Who Is In The Facility?

By Allan B. Colombo, Facility Executive

Effective integration of access control and visitor management is one tool in tracking building occupants.

Security is an important part of business in high-rise office buildings, manufacturing facilities, campus settings, and facilities of all sizes. This includes the development of an intelligent security network that provides for secure, automatic access security policies; and seeks to provide actionable data related to the comings and goings of regular employees; outside, on-site consultants; as well as short-stay visitors.

“Corporate security has become a high-profile issue since the events of September 11, 2001 exposed America’s vulnerability to terrorist attack,” says Thomas E. Cavanagh, author of Corporate Security Measures and Practices, An Overview of Security Management Since 9/11.

In this article we’ll talk about the need and function of access control and visitor management systems. We will look at how these systems are sometimes connected internally by a single software solution as well as other integration methods.

To answer the call for better and more security, equipment manufacturers and other stakeholders have created a unified, centralized, integrated “building intelligence nexus” which enables facility management and security personnel to assign “who” is authorized to enter as well as “where” and “when” they’re authorized to do so. This includes the storage and display of all data for a given period of time, which can be used for investigatory purposes. Processing, analysis, and data storage can take place on site via an access control host computer or in a cloud based data center.

The two mechanisms that enable security to do all of this are “access control” and “visitor management.”

“Access control is very popular in large corporate environments as well as government settings. One of the reasons is that it provides a means whereby only pre-qualified individuals can automatically enter without special, individualized attention. It also assures that there’s an audit trail after the fact for security personnel to follow when an event occurs that requires further investigation,” says John Larkin, senior partner with Electronic Systems Consultants, LLC (ESC) of Columbus, OH. ESC is a security integrator with special focus on the commercial and government markets.

Larkin points out that a well thought out access control system not only makes for a more secure and positive working environment, but it also reduces the need for security personnel, thus saving considerable money.


One of the answers to today’s security concerns is the installation and implementation of network, IP-based access control with a visitor management component. In some cases the visitor management segment may be entirely separate from the access control system. At other times there’s a clear, concise connection between the two—and rightly so as both access control and visitor management share many of the same technological tools and system architecture, as well as types of data. In many cases, this includes access to a facility-wide video surveillance system.

There are differences between what an access control system will do and that of a visitor management system. This difference relates first to the extent to which security must go to in order to positively identify and verify risks associated with individuals. In this regard, access control typically requires a much deeper commitment, such as background checks and the use of publicly available information to evaluate risks associated with long-term employees and temporary workers, subcontractors, and consultants.

A visitor management system, on the other hand, is designed to accommodate short-stay individuals, such as sales representatives, equipment service technicians, IT specialists, deliverymen, members of the general public, to name only a few.

“We offer visitor management systems that are either standalone or integrated into access control, depending on a client’s need,” says Matthew Ladd, a member of Security-Net, a network of independent security systems integrators with offices throughout North America. Ladd also is the president of The Protection Bureau of Exton, PA. “The customer has a card-based access control system. With visitor management added it allows them to log the visitor in—usually after doing some type of verification with a form of ID like a driver’s license—and they are given a badge, which can have an access control component to it. The badge is programmed in such a way that it will time out when their visit is over so they can’t use it again.”


Access control systems are designed to automate the process of entry into and, in some cases, exiting a structure. Through software it’s possible to determine who can enter a facility as well as who can enter through select interior doors. Through software you can again assign a specific door to a specific employee. You also can assign days and times during which they can enter. And when an employee attempts to enter through a door to which he or she is not pre-authorized, or if they should attempt to do so at a time not programmed in software, the access control system will notify security of the failed attempts.

In order to accommodate and fulfill these mandates, there are several ways in which to establish identity. They consist of 1) something that the user knows, 2) something the user possesses, 3) something the user is, and 4) a combination of the above, such as 1 and 3.

A good example of “something the user knows” is an ordinary keypad PIN (personal identification number). Some of the newer keypad designs utilize soft buttons as part of a larger integrated human interface.

The second component, “something the user possesses,” can be something as simple as a standard proximity or RFID access card in conjunction with an access reader placed outside each door. Number three, “something the user is,” pertains to any number of biological characteristics, often referred to as biometrics. Examples include fingerprints, facial characteristics, hand geometry, and iris or retina eye scans. The fourth option usually places number one with either of the others, thus increasing the degree of difficulty associated with a successful entry.

“On the administrative side of the access control coin is the need to create badges with or contained on users’ regular access cards. This requires a few digital images be taken, usually through a small camera on a desk in the main security office,” says Larkin. “A special printer does the actual badge, which can be applied to the access card. Badges provide information on the employee who wears it.”


When you look at the tools, technology, and features that visitor management systems employ, it may first appear that the differences between access control and visitor management isn’t worth mentioning. However, as you will soon see, this is not the case.

“Visitor management is basically the authorization giving a visitor temporary access. Someone intends to be there a certain amount of time, and a visitor’s management system will allow them to go in.

Some companies have rules that must be observed. Policy in place says that if you do not have a visitor’s badge, the visitor most be escorted. The visitor’s personal information must be taken down and recorded. Not only does this facilitate granting access to them, but it also helps comply with company policy,” says Michael Bendis, senior associate with Syska Hennessy Group Inc. of Chicago.

For example, a sales representative enters the building’s public foyer and introduces himself to the receptionist. He’s there to see the company CEO, and his appointment was set for 11:00 a.m. She searches her database for the visitor’s account to verify the appointment and read history on the visitor if necessary, which should tell her if this person is on a company watch list. If everything checks out, the system will either acquire a new digital image of the visitor or use an existing one to print out a temporary paper badge.

After a new badge is printed, the receptionist sends the CEO an electronic message stating that the 11:00 appointment is in the lobby. This message will immediately appear on the CEO’s desktop, as well as on mobile devices. When ready, the CEO will signal the receptionist to have the sales rep come to the office. Because this outside visitor has been there on numerous occasions, the receptionist asks if he requires assistance finding his destination. He indicates no, that he knows how to get there, and then he’s on his way.

A visitor’s badge may be capable of opening doors and activating elevators on the way to his destination, unless an escort is provided. Before the visitor leaves the building, he usually will return the badge as he checks out of the system. If he fails to do so, the visitor management system can be programmed to contact the visitor’s contact to find out if this individual is still in the building. An expiration date and time also can be programmed into the system after which time this badge will no longer work anyway.

In cases where a visitor needs to return to the office the next day, or if he/she should need to work on the premises, the visitor management system will change the visitor’s status to “consultant,” allowing his short-term badge to work throughout the coming days.

“These credentials can be reauthorized every 24 hours, or it can be programmed for a week at a time. Those workers who are there for an extended assignment, where they’re part of a temporary work force with a temporary badge that’s good for only a month, their credential can be re-authorized for even longer periods. However, they’re not given the same privileges as regular employees,” says John Friedlander, senior director, security risk management with Kroll of New York, NY.

Some visitor management systems provide a self registration kiosk where visitors can sign into the system without supervision. In a case such as this, instead of a receptionist or security guard, the host computer through a remote terminal will perform the rest of the sign-in process.

In closing, many years ago access control and visitor management were two entirely different functions. At that time each system utilized its own database and its own means of badging and tracking a visitor. An escort was absolutely necessary at that time because visitors did not have the means of accessing elevators and specific doors. Because access control manufacturers saw a need and worked to fill it, and because visitor management manufacturers saw a need for integration with access control, security is enhanced and the world is a more convenient place for visitors as well as those whose job it is to accommodate them.