Unescorted Contractor in the White Space at 02:40
At 02:40 a chiller maintenance contractor is found alone inside the white space of a 3.2 MW hall, having entered through a secure door that a cleaning operative held open. The contractor's badge is valid for the plant room only. The access control system shows 14 door-held and door-propped events in the last 30 days, none investigated. The NVR storing camera footage failed 40 days ago and no one noticed; retention is now effectively zero against a 90-day policy requirement and a client contract clause. The contractor had also isolated a chilled-water valve without a permit to work, and the isolation register was last updated three days earlier. He was not injured, but a manual valve left in the wrong position had already pushed two aisles to 27°C before a technician noticed the trend.
1. Set out your immediate containment actions for the first 24 hours, distinguishing what must happen now from what can wait.
Read the worked answer
Now (same shift).
- Confirm the contractor is escorted off site or formally re-escorted under a valid permit, badge revoked or downgraded, and the contractor's supervisor informed in writing.
- Verify the chilled-water system state: valve position restored, temperatures trending back, and a walk of all aisles to confirm no other isolation is in the wrong state. Reconcile the isolation register physically against every lock and tag, not against the paperwork.
- Check the door in question and any other door with held/propped events for hardware, closer and alarm configuration.
- Preserve evidence: ACS logs, any surviving camera footage, the isolation register, the contractor's permit file. Do not let the shift rewrite logs.
- Notify the client per contract clause on security incidents, and notify site management. Brief the shift on the escort rule and the fact that holding a door for anyone is a reportable event.
Can wait 24–72 hours, but not longer. Restore CCTV recording and confirm retention by test-retrieval, not by checking the recorder's configuration screen. Issue a formal deviation notice to the cleaning contractor. Set up a permit-to-work review for all contractor isolations. Re-baseline the environmental trend review so a 27°C excursion is alarmed rather than noticed.
The judgement point. The temperature excursion is the symptom that got noticed; the security failure is the one that could have been a deliberate intrusion. Treat the security event as primary, and do not close it because nothing was stolen.
2. Analyse the underlying control failures and rank the corrective actions by risk reduction per unit of effort.
Read the worked answer
The failures are systemic, not individual. Three controls failed independently and simultaneously: physical access (tailgating tolerated long enough to generate 14 unreviewed events), monitoring (CCTV down 40 days with no detection), and work control (isolation without permit, register stale by three days). Any one alone would be a finding; together they mean the site cannot detect or reconstruct an incident.
Ranked corrective actions.
- CCTV restoration and retention verification - highest risk reduction for low effort. Detection of a failed recorder should be automatic; add a daily health check and a monthly retrieval test logged with a timestamp. Without footage, every other control is unverifiable after the fact.
- Door-held/propped alarm handling - configure alarms to the control room with a mandatory response and closure note within 15 minutes; review the 14 events retrospectively to establish whether any were benign. Low cost, directly addresses the entry route.
- Contractor access model - badges scoped to plant rooms with time windows, escort requirement enforced by turnstile/airlock where feasible, and contractual sanctions for the contractor and the cleaning provider.
- Permit-to-work and isolation control - a physical lock and tag with a register reconciled at shift handover; no isolation without a signed permit and a named authorised person.
- Environmental excursion alarming - automated alerts on aisle temperature rate-of-change so that a mis-set valve is caught in minutes.
What not to do. Do not respond with a retraining memo as the primary action. Training is a supporting measure; the controls above are what actually change behaviour, and the audit trail should show the sequence of implementation dates.