Many organizations today invest extensively in security measures that range from fences and concrete barriers to camera surveillance, alarms and access control systems. As I’ve learned by conducting hundreds of physical and technical security assessments over the years, implementing these isn’t a fail-safe strategy. An individual can often circumvent these easily and threaten the safety company personnel, operations and property. Common techniques, for example, include following employees into restricted areas, re-using or copying visitor badges, or moving through the building or property unescorted.
One of the best and simplest mechanisms for evaluating the integrity of your visitor management controls – while also maintaining a welcoming environment – is to ask yourself, as a security leader or professional, six questions designed to “place you in the shoes” of a visitor.
1. Who is a visitor?
Think of a visitor as anyone not employed by the company. However, visitors vary in type and frequency, and should be defined through policies that address nuances such as different visitors’ privileges and access permissions. Visitor policies should also outline who has the authority to determine what areas a visitor may enter. For example, customers should not have the same access as a contractor providing maintenance or delivery personnel.
2. Where am I going?
Have you ever visited a company and were completely lost, or unsure where you are supposed to go? Often visitors wander into areas they shouldn’t be, simply because they have not been provided proper direction. Establishing a clear – preferably single – point of entry for visitors helps ensure proper management and to alleviate confusion.
Review your signage and where you have placed them. Consider an electronic display and, if needed, audible announcements or escorts who can provide clear direction to visitors. This also ensures visitors are funneled to a single point for screening purposes before being allowed into more critical areas.
3. When will I be there?
As a best practice, all visitors should be expected and scheduled, but we realize many legitimate visits can be unplanned or unexpected. Regardless, the reception staff should identify the individual, determine the nature of the visit and confirm the information with the expected employee or host. All visitors should be logged, preferably using a digital visitor management system so staff is aware of who is on the property and why.
Having a well-defined sign-in and sign-out process becomes important in the event of an emergency, such as a fire, in ensuring all personnel, including visitors, are evacuated safely. As an added layer of security, reception staff needs to ensure the visitor is properly identified. Inspecting governmental-issued ID and having the host provide authorization of the visitor will aid in preventing unauthorized access.
4. How will someone know who I am?
If employees and visitors are not required to wear any type of ID badges, it can be difficult to determine who is an employee and who is not authorized to be there. Requiring all employees and visitors to wear ID badges helps employees identify an individual not permitted on the property. All visitors should be required to wear badges at all times and return them upon departure. The type of visitor badge used is also important as you do not want a badge that’s easily reproduced for fraudulent purposes.
Many visitor management systems allow the ability to quickly take pictures of visitors in order to create a temporary visitor badge with an identifiable photo, which greatly increases security. Visitor badges should include the date, the company they represent, the primary employee responsible for them and the reason for the visit. In addition, visitors should always be escorted or under direct supervision of employees while on premises.
5. Where can I go?
As emphasized above, determining the areas a visitor can access is important and relates directly to the type of visitor. Depending on the size of the organization, visitor badges can be produced with easily identifiable indicators to represent what areas the individual is permitted to access. In some circumstances, background screening should be conducted before allowing non-employees into more critical or sensitive areas.
6. What do I do?
Proper policies and procedures are only effective when employees fully understand and strictly adhere to them. All employees should be trained regularly on visitor procedures. The security and safety of any company is a group effort and requires all personnel to be informed and committed to the same goal.
Employees should be aware of how to identify a person who does not have access to the property. In addition, staff should be empowered to challenge any individual they deem may be unauthorized, and follow a pre-determined notification process when a suspected unauthorized person has been identified.
We all want our visitors to feel welcomed and safe; however, we also need to ensure we protect what matters to us. By instituting a comprehensive visitor policy and procedure, we take positive steps forward in providing a safe and secure environment for our employees and our visitors.