At some point in most security assessments I run, the access control export lands on my desk and a name on it stops me. It belongs to a contractor whose project ended months ago, sometimes years ago, and the badge is still active. When I bring this to leadership, the usual response is embarrassment followed by a quick deactivation, and the matter is considered closed. I want to persuade you to treat it differently. A terminated contractor’s active badge tells you more about your program than almost any other single finding, and if you only fix the badge you have wasted the lesson.
This is not a rare finding. In the mid-sized organizations I have assessed across my career, it is closer to the rule than the exception, and the executives running them are competent people who would be alarmed if they knew. They do not know because nobody has looked, and nobody has looked because nobody owns the looking. That is the first thing the badge tells you, and it is the most important.
It Tells You Nobody Owns Offboarding
A contractor’s badge exists because three processes touched it. Someone requested it, someone approved it, and someone issued it. For the badge to still be active, a fourth process, the one that removes it, either does not exist or is not connected to the event that should have triggered it. The project ended in the operations department. The invoice was closed in finance. The badge lives in a system administered by IT or facilities. No one of those departments considered the credential its responsibility, and the contract itself probably said nothing about it. The badge is evidence that access is granted by one path and removed by none.
The question to ask is who was supposed to know. If the honest answer is that nobody was assigned, the fix is an owner and a process, and it applies to every contractor, every vendor, and every employee, since the same gap that missed this badge is missing others.
It Tells You the Access List Has Never Been Reviewed
A badge that stays active for months after a contract ends can only survive if no one has compared the credential list against the roster of people who should have access. A quarterly review would have caught it within ninety days. A year-old active badge means at least four review cycles were skipped or never scheduled. And if that one badge was missed, so were the departed employee’s, the former cleaning crew’s, and the temporary access issued for the last renovation. The badge you found is a sample from a population, and the population is the finding.
The practical step is to run the full reconciliation now, deactivate everything that does not match an active person with a current need, and count what you removed. That number is the size of the exposure the organization has been carrying without knowing it, and it belongs in the next briefing to leadership.
It Tells You Your Contracts Are Silent on Security
Look at the contract the badge was issued under. In most cases it says nothing about credentials, nothing about the vendor’s obligation to report staff changes, and nothing about returning badges and keys at the end of the engagement. The organization extended physical access to an outside company with no written terms governing that access, which means the vendor had no obligation to tell you when the person left their employment, let alone when the project ended. The badge may belong to someone who no longer works for the vendor at all, and the vendor has no reason to know or care.
Every contract that involves physical access should include a short security clause covering who may hold credentials, the vendor’s duty to notify you of staff changes within a day, the return of all credentials at contract end, and your right to revoke access at any time. Your legal team can draft it in an afternoon. The badge tells you it has never been asked to.
It Tells You the Doors Trust the System More Than the People Do
Here is a question worth sitting with. If that contractor had walked in last week, would anyone have stopped them? The badge would have worked, so the door would not have. The guard, if there is one, likely recognizes the face from the project and would have waved. The receptionist has no visitor log entry to check against because the person is not a visitor in the system. Every layer of the program deferred to the credential, and the credential was wrong. An active badge in the wrong hands defeats a building that has no other layer of verification, and most buildings have none.
This is where the finding stops being about access control and becomes about the program as a whole. Layers exist so that one failure does not become an entry. If your only layer is the badge reader, you have a lock rather than a program.
It Tells You the Program Has Never Been Tested
The badge was there to be found by anyone who exported the list and read it. Nobody did, because the program was assumed to be working. This is the pattern I wrote Until Tested: Security Is Only Assumed to address, and the P.R.O.O.F. framework exists precisely so that findings like this one surface on your schedule rather than on an intruder’s. A program that is tested regularly finds its own stale badges, its own propped doors, and its own untrained receptionists, and it fixes them quietly. A program that is assumed finds them in the incident report.
So when you find the badge, deactivate it, and then do the rest. Name an owner for access. Run the full reconciliation and put the quarterly review on a calendar. Add the same-day deactivation step to the separation checklist and to the contract close-out process. Put a security clause in every vendor agreement. Then, next quarter, take a deactivated badge to a door and see whether it opens, and watch whether the guard stops the familiar face. The badge was a gift. It showed you exactly where the program is thin before anyone else did.
Go Deeper
Findings like this one are why the first ninety days of a security leadership engagement are spent finding out what is true rather than what is assumed. For a full explanation of that role and how it works on a part-time basis, start with What Is a Fractional Security Director? The Complete Guide. My book Fractional Security Director walks through the assessment process and the disciplines that keep findings like this from recurring.
Commissioner William Epps is a former elected Fire Commissioner, federal law-enforcement supervisor, and firefighter since 2006, with instructor credentials in Hazardous Materials response, Active Shooter preparedness, and Stop the Bleed®. He spent seven years in federal law enforcement in physical security, executive protection, and incident command, and now serves organizations as a Fractional Security Director. He is the author of The Spirit of Saul, The Spirit of Pharaoh, and other practical books on security, leadership, and faith, built around one idea: knowledge should be practical enough to use when it matters.
Leave a Reply