, and each row is hash-chained to the previous one per organization. Exportable for assessor review. | NoExcluded by name, § 170.21(a)(2)(iii) |
| PE.L2-3.10.5Control Physical Access DevicesSupporting | Control and manage physical access devices. | Supporting. Badge issuance and badge return are recorded against the visit and export with it, so an unreturned badge is visible rather than assumed. The physical badge stock, and any electronic credential system, remain under your control. | NoExcluded by name, § 170.21(a)(2)(iii) |
| PE.L2-3.10.6Enforce Safeguarding at Alternate SitesNot claimed | Enforce safeguarding measures for CUI at alternate work sites. | Not claimed. This control concerns safeguarding CUI at alternate work sites. SecurePoint supports per-site configuration and multi-site visibility for the facilities it runs in, which is not the same thing. We do not claim this control. | EligibleOne-point requirement |
What SecurePoint Records for Each Visit
Foreign-Person Status at Export-Controlled Sites
The International Traffic in Arms Regulations (ITAR) and Export Administration Regulations (EAR) impose controls on who can access defense-related technical data. Releasing controlled technical data to a foreign person in the United States is a “deemed export” under 22 CFR § 120.50, with significant civil and criminal exposure. CMMC does not assess export controls, but many CUI facilities answer to both.
At an ITAR-ready site, every visit asks the visitor to attest to U.S.-person status before a badge is issued. A visitor not confirmed a U.S. person needs an escort, and a § 126.1 national, a visitor whose country cannot be resolved, or one whose attestation conflicts with their citizenship is held for compliance review. SecurePoint records the attestation and the reviewer's decision. Whether a license or exemption covers the access stays with your export control officer.
Restricted-Party Screening
Every visitor is automatically screened against the OFAC Specially Designated Nationals and Blocked Persons (SDN) List, the BIS Entity List, and the Denied Persons List, among other sources. A visitor is screened at pre-registration. At check-in, an approval is reused only while its screening is still inside the re-screening interval your organization sets and ran on the same name. Otherwise kiosk and guided check-ins screen again, QR check-ins move to the kiosk flow, and one-click desk and API check-ins refuse and send the visitor to one that screens.
A possible match holds the visit and alerts your compliance managers: no badge is issued until a reviewer decides.
Escort Enforcement
SecurePoint USA does not treat escort assignment as a data field. When a site or visit requires an escort, it is a check-in condition:
- 1A front-desk check-in stops until an escort is assigned, by name or from your host directory
- 2At a self-service kiosk, the visit is held for host verification, where the host attests to escort custody for a foreign national
- 3Escort events (assigned, acknowledged, started, ended, and exceptions) are recorded with timestamps
An org admin or compliance manager can override a missing escort, and the override is written to the audit log with who made it. That produces the escort record PE.L2-3.10.3 is assessed against. The practice is assessed against your organization, not against a vendor.
Hash-Chained Audit Trails
Every action in SecurePoint USA generates an append-only, cryptographically hashed log entry. Application users cannot edit or delete entries, and a verifier checks the hash chain for breaks. That is the physical-access log PE.L2-3.10.4 is assessed against, protected against modification and deletion as NIST SP 800-171 3.3.8 asks of audit information.
The audit log exports as CSV or PDF, filtered by date range and actor. The CMMC physical-access evidence pack adds a per-visit register (arrival, departure, host, and escort) with the raw visitor, escort, badge, and zone logs behind it, and lists a SHA-256 checksum for every file.
Built for Defense Contractors
Procurement identifiers and SAM.gov evidence are provided during sales/procurement review after the evidence capture checklist is complete. SecurePoint USA does not represent GSA Schedule, FedRAMP authorization, SOC 2, ISO, CMMC certification, or endorsement by any government.
What Is at Stake
Three kinds of exposure meet at a defense contractor's front desk: eligibility for contracts that require a CMMC status, False Claims Act liability for compliance that was represented but not in place, and, at export-controlled sites, ITAR penalties for releasing technical data without authorization.
Contract Eligibility
A contractor without the CMMC status a solicitation requires is ineligible for that award (DFARS 252.204-7025), and an option cannot be exercised without it (DFARS subpart 204.75). In an assessment, a Physical Protection requirement other than PE.L2-3.10.6 that is still NOT MET when the assessment closes rules out Conditional status, so the gap has to be fixed and assessed again.
That is ineligibility, not debarment. Debarment is a separate, government-wide decision under FAR subpart 9.4, and ITAR debarment (22 CFR 127.7) bars participation in defense trade.
False Claims Act Exposure
The enforcement risk that has produced settlements is misrepresentation. Under the Department of Justice's Civil Cyber-Fraud Initiative, contractors have settled False Claims Act allegations that they billed DoD while NIST SP 800-171 requirements were not met or their SPRS score was overstated: MORSECORP ($4.6 million, March 2025), Raytheon and Nightwing ($8.4 million, May 2025), Georgia Tech Research Corporation ($875,000, September 2025), LOGZONE ($507,144, June 2026), and Honeywell Aerospace ($2.04 million, September 2026). These are settlements of allegations, not findings of liability. A self-assessment score needs evidence behind it, and physical-access records are part of that evidence.
ITAR Violations
Where visitors can reach ITAR-controlled technical data, the civil maximum is the greater of $1,271,078 or twice the value of the transaction, per violation (22 CFR 127.10, as adjusted in January 2025; there was no 2026 adjustment). Civil liability does not depend on intent, and several visitors over several days can be several violations. Criminal penalties, up to $1,000,000 and 20 years in prison per violation, apply to willful violations.
What This Means for the Front Desk
The visitor record carries more weight than its cost suggests. It is evidence behind a self-assessment score and an annual affirmation, and, at an export-controlled site, the first place anyone looks to answer who reached technical data.
Have the Evidence Before It Is Requested
Whether the next review is a self-assessment, a DIBCAC assessment, or a C3PAO assessment if Phase 2 is reinstated, the Physical Protection requirements are the same, and five of the six cannot wait for a POA&M.
SecurePoint USA records the screening, escort, and physical-access evidence described here for the requirements it supports, and says plainly where your own controls take over.
Frequently asked questions
Does SecurePoint make our organization CMMC compliant?
No. CMMC compliance is a program your organization runs and an assessment it passes. SecurePoint is one internal control inside that program: it screens visitors, records host and escort assignment, gates badge issuance, and produces the physical-access records an assessor can review. The obligation stays with your organization.
Which CMMC Level 2 controls does visitor management touch?
The Physical Protection family runs PE.L2-3.10.1 through PE.L2-3.10.6. Visitor management does not touch them equally. SecurePoint produces direct evidence for 3.10.3 (escort visitors and monitor visitor activity) and 3.10.4 (maintain audit logs of physical access). It supports 3.10.1 and 3.10.5 without being sufficient for them on its own, contributes only partially to 3.10.2, and does not address 3.10.6, which concerns alternate work sites. Confirm your assessment scope with your C3PAO.
Which Physical Protection requirements can go on a POA&M?
Only PE.L2-3.10.6. Under 32 CFR 170.21, a Level 2 POA&M is allowed only with a score of at least 80 percent and only for requirements worth one point (one encryption requirement excepted), and the rule excludes PE.L2-3.10.3, 3.10.4 and 3.10.5 by name. PE.L2-3.10.1 and 3.10.2 are worth five points each. The visitor-facing requirements have to be met when the assessment is scored, not closed out afterwards.
Is a paper sign-in sheet enough for the physical protection controls?
A sign-in sheet records that someone signed in. The PE controls also ask you to show that visitors were escorted and monitored, that access devices were controlled, and that a durable audit log of physical access exists. What satisfies your assessor depends on your scope, so confirm it with your C3PAO rather than assuming any single artifact is sufficient.
What visitor evidence can we hand to an assessor?
Evidence packs bundle visit activity, screening results, adjudication decisions, and the audit trail into a single export with SHA-256 checksums, scoped to the date range and sites you select. The audit trail itself is append-only, with update and delete refused at the database.
Is sanctions screening part of CMMC?
No. The CMMC Physical Protection controls are about who may enter, who escorts them, and what is logged. Restricted-party screening is how organizations manage separate obligations under OFAC and export-control rules, which prohibit dealings with listed parties rather than prescribe a screen. Many defense facilities run both, which is why SecurePoint records them against the same visit, but they answer to different regimes.
Sources and revision history
First published March 2026. Last reviewed against the sources below and against SecurePoint's product as it stood that day. The sources are listed for traceability, not as endorsements; confirm current text with the issuing agency before relying on a citation.
- [1]NIST SP 800-171, Revision 2: Protecting CUI in Nonfederal Systems and Organizations
Requirement text quoted for PE 3.10.1 through 3.10.6 and AU 3.3.8. NIST marked Revision 2 withdrawn on May 14, 2024, in favor of Revision 3; DoD still requires Revision 2 for DFARS 252.204-7012 and CMMC.
- [2]NIST SP 800-171A: Assessing Security Requirements for CUI
Assessment objectives for each requirement, used for what an assessor looks for.
- [3]32 CFR Part 170: Cybersecurity Maturity Model Certification (CMMC) Program
§ 170.21(a)(2) sets Level 2 POA&M eligibility and excludes PE.L2-3.10.3, 3.10.4, and 3.10.5 by name; § 170.24 sets point values, with PE.L2-3.10.1 and 3.10.2 at five points.
- [4]Department of War: "DoW Suspends CMMC Phase II Requirements" (July 13, 2026)
Source for the Phase 2 suspension and for Phase 1 self-assessment requirements remaining in force.
- [5]DPCAP: Class Deviation 2026-O0025 (FAR overhaul Part 40 / DFARS Part 240)
Revision 3 (September 3, 2026) directs contracting officers to remove or revise CMMC requirements; Level 1 (Self) and Level 2 (Self) may still be required.
- [6]DFARS 252.204-7012: Safeguarding Covered Defense Information and Cyber Incident Reporting
Contract clause flowing the NIST SP 800-171 obligation to contractors handling covered defense information.
- [7]DFARS 252.204-7025: Notice of CMMC Level Requirements
Award and option eligibility where a solicitation requires a CMMC status.
- [8]22 CFR § 127.10: Civil penalty
ITAR civil maximum: the greater of $1,271,078 or twice the value of the transaction, as adjusted in January 2025. OMB Memorandum M-26-11 cancelled the 2026 inflation adjustments.
- [9]22 U.S.C. 2778(c): Criminal violations
Criminal penalties for willful violations: up to $1,000,000, up to 20 years in prison, or both, per violation.
- [10]DOJ: MORSECORP settlement (March 2025)
Civil Cyber-Fraud Initiative settlement over an overstated SPRS score.
- [11]DOJ: LOGZONE settlement (June 2026)
Civil Cyber-Fraud Initiative settlement after DCMA assessments found NIST SP 800-171 requirements unmet.
- [12]DOJ: Honeywell Aerospace settlement (September 2026)
Civil Cyber-Fraud Initiative settlement over NIST SP 800-171 requirements on a DoD contract. The other settlements cited are announced on the same site.
- [13]DoD CIO: Cybersecurity Maturity Model Certification
Current CMMC program status.
Revision history
Updated for the July 13, 2026 suspension of CMMC Phase 2 and Class Deviation 2026-O0025. Corrected POA&M eligibility: five of the six Physical Protection requirements cannot be placed on a POA&M, not three. Quoted each requirement as NIST states it, replaced an outdated ITAR civil penalty figure, distinguished award ineligibility from debarment, added False Claims Act settlements, and narrowed product statements to what SecurePoint records.
Corrected the escort, export-screening and audit-log statements against the product and DDTC records.
Stated what the audit log guarantees: append-only and hash-chained, with the maintenance functions that lift its protection named.
Mapped each Physical Protection requirement to the evidence SecurePoint produces: direct, supporting, deployment-dependent, or not claimed.
Informational only. This whitepaper is provided for general informational purposes only and does not constitute legal, regulatory, export-control, or compliance advice. It is not a substitute for review by qualified counsel, a C3PAO, your Facility Security Officer (FSO), an export-control officer, or other advisor familiar with your specific contracts and facilities.
Regulatory citations and statistics reflect publicly available information believed to be accurate as of the review date shown on this page and in the PDF. Regulations and enforcement priorities change; verify current text with primary sources before acting on anything in this document. © 2026 SecurePoint USA LLC. All rights reserved.