Access Control and Visitor Management
What the domain tests
This domain tests control of people, vehicles and materials at a site. The exam wants a repeatable check: authorise, identify, record, issue, escort and recover.
Core rules
- Use one entry point where possible and apply the same check to staff, visitors, contractors and VIPs. Familiarity is not authorisation.
- Verify identity against an approved list or photo ID, confirm the purpose of visit, issue a dated badge, and record name, organisation, time in/out, host and vehicle number.
- Prevent tailgating: politely ask the second person to present their own pass; use barriers, turnstiles or an escort where required.
- Visitors stay in permitted areas and are escorted if the site requires it. Collect badges and passes on exit.
- Control keys, cards and vehicle passes with a signed issue/return log; report lost keys at once.
- Check deliveries against the gate pass and invoice, and inspect vehicles where site rules allow, without damaging property.
Worked example
A man in a courier jacket says he has a parcel for accounts but has no ID and cannot name the recipient. Reasoning: appearance and urgency are not proof. The guard keeps him at the gate, calls the accounts office, confirms whether a delivery is expected, and asks the courier to wait for the host. If no host confirms, entry is refused politely and the decision is logged.
Traps
Waving through a familiar face, letting a visitor follow a staff member through the door, incomplete logs, holding ID documents without policy, or accepting a verbal it is fine from an unknown caller.