SOC 2 CC6.4 Visitor Log Checklist

The 12 points

• Every visitor is logged. No exceptions for "quick" visits or vendors.
• Identity is captured. Name, company, and who they are visiting.
• Purpose is recorded. Why they were on-site.
• Timestamps are automatic. Arrival, and ideally departure, captured by the system.
• A host is named. The employee responsible for the visitor is on record.
• Records are tamper-evident. Entries cannot be quietly edited or deleted.
• Logs are retained. Kept for your stated retention period and retrievable.
• Access is restricted. The log is not a public notebook; only authorized staff see it.
• Watchlist or deny capability. You can flag a name that should not be admitted.
• Evacuation roster. You can produce a real-time list of everyone on-site.
• Multi-site consistency. Every location follows the same process and reports together.
• Exportable evidence. You can hand the auditor a clean report on request.