Implementing a visitor management system for ISO 27001 certification – how a digital visitor management system can support the process

Organisations working towards ISO/IEC 27001 certification not only need to have processes and procedures in place – they must also be able to show objective evidence that these processes and procedures are followed in practice. Certification efforts often fail because of insufficient documentation and traceability. That is why it is important to understand why introducing a digital visitor management system matters for ISO 27001 certification, and which requirements such a system can support. ISO 27001 is the standard for information security management systems. It covers digital assets and can include physical controls.

• Physical security: During an audit, the organisation needs to be able to show, based on its risk assessment, that it has documented procedures for visitor management and access control, and that it follows them. CavVisit can support this by handling both pre-booked and drop-in visitors and documenting the relevant steps in the process. With CavVisit, pre-booked visitors can read and confirm the visitor rules in advance, and drop-in visitors can confirm the applicable visitor rules on site, providing traceability that the rules have been communicated and accepted.
• Traceability: CavVisit can contribute to traceability through searchable logs and reports for a date range and per site, taking the company’s GDPR policy into account. CavVisit comes with an advanced report generator in which each customer can build their own reports, and the system also includes several standard reports that meet most of the requirements placed on a modern visitor management system – see the visitor management system’s functions.
• Evacuation: In an evacuation, you can generate an evacuation list and use CavVisit’s extended evacuation module to track and see the status of checked-in visitors in real time – see our automatic evacuation system.
• Incident management: In the event of an incident, a digital visitor management system can facilitate and speed up the investigation through logs and reports. CavVisit also offers extended logging that can support the organisation’s requirements for logging, traceability and incident investigation under ISO/IEC 27001 and other regulations, such as NIS2.
• Data protection and compliance: An organisation’s information security is defined by three properties, which must be ensured in its information security management system (ISMS): confidentiality, integrity and availability.
  1. Confidentiality means that only authorised people should have access to data in CavVisit. CavVisit uses encryption, MFA and role-based access, among other measures, to ensure confidentiality.
  2. Integrity means that information is correct and protected against unauthorised or accidental changes. Through access management, the system knows that the right users have access to the right data. All changes are also logged in the system, so that traceability requirements can be met.
  3. Availability, the final aspect, can be achieved in different ways. CavVisit meets it through a range of technical and organisational measures, such as operating and recovery procedures, backups and continuity planning. These are part of our ISMS.

Compliance with data protection requirements is just as important: a digital visitor management system should support the GDPR, while the system supplier must follow the requirements and laws that apply to information security – and be able to prove it. CavVisit offers extended GDPR support.