Many of us have heard of an Access Control Policy, but what is it, and why should I give it some thought and time? Where do we start and what will it effect? Your Access Control Policy includes your employees and fellow team members. It also includes visitors, vendors and contractors. It dictates which doors each group has access to and for what duration. It also covers which doors need to be automatically unlocked each day.
For most organizations’, the leadership team needs 24/7, 365 access to the facility. This means during holidays and other days which the organization is closed these individuals will continue to have access to the facility. Even though common access points which may be unlocked during normal business hours will be closed, their card access will allow them in and throughout the facility.
Besides the leadership team there are others within the organization which may need 24/7, 365 access. This may include IT, Security, Facilities and Building Operations. Anyone which may need to come in at any time throughout each day, including Holidays.
Sometimes the first instinct is to limit access as much as possible. While this is generally the ideal, it is just as important to identify the needs for key individuals and departments. Who needs access to what and when? Do some team members stay late or come in on the weekend? You do not want to limit access to those individuals wanting to contribute. It is very frustrating for the employee driving in to work on the weekend and finding out they do not have access to the building. Will they attempt that again? This can be fixed by expanding their access but there will be that lingering doubt.
Identify additional employee groups which will need to get in 24/7, 365. It is also good to remember that each scan at the door is recorded within a secure database. This means there is an audit log for each scan. Even if someone did come in on the weekend and something went missing you will be able to identify which individuals were onsite. If there was tailgating going on, the video management system will also help determine which employees were onsite.
Next, now you need to determine which employees do not need 24/7 access. What access do they need? Do I put together the list by department? There are VPs, Directors, Managers and Supervisors along with the standard working employees all within a single department. Is it easier to separate by role within the organization? For the most part, yes. In most instances’ managers, directors, VPs and the rest of the executive level team members require 24/7 access. What are the general working hours of the standard employee? What is the start time and end time? Are there more than one schedule or shift? A good rule of thumb is to pad the beginning schedule by a half hour to hour in the morning. This is to allow employees liking to get in early. Some employees may need to be dropped off or take public transportation. Allowing them to come in a little earlier enables them to be ready for their work day. This helps prevent them from coming in at the last minute and then starting work 10 – 15 minutes late each day.
On the tail end of the work shift, generally employees do not need to leave and then come back in the office. They leave when their shift is over. Those organizations in colder climates, or neighborhoods with many incidents should consider allowing employees back in for safety and security reasons.
Weekend Work; do standard employees need to come in to work on Saturday, what about Sunday? Is this a weekly event or does it just happen once in a while or during the busy season? Will a supervisor be onsite to let the employees in? With the vIDix Control Administrator App a supervisor can make decisions on the fly and set an immediate Unlock Schedule to accommodate weekend, or a once in a while event.
One of the benefits of an electronic access control system is being able to adjust schedules quickly and efficiently. This does not mean that the administrator should be taking time to be adjusting access schedules and door groups each week. Setting up some time up front to think through your access control system will eliminate or reduce the administrative cycles after the fact.
Now that I have setup everyone’s schedule, which doors should they have access to and how should these be grouped? Door Groups as they are known, are the logical grouping of like doors. For smaller organizations it is relatively painless to click on 10 or so individual doors when adding a new cardholder to the system. With organizations with 50 or more doors, multiple buildings as well as locations then becomes quite a painful and time-consuming task. It is a lot easier for the administrator to click on three to five Door Groups than clicking on 50 plus individual doors. Creating logical Door Groups provides an opportunity for an organization to think through access to their facility or facilities, as well as which areas within the facility different employee types have access to.
Generally, doors can be grouped into three standard groups, perimeter doors, common interior doors as well as individual department needs or specialty doors. How many perimeter doors are there, do employees need access to each of these or are they required to enter through an employee entrance? Do they need access to the dock entrance door because they may need to pick up or drop off a piece of equipment? Again, all transactions are recorded so there is an audit trail to fall back on. Think through all perimeter doors employees need access to. Do admins need access to more doors than the standard employee? If so, this would be a different door group. What if there are more than one building or facility? Do some employees need access to some building or locations, but not others? If so then these will have to be separate door groups.
Once the perimeter doors have been thought through now it is time to think through common interior doors. With smaller organizations perimeter doors and common interior access doors can be grouped together. For larger organizations especially those with multiple buildings or locations then separate interior door groups need to be thought through. These are doors that most employees need access to throughout the standard work day. This may include the break room, door to the warehouse or manufacturing floor. This all depends on how many interior doors are being controlled by the access control system. This should be a relatively easy task determining which interior doors most employees will need access to.
Now, who needs access to specialty areas within the facility? One of the most common specialty door groups is for IT. These would be the server room, equipment and phone rooms. These are grouped together and only IT, admin/execs and building systems will have access to these. Tool cribs and equipment lockers. Those on the manufacturing floor will have access to these. Is there an onsite workout room? Access to this area is generally reserved to those who have had training and signed a waiver. This door or doors is usually its own door group and only added to the employee’s schedule after training and the waiver has been signed.
Other specialty door groups, law enforcement will setup minimum access to the evidence room and weapons locker. Health Care will have minimum access to pharmaceutical, dietary and med rooms. Some organizations may limit access to the Accounting and HR wing or suites. For the most part, specialty door groups are easy to think through and put together because the needs here are specific.
Unlock Schedules, do you have any customer facing doors which need to be unlocked each day? Is it a straight forward to unlock and lock schedule? Is it multiple unlock and lock cycles in a single schedule? This is used at schools to unlock/lock the doors for a short duration when the students both arrive and depart? Is this only Monday through Friday or do you need to take in account weekends? Is there someone always onsite when the door is to unlock? Do you want to ensure a person or a group of persons is onsite before any of the doors unlock each day?
Vendors, Visitors and Contractors
Vendors, Visitors and Contractors and other smaller groups of individuals. Vendors will have their own door group and access schedule. This limits them to only the two or three doors they need to access their equipment. Their associated access schedule for the most part is limited to a couple of hours they are generally onsite once a week.
Access for contractors and visitors depends on the time frame they will be onsite and for how long? Long-term contractors are essentially short-term employees. They need access to everything a standard employee needs access to unless certain areas are deemed off limits. The same with visitors, someone visiting for only the day may need very limited access. This may be an entrance and two or three doors within their facility to accomplish their task. Longer term visitors may need access to only one entrance but a handful of interior doors to accomplish their daily tasks.
Besides limiting the access schedule and the door a Vendor, Contractor or Visitor may have access to you can also limit the overall time frame the badge is going to work at that facility. Most cardholders are added to the system with a badge which is enabled. This means the badge is going to work today, next month and next year and 10 years from now. To help combat access to your facility by a short-term visitor, vendor or contractor limit the overall duration the badge will work. This means instead of enabling the badge in the system make it temporary. While the badge is still assigned a time frame it is going to work and which doors it is going to work at. You are limiting the overall access to a day, a week, a month or year. In fact, some organizations put in all of their employees as temporary for a year or two. This way their access to their facility is re-evaluated every year or couple of years.
Employee Trust and Compliance
When a new employee is being on-boarded be sure to spend a moment and discuss your access control policy.
Make sure they understand that the badge is for their use, and their use only. They are not allowed to lend it to another employee to run out and get something from their vehicle. Inform them that every transaction at the door is recorded in the access control system.
Badge care, make sure they understand to keep it out of direct sunlight, don’t leave it on the dashboard of their vehicle. Don’t make it a tempting target by leaving it in your vehicle. Make sure it does not end up going through the washer and dryer.
Report lost or missing badges immediately. This way the badge can be made in- active within the system. Make sure they understand that it is not uncommon for a badge to be temporarily misplaced. A replacement temporary badge can be issued in the meantime. This is until it is decided that the badge is truly lost and can be marked so in the system. Record the date and any other pertinent details. Make sure it is understood that it is better to report a lost or misplaced badge than not to.
Let Ban-Koe Companies design and implement your own access control policy…
With over 30 years’ experience in the access control industry we have the experience to design, implement and install a tailored solution.
Listening is key, working with you to understand the individual needs of your organization enables us to create seamless solution which is natural and becomes part of your everyday policies.
Evolution of a plan to a policy; a good access control policy starts with a plan, a conversation, and from there the details are flushed out until a tailored solution and policy is delivered.
Contact Ban-Koe Companies for the expertise to guidance to deliver your next access control solution.