The scenario describes a failure in visitor management. The CMMC Assessment Team, as external personnel, are considered visitors. The receptionist did not check their credentials, did not provide visitor identification, and most critically, did not escort them or ensure they were monitored. This is a direct violation of practice PE.L1-3.10.3, which explicitly requires organizations to "Escort visitors and monitor visitor activity." This control is fundamental to physical security, ensuring that non-authorized individuals do not gain unsupervised access to facilities where Controlled Unclassified Information (CUI) may be present or accessible. The receptionist's actions created a security gap by allowing unescorted individuals into the facility.

B. This practice concerns the management of items like keys, locks, and electronic card readers, which were not mentioned as the point of failure in the scenario.

C. This practice relates to formal screening processes like background checks before granting individuals long-term, authorized access to systems, not the immediate handling of daily visitors.

D. This practice is about securing systems during personnel changes like employee terminations or transfers, which is irrelevant to the visitor check-in process described.

1. U.S. Department of Defense (DoD). (2021

December). CMMC Model v2.0.

Page 27

Practice PE.L1-3.10.3: The document lists the practice as "Escort visitors and monitor visitor activity." This is a direct match to the failure described.

Page 26

Practice PS.L2-3.9.1 & PS.L2-3.9.2: These practices are clearly defined under the Personnel Security domain

focusing on screening and personnel actions

respectively

distinguishing them from the physical visitor control issue.

2. National Institute of Standards and Technology (NIST). (2020

February). NIST Special Publication 800-171 Rev. 2: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.

Page 27

Section 3.10.3: This is the source requirement for the CMMC practice in question. It states

"Escort visitors and monitor visitor activity." The discussion section clarifies this is to control physical access by individuals without a need-to-know.

Page 27

Section 3.10.5: This requirement is detailed as "Control and manage physical access devices

" clearly separating it from visitor procedures.

Page 26

Section 3.9.1 & 3.9.2: These requirements detail personnel screening and termination/transfer actions

confirming they are distinct from the physical escorting of visitors.