Visitors to your facilities come in many shapes and sizes. They may be business guests, employee family members or potential new hires arriving for an interview. Delivery personnel can range from uniformed USPS or FedEx drivers to bicycle messengers; they can be carrying food that has been ordered for a meeting or by an employee for lunch; they can be surprising an employee with flowers or a singing telegram. Contractor tradesmen can be scheduled to work on an interior construction project, to repair a copier, to clean a carpet, to install a new phone or to implement a new network in a sensitive IT server room. Some of these visitors may be regulars, and others may be first-timers.
Regardless of their access needs, all visitors need to be processed quickly, efficiently, accurately and with a sense of welcome and friendliness.
Although employees and building staff with a permanent building or company credential usually represent the majority of people entering a facility, visitors require a different type of processing to keep security at an optimum level. That optimum level often depends on the security profile of the host facility; and the assets (physical or intellectual) to which the visitor will need access.
Some facilities may require visitors to be pre-screened for identity and be escorted while on the premises; others may accept the presentation of a business card or a driver’s license from an appropriately dressed individual. Most visitor management strategies will range somewhere between these extremes and it is important for the security director to determine the appropriate level of implementation.
Crafting a Visitor Management & Security Plan
In all cases, there are four major elements that should be considered for well-managed visitor control:
1. Verification of identity: Who is the person seeking access to the facility and can they prove that they are who they say they are?
2. Validation of the visit: Does the person have a valid reason to visit the facility? Do they have a scheduled meeting with a trusted person within the facility? Is their host expecting them or prepared to accept a delivery?
3. Screening for contraband: Do building or company policies require screening for weapons or explosives? After the Sept. 11 attacks, many commercial high-rise operations instituted the use of package x-ray and walkthrough magnetometers for employees and/or visitors.
4. Control of access from the building lobby to other areas within the facility. Is the visitor issued a badge? Can it be used at access control card readers? Are escorts required?
Before looking at different management strategies associated with each of these important security elements, there is some homework to be done and a myriad of questions to be answered. There are a number of options to consider, which need to be understood before addressing security solutions. Here is a checklist of the many considerations to make before implementing a visitor management plan:
Building Occupancy. Is the building owner-occupied or are there multiple tenants? How much input is required from other tenants? Do their operations have an impact on security? For example, many wealth management and legal services firms would prefer no access or video records of their clients; on the other hand, government contractors may require auditable transactions.
Security Level. What is the required security posture for this facility? Are security regulations mandated — for example, government entities and those subject to PCI compliance? To what level will the elements described above be implemented? Are corporate culture, security image and budgetary issues important, and to what extent? Will the level of security vary based on dynamic threat scenarios, for example a 9/11-type incident or a theft within the building?
Visitor Volume. How many visitors per day need to be processed? What is the worst case, and when (day and time) does it occur? How will this be impacted by peak volumes of regular employees entering or exiting the lobby? What is an acceptable queuing or wait time for the visitors?