Joiners–Movers–Leavers (JML) and temporary access
Publish a short JML procedure:
- Joiners: how identity is verified, credential issued (card/fob/mobile), and group assigned.
- Movers: how access changes are requested/approved and implemented (with audit).
- Leavers: how and when access is revoked (same day), including contractors and temps.
Treat temporary access (e.g., project contractors) as time-boxed from the start. For receptions and deliveries, integrate video entry so manual releases are logged via the controller, not bypassed with a dry contact.
(See: Entry Phone Installation.)
Life safety policy (non-negotiable)
Security must never impede escape. Your written policy must state that electronically controlled doors on escape routes release on fire alarm and on relevant fault conditions, with the interface to the fire system designed and witness-tested. Reference BS 7273-4:2015+A2:2023 and record test results at commissioning and drills; treat the “critical signal path” as a design line-item, not a late change.
Administration & change control
Document who can administer the system (named roles), how changes are approved, and what is logged:
- Role-based admin accounts; no shared logins.
- Strong authentication for admins (MFA) and secure admin paths (especially for cloud-managed systems) aligned with NCSC Cloud Security Principles—identity and secure administration.
- Time-synced logs; configuration backups after significant changes.
- A simple change form for new doors, integrations, schedules and holiday calendars.
Credential policy: cards/fobs, mobile and PINs
Write down which credentials are allowed, where, and when to step up to two-factor (e.g., card + PIN for comms rooms). If you issue mobile credentials, set the BYOD ground rules (screen lock, current OS, immediate revocation on loss) and point to your IT device policy. NCSC’s BYOD and cloud guidance provide a vendor-neutral benchmark for identity, device assurance and admin hardening.
For touch-free journeys at busy doors, specify where hands-free readers are permitted and how far they should trigger—then test them against your throughput and tailgating risk.
(See: Hands-Free Access Control.)
Biometric policy (only if genuinely needed)
If you use biometric recognition (fingerprint, face, iris, vein) to identify people, you’re processing special category biometric data under UK GDPR. Your policy must cover:
- Necessity & proportionality versus less intrusive options.
- A DPIA before deployment; a lawful basis and Article 9 condition.
- Alternatives for those unwilling/unable to enrol (e.g., card+PIN).
- Template security, retention and deletion; who can enrol/delete; how it’s audited.
The ICO’s biometric guidance is explicit on these obligations—build them into your policy and supplier due diligence.
Visitor and contractor procedures
Publish a reception SOP that covers pre-registration, verification, issuing time-limited least-privilege credentials (QR/mobile/card), and checkout. Pair your VMS with the access platform so every grant/expiry is an access event, not an unlogged relay. Keep privacy information concise and visible; the ICO’s surveillance guidance is a good yardstick for transparency and retention.
(See also: CCTV–Access Control–Alarm Integration.) ICO
CCTV & alarm integration rules
Spell out which access events should trigger which actions: e.g., “forced door = bring up the associated camera; first-in disarms intruder zone; last-out arms.” Decide who reviews alerts and within what time. This turns “integration” from a wiring exercise into an operational playbook your team can follow and auditors can verify. The ICO’s video surveillance guidance will help you keep signage, retention and rights handling in order.
