An access-control regime is a set of rules defining who may enter the facility, when, on what grounds, and into which zones, as well as how vehicles and material assets move around. A turnstile and a guard at the entrance are only the visible part. The regime works only when the rules are well thought out, written down, and followed by everyone, including management.

What problems an access-control regime solves

  • Prevents the uncontrolled presence of outsiders at the facility.
  • Brings order to the movement of employees, visitors, and contractors.
  • Controls the bringing in and taking out of goods and material assets.
  • Creates a documentary basis: during an incident it is possible to reconstruct who was at the facility and when.
  • Reduces the load on security: the clearer the rules, the fewer disputed situations at the post.

Define access categories

There should be no universal pass «for everyone.» Divide everyone who enters the facility into categories, and for each one define the grounds for access, the permitted zones, the times, and whether an escort is required.

  • Employees — permanent passes, access by zone and work schedule.
  • Visitors — single-use passes issued on a prior request, indicating the receiving employee.
  • Contractors and service personnel — pre-approved lists with restrictions on zones and time frames.
  • Vehicles — a separate procedure for company, cargo, and personal vehicles, taking loading areas into account.
  • Deliveries and couriers — received at the entrance without proceeding deeper into the facility, where possible.

The rules must be written down

As long as the procedure exists only «by agreement,» the guard at the post acts at their own discretion, and it becomes impossible to hold anyone accountable for a violation. The minimum set of documents looks like this:

  • a regulation on the access-control and internal-facility regime;
  • a post instruction with specific actions for standard and non-standard situations;
  • a procedure for issuing, handing over, and withdrawing passes;
  • request forms for visitors, vehicles, and the removal of material assets;
  • logbooks, if the processes are not automated.

Entry points and equipment

The number of entry points should be the minimum necessary: each additional point is a separate post or technical solution, meaning costs and a potential vulnerability. Equipment — turnstiles, access control and management systems, barriers, video surveillance (CCTV) — is selected to fit the actual flow of people and vehicles, not the other way round. Separately, think through a backup procedure: how the facility operates during a power outage, an access-system failure, or an evacuation.

The regime is carried out by a person

Even a fully automated checkpoint requires a post nearby: technology does not resolve disputed situations. A security officer checks documents in non-standard cases, meets visitors without a request, acts when an alarm is triggered, and ensures that two people do not pass through the turnstile on a single pass. That is why the post instruction should describe not «stand at the entrance» but specific actions: what to check, what to record, whom to call, and in which cases entry is prohibited.

Do not forget the internal-facility regime

The access-control regime answers the question of who has entered the facility; the internal-facility regime answers what that person may do inside: rules for moving between zones, procedures for working outside business hours, the removal of property, and behavior during emergencies. These two systems are designed together — otherwise you end up with a facility that is hard to enter but inside which one can move around freely.

Typical mistakes

  • The rules exist on paper, but management itself does not follow them — the regime quickly falls apart.
  • Exceptions «for insiders» without any paperwork: it is precisely through these that violators most often pass.
  • Visitor requests are filled in after the fact, and logbooks are kept as a formality.
  • The single checkpoint is overloaded during peak hours, and people start looking for ways around it.
  • No procedure is defined for contractors and repair crews, and they move around freely.
  • The passes of dismissed employees are not blocked.

How to tell whether the regime is working

The regime needs to be checked periodically: a control walkthrough, an analysis of logbooks and records, and a reconciliation of active passes against the list of working employees. A useful practice is to assign the control walkthrough to someone the posts do not recognize by sight: they will reveal the real work of the regime, not its parade-ground version. Any change at the facility — a new tenant, renovations, a change in the work schedule — is a reason to revise the rules. A good access-control regime is convenient for conscientious users and inconvenient for a violator, not the other way round.

If you are building an access-control regime from scratch or want to put an existing one in order, start with a description of access categories and the basic documents — this is the foundation on which posts and technology rest. KOS specialists will help you develop a regulation on the access-control regime and organize its enforcement at the facility.