A research building is the hardest kind of campus space to secure, and access control for labs and hazardous materials on campus is where most universities are weakest. Labs hold chemicals, biological materials, expensive equipment, and years of unpublished work. They are also staffed by people who come and go at every hour, change every semester, and are rewarded for working independently. The culture of open inquiry that makes a university great collides with the discipline that dangerous materials demand.
I look at this problem as a firefighter and a hazardous materials instructor first, and as a security professional second. That order matters. The first question I ask about a lab door is not who might steal something. It is what happens to the people in the building if something goes wrong there, and who needs to know what is inside.
The fire and HazMat view of a lab door
Responders arrive at a lab building with limited information and unlimited risk. They need to know what is stored, where, and in what quantity. They need to get to it, which means access control cannot become an obstacle to a fire crew. They also need the building to be controlled enough that untrained people are not wandering through a chemical storage area while an incident develops.
This is why security and environmental health and safety must work as one function in these buildings. Federal workplace safety rules for laboratories use a chemical hygiene plan to govern how hazardous chemicals are handled, and universities typically assign that responsibility to a safety office. The access system should support that plan. Chemical storage rooms should be limited to trained people, door signage and inventories should be current, and responders should have a reliable way to enter and to learn what they face. Confirm your obligations with your safety office and counsel, because rules vary by material, state, and institution.
A short, consistent rule helps: the more dangerous the material, the smaller the list of people who can reach it and the more complete the record of who did.
People are the real variable
Doors are easy. People are hard. A research building has a rotating population: faculty, postdoctoral researchers, graduate students, undergraduates doing lab work, technicians, visiting scholars, and sometimes collaborators from other institutions or industry. Their access needs are real and they change constantly. A graduate student finishes and leaves. A visiting scholar arrives for six months. A rotation student works in three labs in a year.
The common failure is that access is granted quickly and removed slowly or never. A principal investigator signs a form to get a student into the lab, and no one signs a form to take the student out. After a few years the credential list for a building no longer resembles the people actually working there. Some of those credentials open rooms containing hazardous materials or valuable intellectual property.
Make the principal investigator accountable. The person who requests access for a lab member should also own the review of that access, on a schedule, and should be required to confirm or remove each person. Connect the credential to the student or employment record, so that when someone graduates or leaves, access ends automatically unless it is renewed. For visiting scholars, set a start date, an end date, an escort or sponsor, and the specific rooms they may enter, rather than treating them like faculty.
Research security is also a people question
Universities increasingly face expectations from funders and governments about protecting research. Those expectations vary and change, and your research compliance office and counsel should lead on them. From a physical and personnel perspective, the basics are consistent. Know who has access to sensitive projects. Limit access to what each person needs. Control the spaces where sensitive data and equipment live, and log who enters them. Be especially careful with access for people whose affiliation or sponsor is unclear.
I would add a caution. Insider risk in research settings is rarely dramatic. It is a copied file, a borrowed credential, a door left open for a colleague, or a departing researcher who still has a working card. Good access control reduces these quiet exposures, and it does so without treating every scholar as a suspect. Leaders should set the tone: the controls protect the work and the people, and they apply to everyone.
Balance security with the way labs actually work
Experiments run overnight. Cell cultures cannot wait for business hours. Researchers work odd schedules, and a policy that makes after-hours access difficult will be defeated. Design for it. Allow after-hours access by credential rather than by key, but require that people working alone follow a safety practice, such as notifying someone or checking in, appropriate to the hazard. Place readers so that a person carrying materials is not tempted to wedge a door. Provide a clear process for deliveries, because loading areas and shared corridors are where doors tend to stay open.
Listen to the researchers. They know which doors are inconvenient and why. A control they understand and helped shape will survive. A control imposed without explanation will be propped open within a month.
Test the lab, the list, and the response
Security is only assumed until it is tested. For labs, three tests are worth running every term. First, test the list: pick a research building, pull its credential holders, and have each principal investigator confirm the names. The discrepancies are your findings. Second, test the doors: check that storage rooms and sensitive spaces actually lock, that held-open alarms are working, and that access to chemical storage matches the training records. Third, test the response: run a tabletop exercise with public safety, environmental health and safety, the local fire department, and research leadership. Walk through a spill, a fire, or a suspicious package in a lab building and see whether everyone knows what information responders need and how they will get it.
Invite your local fire and emergency services to walk the building before an incident. Responders who have seen the layout make better decisions under pressure, and the walk often reveals simple fixes: a missing sign, an unlabeled room, a door that cannot be opened from the outside by the people who need to.
Who owns it
Lab access sits among public safety, environmental health and safety, facilities, research administration, and individual departments. That is too many hands. Assign one executive, often the vice president for research or an equivalent, to be accountable for the outcome, and require a regular report on credential reviews, hazardous storage access, and test results. Give principal investigators clear duties and the support to carry them out.
A university does not have to choose between open inquiry and controlled access. It has to know, at any moment, who can reach what and why. That is a discipline, and it can be learned.
Go Deeper
Bridging safety, security, and research administration is the kind of cross-department work that benefits from an outside senior view. What Is a Fractional Security Director? The Complete Guide describes the role, and Fractional Security Director gives the full framework.
Commissioner William Epps is a former elected Fire Commissioner, federal law-enforcement supervisor, and firefighter since 2006, with instructor credentials in Hazardous Materials response, Active Shooter preparedness, and Stop the Bleed®. He spent seven years in federal law enforcement in physical security, executive protection, and incident command, and now serves organizations as a Fractional Security Director. He is the author of The Spirit of Saul, The Spirit of Pharaoh, and other practical books on security, leadership, and faith, built around one idea: knowledge should be practical enough to use when it matters.
Leave a Reply