If you run a data center, there is a badge in your access control system right now that belongs to a contractor whose work ended months ago, and it still opens doors. I say that with confidence because I have never audited a facility where it was not true. It is the single most common finding when I review an operator’s access records, and it is worth walking through exactly what happens when a terminated contractor’s badge still works, step by step, because the failure is never one person’s mistake. It is a handoff that nobody designed.
The reason this matters more in a data center than in an office building is the depth of the access. A contractor badge in your facility was likely provisioned for the lobby, the mantrap, a data hall, and possibly a specific cage, because that is where the work was. When that badge outlives the contract, the person holding it retains a path to your customers’ hardware that most of your own employees do not have. This article is about how that path stays open, and how to close it.
Anatomy of the Failure
The contract ends. Sometimes it ends cleanly on a date written in the agreement, and sometimes it ends because the project finished early, the vendor was replaced, or the technician was let go by his own employer. In every version of this, the ending is known to someone: the project manager, the procurement team, or the contractor’s employer. It is almost never known to whoever administers your access control system, because nobody’s process includes telling them.
Nobody notifies security. Procurement closes the purchase order and considers the matter finished. The project manager moves on to the next job and assumes the badge was handled when the contract closed, or does not think about the badge at all. The contractor’s employer, if they even know the technician is gone, has no obligation in the contract to tell you and no habit of doing it. The technician may still have the badge in a truck, a jacket pocket, or a drawer at home. Each party did their part as they understood it, and the credential fell through the space between them.
The badge stays active. Your access control system does not know the contract ended, because it was never told. The credential was issued without an expiration date, or with one set so far out that it was effectively permanent, because the requester did not know how long the work would take and chose the safe answer. Nobody runs a regular review comparing active credentials against active contracts, so there is no point at which the discrepancy would surface on its own. Months pass. Sometimes years.
The door still opens. If the former contractor returns, for any reason at all, the reader accepts the badge and the guard sees a familiar face carrying a familiar credential. If the badge was lost or passed to someone else, the reader accepts it just the same. The mantrap works exactly as designed. The layered perimeter works exactly as designed. Every control functions, and the facility is open to a person who should not be there, because the one control that mattered, the decision to revoke, was never made.
Why the Handoff Fails
Three organizations touch a contractor’s access, and none of them owns the end of it. Procurement owns the contract but not the credential. The contractor’s employer owns the person but not your building. Access control owns the credential but has no visibility into the contract or the person. The handoff between them has to be designed on purpose, and in a mid-sized operator without a physical security leader, nobody has the standing to design it. The access administrator cannot compel procurement to add a step. Procurement does not know the step is missing. So the gap persists through audit after audit, because auditors ask whether you have a revocation process and you do, in a policy, and nobody tests whether it fires.
Fixing the Handoff
Start with the credential itself. Every contractor badge must carry an expiration date set at issuance, and that date must be short, measured in weeks, with extension available on request from a named owner in your organization. This one change converts the failure from something that requires someone to remember into something that requires someone to act, and access that has to be actively renewed does not drift. When the contract’s end date is known, set the expiration to match. When it is not, set it to thirty days and let the project manager renew it as often as the work requires.
Next, fix procurement. Closing a contract or a purchase order that involved facility access should automatically generate a notification to access control, in the same way that a new contract generates a request for access. Make it a required field in the closure process rather than a courtesy email. If your procurement system cannot do that, a shared list that procurement updates on closure and access control reviews weekly will do the job until it can. The point is that the end of the contract and the end of the access become the same event.
Then fix the contractor’s employer. Put language in every vendor agreement that requires the vendor to notify you within one business day when any individual with credentials to your facility is reassigned, resigns, or is terminated, and to return the physical badge within a defined period. Enforce it by asking each vendor quarterly for a current roster of everyone they have on your site and comparing that roster against your badge list. The first time you do this you will find names on your list that the vendor does not recognize. Deactivate them that day.
Finally, put someone in charge of the whole chain. The reason this handoff fails is that it crosses three organizations and nobody owns the crossing. A physical security leader with executive standing, whether full-time or fractional, owns it by definition. That person runs the quarterly access review, holds procurement and the vendors to the process, and tests it by picking a closed contract at random and checking whether the badges tied to it are dead. The doctrine I lay out in Until Tested: Security Is Only Assumed is that a revocation process you have never tested is a process you are assuming, and the door does not care what you assume.
What to Do Today
Before you build any of the above, run the audit. Export every active credential from your access control system, isolate the ones issued to contractors and vendors, and match each one against a current contract and a current roster from the vendor. Any credential that fails either check gets deactivated now and investigated later. In my experience the number that fails is large enough to change how leadership thinks about the problem, and that is the point. The badge that still works is the leadership gap made visible, and once you have seen it you cannot go back to assuming.
Go Deeper
For a full explanation of how a part-time executive security director takes ownership of access control and the rest of the physical program, start with What Is a Fractional Security Director? The Complete Guide. My book Fractional Security Director makes the case that most mid-sized organizations have a security leadership gap and shows how to close it.
Commissioner William Epps is a former elected Fire Commissioner, federal law-enforcement supervisor, and firefighter since 2006, with instructor credentials in Hazardous Materials response, Active Shooter preparedness, and Stop the Bleed®. He spent seven years in federal law enforcement in physical security, executive protection, and incident command, and now serves organizations as a Fractional Security Director. He is the author of The Spirit of Saul, The Spirit of Pharaoh, and other practical books on security, leadership, and faith, built around one idea: knowledge should be practical enough to use when it matters.
Leave a Reply