Physical Access and Visitor Management Procedure

Purpose

This Procedure describes how people enter our premises and the data centres, how visitors are received and escorted, and how badges and access lists are controlled, so that only the right people reach the Office and Restricted zones.

Scope

It applies to the Utrecht office, to the data centre suites that colocation providers operate for us, and to every employee, contractor, and visitor who enters them.

Roles

• ISMS Manager: owns this Procedure and reviews the visitor log.
• Service Desk Lead: issues and withdraws badges, keeps the Restricted zone access list, and approves visits to the data centres.
• Facilities Lead: looks after reception, the entrances, and the badge system.
• Host: the employee who invites a visitor and stays responsible for them.
• Management Board: receives the report of the quarterly review.

Procedure

Visitors

1. The host registers a visitor beforehand, with the name, the company, the date, and the reason for the visit.
2. At reception the visitor signs in and shows identification. A pre-registered visitor is accepted, and an unregistered visitor waits until the host confirms.
3. The visitor receives a visitor badge and is escorted by the host at all times. Visitors never enter the Restricted zone unless the Service Desk Lead has approved it, and they are never left alone.
4. At the end of the visit the visitor signs out and returns the badge.
5. The visitor log is kept for 12 months.

Badges

1. The Service Desk issues a personal badge to each new employee on the first working day, after identification, with the zones the role needs.
2. A badge is never lent. A lost or stolen badge is reported at once to the Service Desk, which disables it and issues a new one.
3. A badge is returned and disabled on the day its holder leaves or no longer needs access.

Restricted zone

1. The Service Desk Lead keeps an access list of named people for the Restricted zone.
2. Every quarter the Service Desk Lead reviews the list with the ISMS Manager and removes everyone who does not need the access. The result is reported to the Management Board.

Data centre visits

1. A visit to a data centre is requested through the provider at least 2 working days ahead, and is approved by the Service Desk Lead.
2. On arrival, the visitors show identification to the provider, who checks it against the request.
3. An escort stays with every visitor who does not hold standing access. The visit is logged with the times of entry and exit, and with the racks that were touched.

Records

• The visitor log and the registrations of visitors.
• The badge register with issue, loss, and return.
• The Restricted zone access list and the report of each quarterly review.
• The requests, approvals, and logs of data centre visits.

Related documents

• Physical and Environmental Security Policy
• Access Request and Review Procedure
• Joiner, Mover and Leaver Procedure

Review

The ISMS Manager reviews this Procedure at least once a year and after a significant change. The first review falls one year after the Procedure was published.