Visitor and Vendor Management
Every access policy has a standing exception: the people who do not work here but need to come in. Visitors, contractors, auditors, delivery drivers, and vendor technicians pass through the perimeter every day with legitimate business. They are also the single most exploited path into a secure facility, because managing exceptions is where discipline quietly decays. The control is not a better lock; it is a rigorous process applied without exception.
The process begins before arrival. Pre-registration requires a host, an employee who sponsors the visit, to enter the visitor's name, company, purpose, and time window into the system in advance. Pre-registration does two things: it creates an accountable sponsor and it lets security vet the visit before the person is standing at the desk creating pressure to be waved through. A walk-up with no host and no appointment is the default-deny case, not an inconvenience to be smoothed over. The sponsor model means every visitor is tied to a named employee who answers for their presence and their conduct.
At arrival, identity is verified against government-issued photo identification, and the name is matched to the pre-registration. High-security sites photograph the visitor, print a badge that visibly encodes the date and expiry, and in sensitive facilities check the identity against denied-party and watch lists. The visitor badge is deliberately distinct in color and design from a staff badge, so that anyone on the floor can tell at a glance that this person should be escorted and should not be alone in a restricted space. A visitor badge grants no independent door access; it is a marker, and the real access is the escort.
The escort is the heart of visitor control. In the secure and critical zones, a visitor is never alone. An authorized host accompanies them from entry to exit, ensures they access only what the visit requires, and stays with them through every zone transition. The escort is accountable if the visitor wanders, touches equipment out of scope, or attempts to photograph the floor. Escort ratios are enforced: one host cannot credibly control a crowd, so sensitive areas cap the number of visitors per escort, often at one to one. The badge and the log record entry and exit; the escort enforces everything in between.
Vendors and contractors are a harder problem than one-time visitors because they need recurring, sometimes deep, access. A cooling contractor, a network installer, a hardware break-fix technician may be on site weekly and may need to touch live infrastructure. The discipline here is time-bounded, scope-bounded credentials. A contractor is issued access limited to specific doors, specific zones, and specific hours, expiring on a fixed date and requiring renewal. Access is provisioned to the job, not the person indefinitely. When the contract ends, the credential is revoked immediately, and the revocation is verified, not assumed. Orphaned contractor credentials, still-active badges for people who no longer have a reason to enter, are a persistent and dangerous failure.
Vendor management extends beyond the badge to vetting. For contractors with recurring access to critical spaces, background screening, security awareness briefings, and signed acknowledgment of site rules are prerequisites, not formalities. The vendor's own employees change, so the process tracks which individual technician is on site under which contract, and it does not accept a substitute technician on an existing credential. One badge, one vetted person.
The supply of access rights has to be reconciled continuously. Periodic access reviews compare the list of everyone holding credentials against the list of everyone who currently has a business reason to hold them, and they revoke the difference. This catches the departed contractor, the completed project, the role change that should have narrowed access but did not. Between reviews, a clean offboarding process ensures that the day a contract ends or an employee leaves, every credential is disabled and every issued badge is recovered or deactivated. The threat model here is mundane and real: the person who once had a legitimate reason to enter and no longer does, still carrying a badge that still works. Close that gap with process, because no wall stops a valid credential.