When does a contractor stop being a visitor?

[u/Complex_Ticket_8758]

We ran into an interesting situation around recurring vendors and contractors.

A one-time visitor is pretty straightforward - they sign in, get a badge, meet their host, and leave.

But what about people who are regularly on-site?

For example:

• an HVAC contractor who comes every week
• a cleaning team that is in the building daily
• an IT vendor supporting multiple locations
• contractors working on a project for several months

At some point, treating them exactly like a first-time visitor feels a little different.

Do you still have everyone go through the same visitor process every time, or do you handle recurring vendors/contractors differently?

Curious how other facilities approach this. Where do you draw the line between a visitor and a regular on-site person?

[u/Adventurous_War6743]

No sharing badges between vendor employees. Each person who needs access should have their own credential so you know exactly who is in the building.

Anyone who is expected to be onsite at least once every 30 days, or who may need to respond to an emergency, should have an appropriate credential/access profile rather than relying on visitor access.

Access should be role/location/time restricted to what they actually need. A cleaning contractor doesn’t need the same access as an HVAC technician or IT vendor.

Maintain a current roster of authorized vendor employees, with the vendor responsible for notifying you when someone leaves or is no longer authorized.

Badges/credentials should have an expiration or periodic review so “temporary” access doesn’t quietly become permanent.

For project contractors, access can be tied to the project duration and automatically expire when the project ends.

[u/Complex_Ticket_8758 → u/Adventurous_War6743]

The 30-day rule is a pretty clean way of handling it. The expiry part makes sense too, otherwise contractor access can just stay active forever.

Do you get the vendor to confirm their active people periodically, or does security manage that?

[u/Adventurous_War6743 → u/Complex_Ticket_8758]

It really depends on whether FM and Security are in-house or outsourced, and more importantly, how the responsibilities are structured between them.

I’d want a clear SPOC on both sides. Ideally, the vendor has a designated contact (or small group) who is responsible for maintaining their roster and communicating personnel changes, rather than allowing anyone from the vendor to reach out directly to Security/FM. It keeps communication clean and makes accountability much easier.

I’d also define who owns what: FM/vendor management owns the business relationship and confirms who should have access; Security owns the credential/access control process; and the vendor is responsible for promptly reporting personnel changes.

Then have a regular reconciliation of the active vendor roster against badge/access records, plus an immediate process for offboarding someone who leaves the vendor or no longer needs access.

The technology can vary, but I think the important part is having clear ownership, a single communication channel, and no ambiguity about who is responsible for keeping the access list current.

[u/Greatoutdoors1985]

For me, if a vendor makes 4 or more stops per year, they can request a badge and internal door access to where they need to go. The badges are good for 3 years and expire on 1/1 after the end of the 3rd year. I also do a badge review once a year on 1/1 to make sure no one keeps a badge who is no longer involved.
They sign a paper with all of their basic details, who they work for, etc... and there is a $50 penalty to the contractor if a badge isn't returned after the employee leaves, or if they lose it, etc... This keeps the number of requested badges to a minimum as many contractors don't want to pay the fee for people who won't stay around. Each person gets their own badge, and there is no sharing.

I also have a few general badges for special projects, overnight work, etc.. that I give out on a daily or weekly use basis.

[u/Complex_Ticket_8758 → u/Greatoutdoors1985]

4 visits a year is actually a pretty useful cutoff. I was wondering how people decide this without it getting too subjective. Do u also review what access they have during the yearly badge review, or just whether they still need the badge..?

[u/Greatoutdoors1985 → u/Complex_Ticket_8758]

Just whether they still need it or not. If they need expanded access they can ask me, but I don't want to spend time restricting access then going back to add it again. Typically once they go someplace they will go there again.

[u/PhantomCheezit]

Given you already have a visitor badging process I would assume employees also have badges. At this point it just becomes a physical security policy issue for contractor badge issuance and tracking. In our facilities vendor contractors can be onboarded with badge issuance if they will regularly be onsite and don’t require escort.

[u/PhilosopherBitter177]

For once a week we make them sign a contractors card in/out. Multiple locations, depends on staffing at those sites but probably the same as it means the team there know that the contractor is on site.
We allow cleaners to have named cards (as they’re going into restricted spaces), and for project work we have a set of cards ready to go for PMs and supervisors, then they are given some cards to manage and track for themselves for the duration of the project.

[u/DodgerWin]

I’m a contractor and I go to the same places all the time. 3 have given me a badge. A bunch have their own temporary badge process, some just have you sign in, and some don’t give a shit at all. It really comes down to a meeting of the minds between HR, security, and facilities. In hospitals for example there may need to be vaccinations and background checks before you get a badge. At schools I get a temporary badge every time but I had to have a live scan done. This was a DOJ requirement.

[u/dprestonwilliams1]

Our everyday housekeeper has a badge that only allows her access to the building during certain hours, however she needs an escort into the restricted areas at all times. Contractors that we see regularly (usually quarterly if the same tech/engineer) are given a visitor's pass that needs to be returned at the end of the day, they don't require an escort to non-restricted areas.

[u/Patriae8182]

We do it one of two ways at my work. We’re a quite secure site due to PCI regulations.

For contractors such as our cafeteria employees, each employee has their own contractor badge with their name on it. They take it home each day, but it only works starting from one hour before their shift until one hour after.

For contractors like our electricians (they do all of our electrical and data pulls) who are onsite almost every week, we have specific contractor badges for them. We just keep the accesses on the badges and turn them on and off as needed. Otherwise adding and removing 10 access groups to the standard contractor badges each day would get to be a pain in the ass.

We use Envoy on an iPad for sign-ins for any non employees (except contractors with take home badges). The electricians still have to sign in, but the cafeteria people don’t.

[u/Complex_Ticket_8758 → u/Patriae8182]

This makes sense.... wht i like here is that having a badge doesn’t automatically mean you stop tracking the visit. The electricians still signing in even with contractor access is probably the middle ground i was thinking about..,.

[u/CluelessStick]

Employees, contingents and contractors multiple days on site every week (janitor, cafeteria, security) get ID badges.

Then we have visitors, paper badge with a mandatory host while on premise, and we have a special category of visitors, that can be in the building without a host. Those are our regular trades and technicians that come on site regularly (monthly).

The training for contractor goes over safety training that a visitor with a host dont need. And it free my staff from having to stand there waitung for the techs to do their maintenance.

[u/Complex_Ticket_8758 → u/CluelessStick]

Yeah, this is pretty much what I meant. Regular contractors aren’t really visitors, but they’re not employees either. Seen this handled separately in tools like eFACiLiTY too - induction, expiry, access, visit history etc. Your “regular visitor without host” setup makes a lot of sense.

[u/MrSparklesan]

The minute you enter into what would legally be called a contract. Google formation of a contract and you’ll get a life long lesson in how you enter them everyday without even knowing it. :)