Tailgating at a Leased 1970s Headquarters
A 1970s eight-story headquarters holds 1,100 badge holders, 22% of them contractors. The only controlled entry is the lobby: two turnstiles installed in 2009 and one unarmed guard from 07:00 to 19:00. Badge data show 14 tailgating events in 30 days, a vendor was found unescorted in the server room twice, and a courier walked to the fifth floor unannounced. The building is leased; the landlord controls the shell and core and resists drilling. Fire code requires unobstructed egress, and the tenant council objects to 'fortress' measures. You have $400,000 capital and no new headcount approved. HR will not release floor plans to the guard vendor.
1. Design the layered approach and zoning within these constraints.
Read the worked answer
Zone rather than fortify. Public lobby, semi-restricted floors, and restricted server and communications rooms - each zone gets its own control, because the tenant council will accept a restricted server room far more readily than a hardened lobby.
Work around the landlord. Anything that clamps, mounts or sits on the floor avoids the shell-and-core fight: optical turnstiles with tailgate detection, a pre-registration visitor management system with photo ID and printed badges, door position switches on sensitive rooms, and alarmed stair and freight doors. Reserve the drilling requests for the server room only, where the argument is strongest and the footprint smallest.
Egress: any barrier must free-egress on alarm or power loss. Optical turnstiles that alarm on tailgating without physically stopping anyone often satisfy fire and the tenant council at once.
Contractor population is the real hole at 22%. Audit the badge file against the staffing agency's active roster, kill orphan credentials, and get a termination feed in writing. HR's refusal to share floor plans with the vendor is correct - give the guard a zone map and escort routes instead.
2. How do you prove it works, given the council's skepticism?
Read the worked answer
Establish the baseline you already have: 14 tailgating events in 30 days, two unescorted-vendor findings, one unannounced courier. Every measure after this is judged against those numbers, which makes the improvement visible and the argument factual rather than aesthetic.
Run unannounced walk tests monthly - a staff member without a badge attempts entry, a visitor attempts to reach a restricted floor unescorted, a courier attempts to bypass the desk. Record detection, response time and outcome. Run one third-party red-team assessment after the first phase to validate the whole path rather than the individual devices.
Metrics to report quarterly: tailgating alarms per door, percentage of visitors pre-registered and escorted, door-held-open alarms and mean response, badge audit exceptions closed, unescorted-vendor findings (target zero).
Publish the results to the tenant council. Transparency is the antidote to the 'fortress' objection - they are objecting to an unknown, and a monthly one-page result turns it into a measured, reversible program.
3. Sequence the $400,000 and state what you defer.
Read the worked answer
- Policy and process first (weeks 1-6, minimal cost): visitor pre-registration, escort policy with logged exceptions, contractor badge audit and termination feed, revised post orders for the lobby guard with an escort and response role. This closes the vendor-in-the-server-room finding before any hardware arrives.
- Lobby turnstiles with tailgate detection (~$150-200K): the highest-visibility fix and the one the badge data most clearly justifies. Free-egress configuration, landlord-friendly mounting.
- Server and comms room access control plus alarms (~$60-90K): card plus PIN, door-held alarm, local sounder. This is where the drilling request is worth spending political capital.
- Analytics on existing cameras for after-hours loitering (~$40-60K): software-only, no new conduit.
Defer: vehicle gates (no perimeter), full floor-by-floor access control, and any additional guard post. Note explicitly what the remaining budget does not buy, so the next cycle has a queued list rather than a surprise. A roving officer beats a second static post at this headcount.