Access Control and Visitor Management
Domain 3 tests the routine that stops unauthorised people and vehicles entering a site, and the records that prove it was done.
Core rules
- Access control follows a sequence: identify, verify, authorise, record, issue a pass, escort where required, and recover the pass on exit. A friendly greeting is not a substitute for verification.
- Use the three factors: something the person knows (PIN), has (card/key), or is (biometric). For visitors, verify photo ID against an appointment or host list. Issue a visible badge with date and area limits; require an escort in restricted zones.
- Apply least privilege and need-to-know: give the smallest access that allows the task. Challenge anyone without a badge, or whose badge is expired, borrowed or for another area. Never hold a secure door open for an unverified person ('tailgating').
- Visitor logs, key registers and vehicle logs are personal data. Collect only what is needed, keep them secure, and release them only to authorised persons under the PDPA 2010.
Worked example
A contractor arrives at 21:00 saying he must service the air-conditioning and has no appointment. Reasoning: the guard does not admit him. He calls the building engineer or duty manager, verifies a work order, checks photo ID, logs name, company, vehicle and time, issues a restricted pass, and arranges an escort. If no authorisation is available, entry is refused politely and the attempt is logged.
Traps
Accepting 'the boss said it is okay' without verification; letting a visitor follow you through a door; leaving the visitor book open on the desk; issuing a master key; failing to recover passes.