Visitor access and insider threat programs: the escort who was never assigned

Visitor management systems record intent at the front desk. What happens over the following four hours — who actually walked the visitor where — is a verbal arrangement between colleagues.

Part of Defense industrial base identity

The gap between the badge and the afternoon

A visitor arrives at 09:15. Reception verifies identity, checks the visit request, prints a badge, and records the sponsoring employee and the assigned escort. All of that is captured accurately.

At 10:40 the escort is pulled into a meeting and asks a colleague to cover. At 13:00 the visitor moves to a different building with a third person. At 15:30 they leave, and the system records departure against the original escort.

Nobody did anything wrong. The record is now a description of the morning's intent rather than of the day.

What the obligations require

Insider threat programme requirements for cleared contractors address programme establishment, training, reporting and access governance. Facility security requirements address visitor control and the escort of uncleared persons in limited and closed areas.

The requirements assume escort responsibility is known. They do not prescribe how a transfer of that responsibility is recorded, because in a paper-and-logbook environment the transfer was rare and visible.

Why this is graded conservatively

Three honest limitations, and they are the reason this record sits in the frontier set rather than the core portfolio.

• Facility security incident data is not public and, for cleared facilities, frequently not shareable at all. There is no measurable prevalence.
• Escort reassignment frequency is not tracked by any system, so even the denominator is unknown.
• The harm pathway is plausible and undocumented. An improperly escorted visitor may see nothing consequential, and the counterfactual is unknowable.

What a facility can do is measure its own: over one month, ask escorts to report handovers informally. The number will be higher than the security office expects, and it costs nothing to find out.

The Escort Handover Receipt

Make the transfer of responsibility a signed act rather than a verbal one.

{
  "type": "manav-stmt/1",
  "action": "escort_handover",
  "visit": "[visit id]  Visitor: [name]",
  "from_escort": "[credential assertion]",
  "to_escort": "[credential assertion]",
  "location": "[area]",
  "at": "[timestamp]"
}

Two gestures, a few seconds, on phones the escorts already carry. The record now reflects who held responsibility at each point rather than who was assigned at 09:15.

The friction test

This lives or dies on whether escorts will do it. So measure before deploying:

1. Time the handover gesture on the devices staff actually carry, in a corridor rather than at a desk.
2. Estimate handovers per day from the informal survey above.
3. Multiply. If the total is minutes per day across a facility, it is negligible. If it is materially more, the design is wrong.
4. Check whether phones are permitted in the areas where handovers occur. In many cleared facilities they are not, which may make this undeployable — and that is worth discovering before procurement rather than after.

That last point is a genuine blocker in a meaningful share of facilities, and any vendor who has not raised it has not thought about the environment.

What it would improve

Investigation time, primarily. A security incident involving a visitor currently begins by establishing who was with them, which means interviewing people about a Tuesday three weeks ago.

It also improves the position of the escorts themselves, who are currently named in a record describing a responsibility they may have handed over in good faith and cannot demonstrate handing over.

Why handover is the gap, not assignment

Objections and honest limits

“Our escort policy prohibits informal handover.” It does, and handovers happen because escorts have other work. A policy that operations must violate to function produces no record of the violation.

“Badge data reconstructs it.” It shows which badges opened which doors. In an escorted visit both parties move together, so the data is consistent with several different escorts.

Making escort custody continuous

1. Treat handover as a first-class event. Rather than something the policy pretends does not happen.
2. Sign the handover, both parties. Outgoing and incoming escort, one gesture each.
3. Bind it to the visitor and the area. So the record answers who, with whom, where.
4. Reconcile at check-out. An unclosed custody chain is the signal.

Terms used here

Escort

A cleared individual responsible for an uncleared visitor's movement and conduct within a controlled area.

Custody chain

The unbroken sequence of responsible individuals over a period, each handover recorded.

Insider threat programme

The required programme for identifying and mitigating risk from trusted individuals, which depends on being able to attribute presence and action.

Frequently asked questions

Why is this graded C? Because prevalence and harm data are unavailable, and in cleared environments they are frequently unshareable. The mechanism is simple; the business case must be built locally.

What if phones are prohibited in the area? Then this is undeployable there, and that should be established before any procurement. It is a common condition and it is a genuine blocker.

Does this replace the visitor management system? No. It records handovers the system does not capture, alongside it.

How would a facility justify it? From its own investigation time and its own handover frequency, both of which it can measure this month at no cost.

Why isn't the check-in record enough? It names who was nominated at the door. Handovers happen during the visit and are the thing an incident review needs to reconstruct.

Can badge data reconstruct escort custody? No. In an escorted visit both parties move together, so the badge trail is consistent with several possible escorts.

What should the handover record contain? Outgoing escort, incoming escort, the visitor, the area and the time — signed by both parties.

Sources and further reading

• 32 CFR Part 117 — National Industrial Security Program Operating Manual
• Published guidance on physical access governance in controlled environments.
• NIST SP 800-171 Rev. 3 — Protecting CUI