While onsite conducting a CMMC Level 2 assessment at a small architecture firm that handles...

Visitor access control (PE.L2-3.10.3 and PE.L2-3.10.4) typically involves procedures at entry points. The front-desk receptionist is the staff member most directly involved in logging, controlling, and monitoring visitor access. While system admins and partners handle IT and business operations, they do not control physical visitor access day-to-day.

Exact extracts:

“Assessment Method – Interview: personnel responsible for visitor access control (e.g., reception staff, security desk staff).”

“Assessment Objectives … Determine if visitor access is identified, logged, escorted, and monitored.”

Why the other options are incorrect:

A: System admins focus on IT, not visitor management.

C: Administrative assistants generally perform clerical tasks, not visitor logging.

D: Senior partners may approve contracts but are not directly responsible for visitor control.