If you operate a data center, you have almost certainly had this happen and may not know it. A contractor finishes a job, leaves the site, and his badge keeps working for weeks. Nobody stole anything. Nobody broke a rule that they knew about. When it finally surfaces, usually during an audit or an access review, every person in the chain can explain why it was not their job to catch it, and every explanation is reasonable. That is the anatomy of a security failure in access revocation, and it is worth walking through slowly, because the fix is in the handoffs rather than in any one person.
I have traced this chain in facilities of every size, and it has the same links every time. The contract ends. The contractor’s employer knows. Procurement closes the purchase order. Nobody tells security. Access control never receives a ticket. The badge stays active. Weeks later someone notices, often by accident. Let me take each link in turn, show you where it breaks, and tell you what a security leader does to make it hold.
The Contract Ends and the Contractor’s Employer Knows First
The first person to know that a contractor no longer needs access is the contractor’s own manager, who works for a different company. That manager reassigns the technician to the next job, updates their own scheduling system, and moves on. From their point of view the engagement is complete. They have no obligation in most contracts to notify your security team, and even when the obligation exists in the paperwork, the person who signed the paperwork is not the person managing the crew. The information exists, in a system you do not own, held by a person who does not think of it as security information.
The fix at this link is to make notification a condition of access rather than a courtesy. When a contractor company is onboarded, the site manager for that company is named in writing as the person responsible for telling your security lead, by a specific channel, within one business day of any crew member finishing or being reassigned. That obligation goes in the master agreement and is reviewed with the site manager in person before the first badge is issued. A leader also gives every contractor credential an expiration date matching the statement of work, so that a silent employer only extends the exposure to the expiration date rather than indefinitely.
Procurement Closes the Purchase Order
The second link is inside your own company. Procurement receives the final invoice, confirms the work was accepted, and closes the purchase order. This is a financial event and it is handled entirely within the finance and procurement system. The person closing the PO is looking at dollars and deliverables, and the fact that the PO was the only reason four people held cage access is not visible on their screen. Procurement has no field for security, no prompt to notify anyone, and no reason to think about badges.
The fix is to connect the two systems, either technically or by procedure. The simplest version is a rule that any purchase order which generated a physical access request cannot be closed until security has confirmed the associated credentials are disabled, and the security confirmation is a required step in the closure workflow. Where the procurement system allows it, a flag on the PO at creation time marks it as access-generating and routes the closure to security automatically. Where it does not, a weekly export of closed POs goes to the security lead, who reconciles it against the contractor credential list by hand. Either way, the closure of the money is now tied to the closure of the door.
Nobody Tells Security
This link is the one people point to when the failure is discovered, and it is the least useful place to assign blame. The project manager who sponsored the access assumed the contractor’s company would handle it. The contractor’s company assumed the project manager would. Procurement never thought about it. Facilities, which often owns the guard force, was never in the loop at all. Security, if there is a named security function, is waiting for a request that no one has been assigned to send. The information about the contract ending is sitting in three places and none of them is the place that can act on it.
A leader fixes this by naming the sponsor as the accountable party for every credential and making that accountability real. The sponsor who requested the access is the sponsor who must request its removal, and the access review process asks that sponsor, by name, to reaffirm every credential they own on a fixed schedule. When a sponsor leaves or changes roles, their sponsored credentials are reassigned or disabled as part of their own offboarding. The point is to create one person who cannot say it was someone else’s job, because it was written down as theirs.
Access Control Never Gets the Ticket and the Badge Stays Active
The access control administrator, who often sits in IT or facilities, is the only person who can actually disable the credential, and they act on tickets. No ticket, no action. From their point of view they did exactly what the process asked. The system shows a valid credential with no expiration and no removal request, and the badge keeps opening the mantrap and the cage door for as long as that remains true. The camera records every entry. Nobody reviews the footage because nothing has been reported. Weeks pass.
A leader fixes this link by changing the default. Credentials for anyone who is not a permanent employee expire on a date and must be actively renewed, so that the absence of a ticket results in a disabled badge rather than a live one. The access control administrator runs a weekly report of credentials that have not been used in a set period and disables them pending sponsor confirmation, because an unused credential belongs to someone who has probably left. And the security lead, rather than the administrator, is the one who owns the report and is measured on what it finds.
Weeks Later Someone Notices
The failure usually ends by accident. An auditor asks for the active credential list and a name looks wrong. A guard recognizes someone who should not be on the floor. A customer asks who entered their cage on a given night. When the operator traces the chain backward, they find every link did what it was designed to do and the design was the failure. The natural response is to add a policy, and the policy will fail the same way because it depends on the same handoffs.
The response that works is to test the chain deliberately. Take a contractor whose engagement is ending this month and follow the notification from their employer, through procurement, to security, to access control, and confirm with a walk to the cage door that the badge is dead within one business day. Then take a badge you know was revoked last quarter and walk it to the same door. If either test fails, you have found your break, and you can fix it before an auditor or an incident finds it for you. The doctrine I built my career on is that security should be tested rather than assumed, which I lay out in Until Tested: Security Is Only Assumed. Access revocation is a chain of assumptions until someone walks it end to end, and that someone has to be a leader with the authority to change every link.
Go Deeper
For a full explanation of how a part-time executive security director fits into an organization like yours, start with What Is a Fractional Security Director? The Complete Guide. My book Fractional Security Director makes the case that most mid-sized organizations have exactly this leadership gap and shows how to close it.
Commissioner William Epps is a former elected Fire Commissioner, federal law-enforcement supervisor, and firefighter since 2006, with instructor credentials in Hazardous Materials response, Active Shooter preparedness, and Stop the Bleed®. He spent seven years in federal law enforcement in physical security, executive protection, and incident command, and now serves organizations as a Fractional Security Director. He is the author of The Spirit of Saul, The Spirit of Pharaoh, and other practical books on security, leadership, and faith, built around one idea: knowledge should be practical enough to use when it matters.
Leave a Reply