printer friendly version

Managing visitors and contractors

Accessing gated communities and campuses, be it business, government or residential, has become a key point for newer access control technologies. But while it’s relatively simple to grant access to residents, employees, students and people who need to be on site every day, visitors and contractors are a different matter.

Visitors to restricted areas need to be given access quickly, but not without some form of security beyond the infamous ‘visitors’ book’. Many companies have developed electronic access systems, ranging from simple intercom solutions that expect someone to allow people access and take responsibility for them, through to more complex systems that capture identity information of visitors – some requiring pre-registration.

Hi-Tech Security Solutions investigates what solutions there are for visitor management, how they work and how easily they slot into the security processes of business parks, residential estates etc.

When considering what the optimal method/process of managing visitors to a location is, there are naturally many different opinions. GateBook’s MD, Grant Hancock says we need to balance security against convenience and the hassle factor. “It’s possible to implement a highly secure solution today that falls over in a few months, not because the technology fails, but because the implementation is too onerous to the operator or too inconvenient to residents.”

He says the process of pre-authorisation, ensuring the person is meant to be coming onto site at that time, scanning of a driver’s licence in order to capture accurate identity details, and scanning the vehicle licence to capture the registration number as well as make and model of the car, is a good start.

“It is, however, important to note that different sites may want something a little different. A logistics company may want to scan the barcode on the security seals of all the vehicles leaving their site, or another company may want to capture the odometer reading of all their internal fleet vehicles whenever they are leaving,” he says. “The flexibility of the solution is therefore also important.”

Mark Paynter.

Mark Paynter, head of business development at Ideco, expands on this, noting that visitors should be recorded in a manner which is quick and simple so that the process is optimised and efficient with minimal delays for visitors and minimal complications for the guards. The process also should process and record visitor information in a PoPI-compliant manner.

Over many years of piloting various electronic visitor management solutions, he says Ideco has found the following to be the simplest, yet most reliable:

• A battery powered handheld mobile scanner which can read vehicle licence discs, drivers’ cards and which can also ask customised questions.

• The scanner should incorporate a way to record proof that the visitor has given permission for their details to be recorded and stored for health and safety compliance. This can be done using a fingerprint as a digital signature as well as a traditional signature on the touch screen of the device.

• The scanner should be able to store information in offline mode so that in the event of connectivity downtime it can continue operating.

• The system should offer live ID checking to ensure accurate visitor screening and to deter fraud.

• Information should be stored in a managed PoPI-compliant environment – preferably in the cloud.

• Visitor information should be readily available in a searchable and indexed format, to authorised management, via a readily

available web portal interface or mobile app.

• For health and safety purposes the system should offer the ability to quickly check how many visitors are on the site at any given time.

• The system should record a visitor’s mobile phone number so that visitors are easily contactable in the event of an emergency.

• It should offer the ability for authorised personnel to ‘prebook’ selected visitors online so that they can be processed with minimal delays at entry to the premises.

• The system should offer the ability to blacklist or flag unwanted and high-risk visitors in real time to minimise the potential security risks to the organisation.

• The device should be robust, yet easy to use.

Access control integration

John Powell.

According to John Powell, CEO of Powell Tronics, the methods of controlling access to residential estates and business parks are very similar. They should ideally be undertaken with a system that checks and records the credentials of any person entering the premises. The details of the vehicle being driven also needs to be linked to the driver. This can be done via several commercially available systems. However, for this to be effective, linking this to the estate’s access control system being used by the residents is a huge advantage. “Linking the vehicle and driver to the person or company being visited is first prize.”

When the person being visited can register a visitor online and a one-time PAC (personal access code) sent to the visitor in advance, it speeds the system up tremendously as the guard does not have to make a call to confirm that the visitor is expected or should be allowed access. This PAC code should allow for one entry and one exit only and should have an expiry date, for example, 24 hours, or in the case of a contractor, for the period of the contract.

Keep it simple

It will not surprise anybody to hear that South Africa’s guarding community is not the best trained in the world. While there are companies that invest heavily in their security personnel, there are still those that only do the minimum, leaving customers with a problem. When implementing an electronic visitor management system, it must be easy enough for anyone to use, yet it must also have certain security functionality to ensure the information collected is accurate and stored safely.

“We are handing over one of the most important functions of our security to guards that may not be very technology savvy,” notes Hancock. “Not only that, but when there is a shift change or a guard is swapped out for the night, it must be easy for the new guard to pick up where the previous one left off.

“The key is to keep things simple and have a clean step-by-step process for the guard to follow. Keep each page clear and uncluttered for the guard to follow only a simple instruction. GateBook follows this philosophy in all its software, it is made very clean and clear at the user end, and all the intelligence is handled in the cloud and behind the scenes.”

Training is key to making any system work, says Powell. “Even with the visitors’ book, one needs to have a literate guard in place. Since there is often a high turnover of guards, it is essential that the security manager responsible for the estate, business park or educational institution is properly trained in all aspects of the system being used. They can then train new personnel as and when required.

“Most of the electronic systems are menu driven and are not difficult to use. If the guard is capable of writing details down in a book and issuing a temporary visitor card, they can also be trained to use an electronic visitor system.”

Paynter boasts that in surveys done on 100 security guards, Ideco found that they prefer the EVIM device to the traditional visitors’ book.

“This is not only because it is quicker than the manual paper based process, but also because it empowers them with accurate real-time information and because it accurately records details.

“Anyone who can push a button can use the EVIM solution. It is simple and easy to use and the process is based on barcode scanning which requires minimal IT capability and which leaves virtually no room for error.”

Preparing for PoPI

It should be common practice that a company holding personal information, such as identity data, should automatically have the processes in place to keep this information secure. For those that do not, the PoPI Act (Protection of Personal Information Act) will soon make it a legal necessity.

Many people assume PoPI refers only to data collected electronically via licence scanners and similar devices. The reality is even the old visitors’ book is a source of personal information, assuming visitors enter their details correctly, and needs to be handled with the appropriate care.

Powell explains that it is important to make use of PoPI-compliant security companies and systems. Stringent regulations and processes are required to safeguard the information gathered. Since identity theft is rife, this information must be stored securely.

“PoPI requires that all reasonable steps are taken to store this information securely, and that only the relevant information is stored and only utilised for the purpose for which it was obtained and that it is only stored for as long as required/stipulated in the sites rights of entry,” Powell says. “It is essential that access to this information is password protected and access to this information is only available to those that require access, such as security managers and or approved members of the body corporate.

“A necessary rider is that access to this information is available only when it is required for security purposes, for instance, when an incident has occurred. The best place to store the information is in the access control database, in compliance with the PoPI Act rather than in the cloud, where erratic connectivity in South Africa is common place.”

Paynter adds that proof of user consent is vital. Electronic systems that record visitor details without proof of consent are not PoPI compliant. He adds that a biometric reader or a digital signature pad/screen is the best way to secure proof of visitor consent.

Companies or residential bodies are responsible for compliance and can be held accountable in the event of non-compliance. This is why it is vital to choose a visitor management solution that is designed around the PoPI Act. “Many systems casually claim to be PoPI compliant when in reality they are not. Anyone recording and managing visitors’ personal details is also required by law to notify the Information Protection Regulator of all information processed.”

Hancock says that GateBook does not keep transactions stored on its devices. As soon as the scan is completed, the transaction and information is sent to and stored on its remote servers. “Our server and cloud solution have the strictest security policy to ensure compliance with the Act. We also make sure that all individuals on the estate that have access to the data understand that they can use this data for security reasons relating to the site, but can not pass this information on.”

Product focus: GateBook

Describing what GateBook offers to the market, Hancock says, “GateBook offers a complete visitor and contractor management solution, our modular approach means that we can treat our visitors differently to contractors, or even deliveries, and this can be operated completely independently of any other access control system onsite. What’s more is there is no requirement for a costly server to be installed and maintained on site, which makes the GateBook solution very quick and easy to implement. We have also created a number of modules for our devices to handle the integration into onsite access control such as the Impro system.

Product focus: PT-Guest

PT-Guest is a programme designed and developed by Powell Tronics for the management and control of visitor and contractor access to estates and business parks. It uses an Internet to GSM service to request a PAC (personal access code) via a registered/authorised person from the access control database. The code is requested by means of an SMS containing a short code (for example, 31171) with the visitor details.

A random four-digit code will be sent back via SMS to the registered/authorised person requesting the PAC and this can then be forwarded to the visitor. PT-Guest also accommodates a web interface login on an intranet environment. Registered/authorised persons log in via e-mail and request a single or multiple PACs which will be sent via e-mail, which they can in turn send to their guests.

“These solutions obtain the best functionality, value add and ROI for sites when there is an experienced team of professionals with a track record of successful visitor management installations working together to ensure that all the expectations of the customer are met,” concludes Powell.

Product focus: EVIM

Ideco offers the EVIM solution which is a rugged handheld mobile device supported by a comprehensive backend solution, which offers a PoPI-complaint visitor management solution. EVIM offers a combination of PoPI compliancy, live identity checking, biometric recording of visitors’ as well as the visitor welcome and notification SMS in one system.

“Because EVIM is a hosted solution we work with EVIM SCPPs (Specialised Crime Prevention Partners) to maintain a dynamic comprehensive national ‘flagging’ system for high-risk identities of vehicles and persons,” states Paynter. “This means that if a listed high-risk vehicle enters an EVIM-secured property, it would be flagged with the relevant law enforcement agencies and authorities notified automatically. This greatly reduces the risk to your site.”

User companies can also locally blacklist or flag people who are banned from their property. In the event of an emergency, EVIM has the ability to do a live ‘roll call’ to verify exactly how many visitors are on site at a given time.

The EVIM SDK offers a web feed service which gives software OEMs the ability to integrate visitor data with their access control, ERP or other in-house systems. It also offers visitor analytics so clients can see their visitor traffic patterns as well as their entry point patterns.

EVIM also stores visitor contact details which helps streamline emergency evacuation contact procedures and in future versions will offer ‘visitor broadcast’ functionality whereby a host can broadcast an emergency SMS to all onsite visitors at the click of a button.

For more information:

GateBook: www.gatebook.co.za

Ideco: www.ideco.co.za

Powell Tronics: www.p-tron.com

Share this article:

Further reading: