Physical Security and Access Control

Access control is the restriction of entry to a facility or area to authorized persons only. Methods include: (1) Badge readers: an employee scans a badge, and the system verifies their clearance and unlocks the door. (2) Biometric scanners: fingerprint, iris, or facial recognition verifies identity. (3) Keys: physical keys issued to authorized persons; disadvantage is loss or theft of keys and inability to revoke access quickly. (4) Keypads: a personal identification number (PIN) grants access; disadvantage is shared PINs and shoulder surfing (someone watching the PIN entry). (5) Multi-factor authentication: combination of methods (badge AND PIN, or badge AND fingerprint) provides higher security. Access control systems log all access: who entered, when, which door, and how often; this creates a record for security investigations. A security breach (unauthorized entry) is detected through logs or alarm activation, triggering investigation and potentially police response.

A risk assessment is the evaluation of threats (what could go wrong?), vulnerabilities (what weaknesses exist?), and likelihood (how probable is the threat?). For a corporate office: threats include theft (employee or external), violence (disgruntled employee, domestic partner), and sabotage (corporate espionage, competitor). Vulnerabilities include unlocked server rooms, unvetted visitors, and limited CCTV coverage. Likelihood depends on industry and location (tech companies face higher cyber-theft risk; retail locations face higher shoplifting risk; government buildings face higher terrorism risk). Risk assessment prioritizes security investments: a high-threat, high-vulnerability location receives more security resources (guards, access control, CCTV) than a low-risk location. A risk assessment is ongoing; as threats change (new competitor emerges, new technology threat), security measures must evolve.

Personnel screening is the background check and vetting of employees, contractors, and vendors to identify security risks (criminal history, financial problems that could motivate theft, foreign ties that could indicate espionage). Vetting includes: criminal background check (felonies, misdemeanors), employment history verification (confirm past employment), financial check (credit score, bankruptcy history), and in some cases, drug test and psychological evaluation. Sensitive positions (access to classified information, financial systems, executive protection) require more thorough vetting, including interviews and reference checks. A person with a criminal history of theft is not suitable for a position with access to cash or valuables; a person with financial problems might be vulnerable to bribery or espionage. Vetting is ongoing: a cleared employee who develops a gambling addiction or drug abuse problem becomes a security risk and may be re-evaluated. Privacy laws limit what vetting can include; EEOC rules prevent discrimination based on arrest records (which may not reflect guilt) and limit the weight given to criminal convictions.

Terminology varies, but typically: a security guard is an entry-level position, often part-time or contract, with minimal training and authority. A security guard's role is primarily visibility (presence) and reporting (calling police if something suspicious happens). A security officer is a more advanced position with specific training, authority to detain or question, and responsibility for responding to incidents. A security officer may have training in access control, incident response, and evidence preservation. The distinction affects pay (guards often make minimum wage; officers make more), training requirements, and legal authority. In some jurisdictions, security officers are licensed and regulated; guards are not.

An access control incident is unauthorized entry or attempted entry. Incidents include: a person tailgating (following an authorized person through a door without swiping a badge), a stolen badge being used to enter, or a door being propped open. Investigation includes: reviewing access logs (when was the door accessed? Who accessed it?), checking CCTV footage (did the person have authorization?), interviewing the authorized user whose credentials were used (do they know the person? Did they lose their badge?), and determining if a crime occurred (trespassing, theft, identity fraud). A person who uses someone else's badge without permission is committing fraud and can be arrested. A persistent tailgater may be a competitor trying to access trade secrets; law enforcement involvement may be warranted. Access control incidents are early warning signs of larger security problems and warrant investigation.

Closed-circuit television (CCTV) is a video surveillance system that records activity in specific areas (building entrances, hallways, server rooms, parking areas). CCTV serves multiple purposes: (1) Deterrence: the visible presence of cameras discourages theft and vandalism. (2) Evidence: if a crime occurs, footage is reviewed to identify the perpetrator and gather evidence for law enforcement. (3) Monitoring: security staff can watch live feeds to detect suspicious activity in real time. (4) Analytics: modern systems use motion detection and artificial intelligence to alert security staff to movement in restricted areas or unusual patterns. CCTV has limitations: image quality depends on lighting and camera placement; some areas cannot be covered without privacy violation; and storage of footage requires significant hard drive capacity or cloud storage. Privacy laws limit where CCTV can record (bathrooms and dressing rooms are off-limits).

Entry-level security guards require minimal training (some states have no requirement; others require a state-issued license and brief training). Security officers should have formal training: a security operations course (40-80 hours) covering access control, incident response, legal authority, and use of force (for armed officers). ASIS International Certified Protection Professional (CPP) is the advanced certification; it requires five years of security experience and passing a comprehensive exam. IFPO Professional Security Officer certification is another standard. Armed security officers must have additional training in firearms and legal authority to use force (varies by state). Continuing education maintains certifications as security threats and technologies evolve.