{
 "slug": "escort-handover-receipt",
 "topic_id": "TOPIC-205",
 "cluster": "Defense Industrial Base, CUI & Export-Control Identity",
 "tier": "Tier C",
 "title": "Visitor access and insider threat programs: the escort who was never assigned",
 "summary": "Visitor authorization, escort assignment and area access are recorded at check-in by reception staff. Escort reassignment happens verbally, and the escort of record may not be who was present.",
 "lede": "Visitor management systems record intent at the front desk. What happens over the following four hours — who actually walked the visitor where — is a verbal arrangement between colleagues.",
 "date": "2023-09-25",
 "category": "Compliance",
 "author_id": "tobias-lindqvist-rao",
 "tags": [
  "visitor management",
  "escort",
  "facility security",
  "insider threat",
  "cleared facility",
  "physical security"
 ],
 "image_title": "Escort Handover Receipt",
 "schema": "Article",
 "key_takeaways": [
  "Visitor systems capture check-in intent. Escort handover is verbal, which means the escort of record and the escort present diverge routinely.",
  "Insider threat programme obligations put facility access governance in scope without prescribing how escort responsibility is evidenced.",
  "This is graded C: incident data is not public, and the cost case has to be built from a facility's own investigation time."
 ],
 "body": [
  {
   "type": "h2",
   "text": "The gap between the badge and the afternoon"
  },
  {
   "type": "diagram",
   "kind": "chain",
   "alt": "Escort assigned, escort handed over, record unchanged",
   "caption": "The handover is the normal, necessary part. The record simply does not follow it.",
   "nodes": [
    {
     "label": "Visitor checks in",
     "sub": "escort assigned",
     "note": "recorded"
    },
    {
     "label": "Escort has a meeting",
     "sub": "hands over informally",
     "note": "unrecorded",
     "bad": true
    },
    {
     "label": "Second escort continues",
     "sub": "not in the system",
     "note": "invisible",
     "bad": true
    },
    {
     "label": "Incident review",
     "sub": "names the first escort",
     "note": "wrong person",
     "bad": true
    }
   ]
  },
  {
   "type": "p",
   "html": "A visitor arrives at 09:15. Reception verifies identity, checks the visit request, prints a badge, and records the sponsoring employee and the assigned escort. All of that is captured accurately."
  },
  {
   "type": "p",
   "html": "At 10:40 the escort is pulled into a meeting and asks a colleague to cover. At 13:00 the visitor moves to a different building with a third person. At 15:30 they leave, and the system records departure against the original escort."
  },
  {
   "type": "p",
   "html": "Nobody did anything wrong. The record is now a description of the morning's intent rather than of the day."
  },
  {
   "type": "h2",
   "text": "What the obligations require"
  },
  {
   "type": "p",
   "html": "Insider threat programme requirements for cleared contractors address programme establishment, training, reporting and access governance. Facility security requirements address visitor control and the escort of uncleared persons in limited and closed areas."
  },
  {
   "type": "p",
   "html": "The requirements assume escort responsibility is known. They do not prescribe how a transfer of that responsibility is recorded, because in a paper-and-logbook environment the transfer was rare and visible."
  },
  {
   "type": "h2",
   "text": "Why this is graded conservatively"
  },
  {
   "type": "p",
   "html": "Three honest limitations, and they are the reason this record sits in the frontier set rather than the core portfolio."
  },
  {
   "type": "ul",
   "items": [
    "Facility security incident data is not public and, for cleared facilities, frequently not shareable at all. There is no measurable prevalence.",
    "Escort reassignment frequency is not tracked by any system, so even the denominator is unknown.",
    "The harm pathway is plausible and undocumented. An improperly escorted visitor may see nothing consequential, and the counterfactual is unknowable."
   ]
  },
  {
   "type": "p",
   "html": "What a facility can do is measure its own: over one month, ask escorts to report handovers informally. The number will be higher than the security office expects, and it costs nothing to find out."
  },
  {
   "type": "h2",
   "text": "The Escort Handover Receipt"
  },
  {
   "type": "p",
   "html": "Make the transfer of responsibility a signed act rather than a verbal one."
  },
  {
   "type": "code",
   "text": "{\n  \"type\": \"manav-stmt/1\",\n  \"action\": \"escort_handover\",\n  \"visit\": \"[visit id]  Visitor: [name]\",\n  \"from_escort\": \"[credential assertion]\",\n  \"to_escort\": \"[credential assertion]\",\n  \"location\": \"[area]\",\n  \"at\": \"[timestamp]\"\n}"
  },
  {
   "type": "p",
   "html": "Two gestures, a few seconds, on phones the escorts already carry. The record now reflects who held responsibility at each point rather than who was assigned at 09:15."
  },
  {
   "type": "h2",
   "text": "The friction test"
  },
  {
   "type": "p",
   "html": "This lives or dies on whether escorts will do it. So measure before deploying:"
  },
  {
   "type": "ol",
   "items": [
    "Time the handover gesture on the devices staff actually carry, in a corridor rather than at a desk.",
    "Estimate handovers per day from the informal survey above.",
    "Multiply. If the total is minutes per day across a facility, it is negligible. If it is materially more, the design is wrong.",
    "Check whether phones are permitted in the areas where handovers occur. In many cleared facilities they are not, which may make this undeployable — and that is worth discovering before procurement rather than after."
   ]
  },
  {
   "type": "p",
   "html": "That last point is a genuine blocker in a meaningful share of facilities, and any vendor who has not raised it has not thought about the environment."
  },
  {
   "type": "h2",
   "text": "What it would improve"
  },
  {
   "type": "p",
   "html": "Investigation time, primarily. A security incident involving a visitor currently begins by establishing who was with them, which means interviewing people about a Tuesday three weeks ago."
  },
  {
   "type": "p",
   "html": "It also improves the position of the escorts themselves, who are currently named in a record describing a responsibility they may have handed over in good faith and cannot demonstrate handing over."
  },
  {
   "type": "h2",
   "text": "Why handover is the gap, not assignment"
  },
  {
   "type": "table",
   "caption": "What each record actually establishes",
   "head": [
    "Record",
    "Establishes"
   ],
   "rows": [
    [
     "Check-in entry",
     "A visitor entered and an escort was nominated"
    ],
    [
     "Badge swipes",
     "Doors opened, by whichever badge"
    ],
    [
     "Check-out entry",
     "A visitor left"
    ],
    [
     "<strong style=\"font-weight:600\">Escort at a given moment</strong>",
     "<strong style=\"font-weight:600\">Nothing</strong>"
    ]
   ]
  },
  {
   "type": "h2",
   "text": "Objections and honest limits"
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“Our escort policy prohibits informal handover.”</strong> It does, and handovers happen because escorts have other work. A policy that operations must violate to function produces no record of the violation."
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“Badge data reconstructs it.”</strong> It shows which badges opened which doors. In an escorted visit both parties move together, so the data is consistent with several different escorts."
  }
 ],
 "faq": [
  {
   "q": "Why is this graded C?",
   "a": "Because prevalence and harm data are unavailable, and in cleared environments they are frequently unshareable. The mechanism is simple; the business case must be built locally."
  },
  {
   "q": "What if phones are prohibited in the area?",
   "a": "Then this is undeployable there, and that should be established before any procurement. It is a common condition and it is a genuine blocker."
  },
  {
   "q": "Does this replace the visitor management system?",
   "a": "No. It records handovers the system does not capture, alongside it."
  },
  {
   "q": "How would a facility justify it?",
   "a": "From its own investigation time and its own handover frequency, both of which it can measure this month at no cost."
  },
  {
   "q": "Why isn't the check-in record enough?",
   "a": "It names who was nominated at the door. Handovers happen during the visit and are the thing an incident review needs to reconstruct."
  },
  {
   "q": "Can badge data reconstruct escort custody?",
   "a": "No. In an escorted visit both parties move together, so the badge trail is consistent with several possible escorts."
  },
  {
   "q": "What should the handover record contain?",
   "a": "Outgoing escort, incoming escort, the visitor, the area and the time — signed by both parties."
  }
 ],
 "sources": [
  {
   "t": "32 CFR Part 117 — National Industrial Security Program Operating Manual",
   "u": "https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-D/part-117"
  },
  {
   "t": "Published guidance on physical access governance in controlled environments."
  },
  {
   "t": "NIST SP 800-171 Rev. 3 — Protecting CUI",
   "u": "https://csrc.nist.gov/pubs/sp/800/171/r3/final"
  }
 ],
 "related": [
  {
   "slug": "cross-boundary-cui-access",
   "title": "Who touched the CUI?",
   "category": "Compliance"
  },
  {
   "slug": "deemed-export-authorization-chain",
   "title": "Deemed export",
   "category": "Compliance"
  },
  {
   "slug": "biomed-vendor-session-receipts",
   "title": "Who let the vendor in?",
   "category": "Developer"
  }
 ],
 "image": "https://cdn.twc.sh/images/igcache/Escort%20Handover%20Receipt/1500_900/blog.jpg",
 "wordcount": 839,
 "url": "/blog/escort-handover-receipt.html",
 "reading_time": "4 min read",
 "seo_title": "Visitor escort assignment and insider threat",
 "meta_description": "Visitor authorization, escort assignment and area access are recorded at check-in by reception staff.",
 "hub": {
  "slug": "topics/dib-identity",
  "title": "Defense industrial base identity"
 },
 "answer": "An escort is assigned in a visitor management system and handed over informally on the floor. The record names whoever was assigned at check-in, not whoever was actually walking with the visitor at 14:20 — which is the question an insider threat programme needs answered.",
 "answer_q": "Who escorted the visitor, and can you prove it?",
 "glossary": [
  {
   "term": "Escort",
   "def": "A cleared individual responsible for an uncleared visitor's movement and conduct within a controlled area."
  },
  {
   "term": "Custody chain",
   "def": "The unbroken sequence of responsible individuals over a period, each handover recorded."
  },
  {
   "term": "Insider threat programme",
   "def": "The required programme for identifying and mitigating risk from trusted individuals, which depends on being able to attribute presence and action."
  }
 ],
 "checklist": {
  "title": "Making escort custody continuous",
  "id": "custody",
  "desc": "Four steps.",
  "steps": [
   {
    "name": "Treat handover as a first-class event.",
    "text": "Rather than something the policy pretends does not happen."
   },
   {
    "name": "Sign the handover, both parties.",
    "text": "Outgoing and incoming escort, one gesture each."
   },
   {
    "name": "Bind it to the visitor and the area.",
    "text": "So the record answers who, with whom, where."
   },
   {
    "name": "Reconcile at check-out.",
    "text": "An unclosed custody chain is the signal."
   }
  ]
 },
 "cta": {
  "title": "Where this fits in Manav",
  "html": "Manav binds the authorising individual to the exact access or release being authorised, and produces a receipt a prime, a government customer or an investigator can verify without access to the contractor's systems.",
  "href": "../docs.html",
  "label": "See access receipts"
 }
}