NaCTSO – Access Control
It is important to ensure that your site is kept secure, whilst remaining accessible to your visitors or customers. There will be areas within your site or venue that, for various reasons, should be kept closed to the public. There should be clear demarcation between your public and private areas, with appropriate access control measures in place. Measures at crowded places will differ depending upon the conditions of entry. To be effective, any system requires active management and appropriately trained staff.
Your access control system is a strong indicator of the security regime at your site and should be complimented with clear signage. A challenge culture by staff will also deter hostile reconnaissance. However, consider balancing the deterrent effect of appropriate signage with the possible assistance being given to an adversary carrying out hostile reconnaissance.
3. OPERATIONAL REQUIREMENTS
When installing a new access control system, you should specify your Operational Requirement (OR). A Level 1 OR (OR1) will identify the problem you are trying to solve and the most appropriate solution.
4. EASE OF ACCESS
Examine the layout of your access control system. Ensure that your entry and exit procedures allow legitimate users to pass without undue effort and delay. You should consider how your access control system will work in busy areas at peak times. Access measures should be appropriate for the site and not unnecessarily onerous.
5. POLICY AND PROCEDURE
You should have clear policies and procedures for how the access control system will be used and operated. You should consider how misuse of the system by staff, aids or hinders your lockdown procedures. There may be features in your access control system that can be utilised during a lockdown. These features should be quick and simple to activate and staff should be trained in their operation. Staff should feel empowered to challenge anyone entering an area without the correct pass or who looks in any way suspicious.
Ensure your staff are aware of the role and operation of your access control system. If you have any access control equipment in place your installer should provide adequate training. Training should include the action to take:
• if a pass is lost
• if a person needs to be challenged
• in response to suspicions behaviour
7. SECURITY CULTURE
An effective access control system should incorporate adequate training of staff, and should highlight how to overcome bad practice such as tailgating and holding doors open, coupled with the promotion of a good security culture. Staff should feel safe to challenge or report suspicions.
8. SYSTEM MAINTENANCE
Your system should be maintained and kept in good working order. Your installer should supply all relevant system documentation e.g. log books and service schedules. Be aware of the actions required in the event of a system failure. These failures must be dealt with immediately and a contingency plan put into place. This may be to secure a door, or provide a security officer at the point of failure, with all actions being recorded. You should ensure that you have a suitable maintenance agreement in place which will rectify problems quickly.
9. MANUAL ACCESS CONTROL
If after carrying out the OR1 you decide that a manual locking system is appropriate, there should be a robust management process in place incorporating:
9.1 KEY MANAGEMENT
Key management is crucial in order to maintain the integrity of the system. You should keep a record of all keys issued and conduct regular audits. If a key cannot be accounted for, there should be a contingency plan to deal with a potential compromise of access control.
9.2 ADDITIONAL MANAGEMENT CONTROL SYSTEMS
An electronic lock may be appropriate. This offers a ‘halfway house’ between mechanical locks and a fully electronic access control system. If mechanical PIN code locks are used you should have a plan in place to change PIN codes regularly. Best practice is to change them after a member of staff leaves, after a security breach or every 6 months.
Your access control system should support other security measures. Consider system compatibility between access control, alarms, CCTV and text alert systems.
Your access control system should be compliant with:
• The Equality Act 2010
• The Human Rights Act 1998
• Health and Safety at Work Act 1974
• The Data Protection Act 1998
• The Regulatory Reform (Fire Safety) Order 2005
• The Fire (Scotland) Act 2005
Your access control system will have a set response to fire alarms i.e. doors automatically unlock when an alarm sounds. For your critical areas such as control rooms, it must be remembered that fail-safe systems must be compliant with both health and safety and security requirements. Ensure that when you specify an access control system, you consider what areas may remain locked in an emergency, as security should never compromise safety.
12. LOCKDOWN PROCEDURES
Due to the potential for Firearms and Weapons Attacks and protest activity for example, it is important for you to consider implementing a dynamic lockdown procedure. You should consider how your access control system
13. VETTING PROCEDURES
You should consider how vetting procedures impact on access control. You will need to decide if staff have access to all areas, or if there are restricted areas to your site. Staff and visitors should only be given access to the areas required for their role. Passes may vary in type, dependent upon the area accessed.
The manager of the access control system has a critical role and should be appointed accordingly. Only this person or their deputy should issue passes. Passes must be signed for once the identity of the recipient has been confirmed. Out of hours, the security supervisor may be authorised to issue temporary passes but this will be extremely rare and any visitor out of hours should be escorted. Any passes issued out of hours must be of limited duration.
14. SEARCH PROCEDURES
If your OR identified that searching is necessary at your site, then there are a number of considerations. The primary one relates to the nature of the threat you face. You must identify the aim of the search and the type of items you are searching for. You should use appropriately trained staff, use well maintained equipment and have sufficient space and a suitable environment to conduct the search.
Effective searching requires suitably trained staff who know what to look for, how to search and the action to take if anything is found. BSI PAS 127:2014 Checkpoint Security Screening of People and their Belongings: Guide. This guide aims to provide comprehensive guidance to security managers and contractors on the specification, design and delivery of checkpoint screening processes.
15. VEHICLE PROCEDURES
If your OR identifies the need for vehicular access control then there are a number of considerations. Search procedures must be consistent with the threat. The ideal solution is to restrict the number of vehicles accessing your site and any search should be conducted as far away as is reasonably practicable. Ideally, access will be afforded only to vehicles that are booked in and expected, with the identity of the occupants confirmed.
15.1 VEHICLE ACCESS PASSES
Certain vehicles may need to routinely access your site. It may be prudent to issue vehicle passes to identify vehicles and the management of these passes should be commensurate with all the other access control measures in place. Vehicles that need to gain access without a pass should only be with prior arrangement.
Automatic Number Plate Recognition (ANPR) may be a useful addition to an integrated security regime, but will only provide information related to a registration plate and should not be relied upon alone.
16. INCREASED THREAT
At times of increased threat it may require further access control measures, which may be for staff, vehicles or both. This should be reflected in the site security plan. Vehicle access control may be enhanced by the application of Hostile Vehicle Mitigation (HVM).
The OR process is fundamental to planning an efficient security solution and access control is no exception. Be it controlling pedestrian access to certain areas or vehicles into a site, the principles are the same.
Know who or what is allowed to go where and allocate passes to reflect this, with access suitably limited. Any access control system is only as good as the procedures and the people that govern its use and a good security culture is paramount in ensuring your site remains secure.
© NaCTSO Crown copyright 2017