SMB1001 · Control 17 · Silver
SMB1001 wants a visitor register. A notebook will do.
One of the more surprising requirements in Australia's small-business cyber standard has nothing to do with computers, and the compliant answer costs about four dollars.
· 4 min read
People are often thrown by this one. You are working through a cyber security standard, ticking off multi-factor authentication and patching, and then you hit a control asking you to keep a record of who walks through your front door.
What the control actually says
SMB1001 asks organisations from the Silver tier upward to implement a visitor register, and to keep that register for no less than six months. That is the whole requirement. It does not specify a technology, a format or a supplier.
Why a cyber standard cares about your front door
Because a great many breaches begin with physical access. Someone walks in behind a staff member, plugs into a network port or an unattended machine, photographs a whiteboard, or simply picks up a laptop. A visitor register does not prevent any of that on its own, but it creates a record, and a record is what turns “we think someone was here” into something you can actually investigate.
It also has a quieter benefit. Knowing there is a book at reception changes behaviour, both for visitors and for the staff who are supposed to escort them.
The simple way to comply
A bound notebook at reception. Name, organisation, who they are visiting, time in, time out. Kept for six months. That is compliant. It is not a lesser form of compliance or a temporary measure; it satisfies the control as written.
Two details matter more than the format. First, it needs to be used: a book nobody fills in is worse than no book, because it looks like a control while providing nothing. Second, a bound book with numbered pages is better than loose sheets, because pages cannot quietly disappear.
One privacy caveat. A paper register sitting open on a counter shows every previous visitor's name and business to whoever signs in next. If your visitors would rather not be seen (a lawyer's office, a medical practice, an HR consultancy), that is a genuine reason to move to something where entries are not on display.
When it is worth upgrading
An access control system logs every entry automatically, which removes the “nobody filled it in” problem entirely and solves the privacy issue above. Sign-in tablets and badge or fob systems both do this, at very different price points. If you already have electronic access control on your doors, you may find you are compliant already and simply need to confirm the logs are retained for six months.
The upgrade is worth considering when you have regular visitor traffic, when reception is not always staffed, when contractors come and go, or when your visitors are confidential. It is not worth it for a two-person office where the door is locked and visitors are rare.
What an assessor will ask for
Not much. Show the register, show that it has entries in it going back six months, and be able to say who is responsible for it. If it is electronic, show the retention setting. Being able to say who owns this matters more than the sophistication of the tool.
Written by Steven Usher, Director of Owls Nest Solutions. Nothing here is legal advice, and none of it is a pitch. If the cheap option fits, take the cheap option.
Keep reading