Access Control and Site Security Procedures
The core idea
Access control answers three questions: who may enter, where may they go, and what may they bring. Candidates should understand the layered model: perimeter, building envelope, interior zones, and asset-level controls. Each layer should authenticate identity, verify authorization, and record the event. Learn the three factors of authentication: something you know, something you have, something you are; multi-factor means combining different types, not two of the same.
Concepts to master
- Identification vs authentication vs authorization: claiming an identity, proving it, then being permitted.
- Credential types: badges, PINs, biometrics, and their failure modes (tailgating, pass-back, sharing, cloning).
- Tailgating and piggybacking: prevention via turnstiles, mantraps, and courteous challenge scripts.
- Visitor management: sign-in, escort, badge color-coding, and badge return.
- Key control and need-to-know: logging, reclamation, and periodic audit.
- Anti-passback and least-privilege principles.
Traps in exam questions
A common trap is equating a valid badge with authorization to every area; cards grant only what is provisioned. Another is treating courtesy as a reason to skip verification. Questions may confuse authentication with authorization, or imply that biometrics are infallible. Watch for answers that let a known employee bypass sign-in for visitors they escort, or that ignore the need to revoke access the day someone leaves.
Worked rule of thumb
When someone follows you through a controlled door, use a polite challenge: "I'm sorry, I need to see your badge to let you through." If they cannot produce valid credentials, direct them to reception and notify the supervisor. Never physically restrain; escalate. Document the time, description and outcome.
Key points
- Separate identification, authentication and authorization.
- Multi-factor means combining different factor types.
- Tailgating is defeated by design plus a courteous challenge script.
- Badge validity does not equal area authorization; enforce least privilege.
- Revoke credentials promptly and audit keys and access rights.