Access Control and Visitor Management

Why it matters

Most security incidents involve someone being somewhere they should not be. Good access control limits that, and makes investigation easier when it fails.

Who it's for: Reception, security officers, HR and facilities teams.

Learning objectives — by the end you can:

Describe the three credential types: something you have, know, are.
Apply least-privilege when assigning access zones.
Run a visitor and contractor process from booking to sign-out.
Perform a periodic access review and remove leavers.

Key terms

Least privilege: Give only the access needed for the role, for the time needed.
Tailgating: Following an authorised person through a controlled door without presenting a credential.
Anti-passback: A rule preventing a card being used to enter twice without exiting.
Access review: A scheduled check that each person's access still matches their role.

Lesson notes

Zoning a site

Zone	Example	Typical control
Public	Reception lobby	Staffed desk, CCTV
Staff	Offices	Card reader
Restricted	Server room, stores	Card + PIN, access log review
Critical	Control room	Card + biometric, two-person rule

Visitor and contractor process

1Host pre-registers the visitor with date, purpose and areas.
2Reception verifies identity and issues a visible, dated badge.
3Safety briefing for site visitors/contractors where required.
4Escort in restricted areas; badge returned at sign-out.
5Unreturned badges are deactivated and followed up the same day.

Access reviews

At least quarterly, managers confirm their team's access. HR leaver feeds should trigger same-day deactivation. Biometric data, where used, needs a clear privacy basis, secure storage and deletion on exit.

Video lesson

Video to be added

A verified video from an official or reputable channel has not yet been selected for this topic. The text lesson above covers the full content.

Search YouTube for related videos

Practical story: The badge that outlived the job

Fictional teaching example

Situation. A former contractor's card was used to enter a store room three weeks after their contract ended.

Known facts

The contractor list was managed on a spreadsheet by the project team.
No one notified security when the contract ended.
The access log showed the entry but no alarm was configured for inactive users.

Decisions

Contractor cards now expire automatically on the contract end date.
Monthly access review introduced for restricted zones.

Outcome. Stock was recovered; the review found 41 other cards that should have been disabled.

Lessons

Set expiry dates at issue.
Access reviews find hidden risk.
Process gaps between teams are vulnerabilities.

Worked example

Worked example: quarterly access review

Person	Role	Zones held	Needed?	Action
A. Rao	Accounts	Staff, Stores	Staff only	Remove Stores
B. Singh	IT engineer	Staff, Server	Yes	Keep
C. Contractor	Painter (ended)	Staff	No	Deactivate

Practice exercise

Draft a five-step visitor process for a small office with one receptionist.

List the steps from booking to sign-out, including what happens to unreturned badges.

Quiz

References

Official guidanceCPNI/NPSA — Access control guidance
Official guidanceCISA — Physical security

Verify current editions and applicability. Standards are copyrighted; consult licensed copies for exact requirements.

Report an issue with this content