How Can We Create a Visitor Policy to Protect Confidential Information? Seeking Advice from Senior Management

We are in the reality business, and our visitors include clients (potential customers), service providers such as electricians, computer vendors, ex-employees, site employees, etc. It has come to our attention that ex-employees and electricians, while visiting our office, are accessing all areas, which should not be the case. Therefore, I am seeking to establish a specific visitor policy to prevent them from moving around freely and safeguard our confidential information.

Objective of the Visitor Policy

The primary objective of creating such a policy is to ensure the protection of the company's confidential information. I have searched on Google and the HR website but did not find a relevant visitor policy or email template that aligns with our requirements. Hence, I kindly request our senior management to share any existing policies or emails they have in place to regulate visitor access to restricted areas, particularly those involving sensitive information.

Your insights on this matter would be greatly appreciated as I am currently in a practical learning phase. Thank you in advance.

Visitor Management and Office Security

How big is your office? What kind of confidential information do you possess that can be seen by visitors? I would suggest earmarking a proper reception and meeting place for visitors and clients. When a visitor comes to meet Executive "X," the receptionist should ask the visitor to sit and inform X about the arrival of the visitor. Offices and areas where you don't want visitors should be segregated and marked only for staff, and visitors should be politely redirected. Your entry guard should be smart enough to guide people properly to the place they need to go. Proper briefing of the receptionist and guard regarding visitor policy, visiting hours, places they are not allowed to go, and how to handle visitors in a friendly but firm manner is essential.

Hi, if you have a Security Post at the entrance, you can ask the security officer to stop entering ex-employees. That is one of the simple steps you can take.

In addition to that, you can issue an Office Memo to present employees regarding ex-employees' visits to the site. So that they know what to do once they resign or are removed from the service.

I feel such advice is inappropriate. The company must maintain good relations with all stakeholders, which definitely includes ex-employees as well. Mark out your areas that are out of bounds and brief your guards accordingly, as well as all staff. Keep commercially important information secure. If just by walking in, the information can be found out, then revise your way of working and the positioning of such offices.

Access Control for Existing Employees

You can provide access cards only to existing employees. These systems can be programmed in such a way that your own employees, if they are not associated with a particular department, can be denied entry. For instance, access to the server room is restricted to the IT in-charge and the Admin in-charge for cleaning and maintenance purposes. Other employees are not allowed to enter the server room. Utilize technology effectively; access can be granted through smart cards, thumb impression control, iris control, etc.

Best wishes

Creating a Reception Area for Controlled Access

The reception area is meant for this very purpose—to bring some semblance of decorum and system into any company's operations. If you don't have one, suggest creating a separate reception area that's right in front of the entrance, and everyone, including the MD/CEO, will have to cross it to enter the office premises. The receptionist will have to be given clear instructions regarding whom to allow inside and under whose orders.

Benefits of Meeting Rooms Near Reception

Many offices have meeting rooms just adjacent to the reception for client meetings with any official(s) of the company. This way, even the clients don't have a reason to cross a red line. Such meeting rooms also have another advantage—they reduce distraction during meetings and have a different ambiance. In some companies, sometimes even the MD/CEO comes to this meeting room for client meetings, though it's up to him/her.

Communicating Changes to Employees

More importantly, once the changes are put in place, send a common circular/email to all employees about the changes to ensure there are no arguments at the reception—quite often, this happens when changes leading to disruption of easy-going past practices are put into place. This covers the receptionist who can take a firm stand whenever any employee acts as if he/she owns the office due to earlier habits—after all, 'habits die hard.'

Ensuring Confidentiality and Security

Now when these practices are put into place, please don't presume all your confidential info is safe—it may or may not be. When anyone is bent on stealing info, he/she will find a way to do it—possibly when none is around (remember the Government of India finding copies of files being given to corporates through consultants a few months back in Delhi?)—and this is your prime concern.

Implementing Additional Security Measures

One way to handle this aspect after the outside perimeter is handled—reception entry/exit—is to have CCTVs at vantage points within the office. There are new models that don't need DVRs that have come into the market—though I can't vouch for how good they are. They operate on WiFi, enabling one to watch the footage from anywhere on the globe.

All said and done, a lot depends on how the easy-going culture is finally changed among the employees. Since, however good the facilities or rules are, at the end of the day, it's the people who need to follow them. Some amount of hinting of the consequences on what would happen if anyone tries to give the rules a miss may also be needed—but only when you find things are that bad.

All the best.

Regards,
TS