A visitor log is used to record physical access to which locations?

• A. The facility as well as computer rooms and data centers where cardholder data is stored or transmitted.
• B. Only the main entrance.
• C. Only the outdoor parking areas.
• D. Only the data center elevators.

Answer: (A)

Recording who enters the building and the sensitive spaces inside is essential for protecting cardholder data. A visitor log should cover both the facility as a whole and the restricted areas where cardholder data is stored or transmitted, such as computer rooms and data centers. This provides accountability—knowing who came in, when, and for what purpose—so you can detect unauthorized access and trace any incidents back to an individual.

Focusing only on the main entrance would miss entries into restricted zones; logging just outdoor parking or only data center elevators would leave gaps in visibility. The best practice is to maintain a visitor log that captures access to the entire facility and to the specific areas that house or process cardholder data.