The visitor log that turns a clipboard into evidence

Most small offices have a visitor log, and most visitor logs are theater: a sign-in sheet by the door that nobody reconciles, nobody retains on purpose, and nobody could produce on the day it actually matters. The day it matters is unglamorous — a laptop walks out of the office and the police report asks who was in the building that afternoon? An insurer asks for evidence of physical access controls. A customer's security questionnaire asks how visitors are handled. A clipboard with seven honest columns answers all three. This page is the template and the operating rules: what each column is for, who signs and who is exempt, the one acknowledgment line that does most of an NDA's job, and the reconciliation that keeps the log from rotting into decoration.

1. What the log is for — the two questions it must answer

• Question one: who was here, and who let them in? Every row needs a name and a host. "Visitors: 6" is not an answer to anything; "Dana Ortiz, Brightline Co, hosted by Sam, 13:04–14:20, badge #12 returned" is an answer. When something goes missing, the host is the first person who can say what their guest saw and where they went — that is why the host column is not optional.
• Question two: can you produce it, later, as evidence? A log lives in three rooms: the incident timeline (pair it with the incident response plan — visitors in the building are part of hour one), the insurance claim, and the compliance conversation about physical controls. It is only useful in all three if it is retained on purpose and reconciled on a schedule. The physical security checklist puts the log on the quarterly walk; this page is the log's own operating manual.
• What it is not for: security through guilt. A sign-in sheet does not stop anyone determined; it stops the casual walk-in and documents everyone else. Say this out loud to the team so nobody thinks the clipboard is the locked door. The locked door work is the badge and door access checklist; the log is its paper twin for the people the badges don't cover.

2. The seven columns that carry the whole weight

• Date and time in, time out. One date column and two time columns. The out-time is the one small offices skip, and it is the column an insurer asks about ("when did they leave?" is a question only answered by a row that was closed). Rule: nobody is still "in" overnight — the last person out closes any open rows from the day, initialing the out-time.
• Name, company or organization. Full name printed by the visitor themselves (you read handwriting better than they think), plus the company they claim. For the delivery driver and the vending-machine restocker, "Company: FedEx" is fine; for the auditor and the candidate, insist on a person, not a logo.
• Host. The employee expecting them. The test for "is this visit legitimate": if nobody will write their name in this column, the visit is not expected, and expected-ness is exactly what you are documenting. No host, no entry past reception — that is the whole rule.
• Badge or pass issued — and returned. If you issue visitor badges, the log records the badge number in and the same number out. A visitor badge that never came back is a key that walked out the door; treat it the way the badge checklist treats an employee badge that outlives its holder — deactivate the same day you notice.
• Signature and acknowledgment. The visitor signs one line that does three jobs at once (see section 4). Unsigned rows are decoration; if a visitor refuses to sign, that is a conversation the host gets to have, not a shrug.

3. Who signs, who is exempt, and the repeat-visitor problem

• Signs: clients, candidates, auditors, vendors' technicians, contractors' first day. Anyone entering beyond reception with a laptop, a toolbox, or a reason to be alone for five minutes. The contractor's everyday access is the contractor onboarding checklist's job (named accounts, expiry dates); the visitor log catches the humans those accounts don't describe — the contractor's colleague who carries the boxes.
• Exempt: letter carriers, food delivery left at the door, cleaning crews on a standing contract. But exempt does not mean invisible — write the standing rule down ("couriers hand off at reception; cleaning enters 18:30–20:00 under the facilities contract") so the exemption is a policy, not a memory. An exemption nobody can point to in writing is just an unlocked door with good PR.
• Repeat visitors get pre-logged, not un-logged. The client who comes every Tuesday still signs each visit — pre-print their rows for the month if the friction bothers them, but every row still gets a signature and an out-time. The visitor who signs four times and then stops signing is the one you needed to notice; a log with gaps tells you that only if the gaps are deliberate exceptions rather than Tuesday apathy.
• Interviews and sensitive visitors get the escort treatment. A candidate touring the office sees the nice parts and is escorted the whole way; an auditor sees everything and is escorted anyway, because the escort is not distrust — it is the person who answers "where's the bathroom" and "why is that door locked" so the visitor never needs to wander to find out.

4. The acknowledgment line that does most of an NDA's job

• The one-line version, on the sign-in sheet itself: "I agree not to disclose or make use of confidential information seen or heard on these premises, and to be accompanied by my host in non-public areas." One sentence, signed per visit, covers the 90% case: the client who glimpses a whiteboard, the candidate who sits next to the printer queue, the vendor tech who hears a roadmap discussion. It is not a substitute for a negotiated NDA — it is the floor that exists without one.
• When a real NDA is still needed: the three triggers. Long engagements with access to code or customer data, demos of unreleased product, and any meeting where a visitor's lawyers will eventually be involved (acquisition conversations, disputes, enterprise procurement). For those, the mutual NDA is signed before the visit and the log row references it ("NDA on file, dated"). The tabletop exercise is a good place to discover which of your recurring visits actually fell into trigger three.
• Keep the paper honest about what it collects. A sign-in sheet with names, companies, and times is personal data. Say so on the sheet: why you collect it (safety and building security), how long you keep it (see section 7), and who to contact about it. Two sentences at the bottom of the sheet, and the log survives the "wait, why do you keep a list of everyone who visits us?" question from a visitor's own compliance person.

5. Badges, escorts, and the guest wifi — the log's three supporting rules

• Visitor badges expire by the day. Color or date-stamp them so yesterday's badge is visibly dead; collect at the exit and drop in a bowl the host can see from their desk. The visitor badge is the same control as the employee badge with a shorter leash — the badge checklist owns the system, the log owns the daily ledger.
• The escort rule is one sentence: no visitor alone in non-public areas. Restrooms and the reception lobby excepted, everything else is accompanied. This is the rule that makes the log's host column true, because the host is physically with their guest for the whole visit. Break the sentence and the log becomes fiction — the row says "hosted by Sam" while the guest is alone in the ops room.
• Guest wifi is a credential, treat it like one. Visitors get the guest SSID — split from the office network per the wifi checklist — and the password changes when it leaks or when a quarter turns, whichever comes first. The log does not need the wifi password in it; it needs the rule that visitors never touch the office SSID, written somewhere the host reads it.

6. Paper or digital: pick by where the incident will happen

• Paper wins on adoption, loses on forensics. A clipboard gets 100% sign-in compliance because it is physically in the doorway; a tablet form gets 70%. But paper burns, walks, and cannot be searched. If your realistic incident is "something is missing, who was here Tuesday?", paper plus a weekly phone-photo of the sheet into a dated folder is the cheap hybrid that keeps both halves.
• Digital wins on retention and reconciliation. A shared form or a simple page in the ops wiki timestamps itself, survives the coffee spill, and lets the quarterly reconciliation be a filter instead of a flip-through. If you go digital, keep the doorway friction near zero: a tablet with a two-field form beats any system that makes the visitor wait.
• Either way, one canonical log. The failure mode is two half-logs (a clipboard and a form), each missing what the other caught. Choose one, retire the other with a sign by the door, and make the annual security review confirm which one is canonical.

7. Retention, reconciliation, and the after-theft timeline

• Retention: one year is the default; longer when a matter is open. A year covers the insurance claim window and the "when did that vendor visit?" memory horizon without becoming an archive of everyone who ever came to the office. Open legal or insurance matters keep their relevant pages until the matter closes — then they follow the same clock.
• Reconcile quarterly, fifteen minutes. Walk the last quarter's rows against reality: every row has an out-time (chase the open ones), every badge number came back (chase the missing), every host remembers the visit (the one nobody remembers is the row that gets a second look). This is the same reconciliation habit the badge checklist runs for employee badges — do both in the same fifteen minutes and neither gets skipped.
• The after-theft timeline is the log's moment. When a device or a document walks out, the log gives you the visitor list for the window in minutes, not from memory in days: names, hosts, times, who was alone. Feed it to the first hour of the data breach runbook and the police report. This is the moment the team stops seeing the clipboard as bureaucracy — and the moment you never get, if the log rotted.

A visitor log is seven columns and one sentence: name, company, host, time in, time out, badge issued and returned, signature — plus the acknowledgment line about confidentiality and escorts. Close every row nightly, exempt couriers in writing, escort everyone else, expire badges daily, keep it a year, and reconcile it quarterly next to the badge log. The Ops Starter Kit ($14) includes the fill-in-the-blank sign-in sheet and the quarterly reconciliation half-page, and the Automation Starter Pack ($19) schedules the nightly row-close nudge and the quarterly walk so the log stays evidence instead of becoming furniture.