Access Control & Visitor Management Checklist
Visitor management is both a security workflow and a data workflow. Device control, SMS reliability, and policy clarity matter as much as the app. This is the checklist 912 uses on property engagements — gate devices, policy table, and the 5-step rollout that keeps reception calm in week two.
Built from real 912 engagements — not generic checklists.
Gate-device readiness — 5 checks
PIN policy, QR integrity window, SMS allocation, network segmentation, and power-plus-LTE fallback so the gate keeps working when the building does not.
Policy table — 6 decisions to write down
SMS allocation, data ownership, support hours, biometric scope, retention period, incident handover. Each with an owner and a clean decision.
5-step rollout sequence
Walk the site, provision network/power, train reception, enrol staff, review the evidence at day 14.
Off-boarding checklist
Five things to do on the day a vendor exits — visitor-log export, template deletion, PIN rotation, SMS reconciliation, access revocation.
ODPC-aware data handling
Retention windows, consent records, deletion-on-off-boarding, and the export rights that keep the property in control of its data.
What you get
A practical checklist for visitor devices, QR integrity, SMS workflows, support scope, access policies, and data ownership.
Files delivered
No download required — use the complete resource on this page.
Next action
Use the resource, then review the related service path: /services/access-control.
Device readiness
Five gate-device checks before staff go live.
The visitor-management app is the easy part. The hard part is the device sitting at the gate, the network behind it, and the SMS gateway that has to deliver during peak.
Gate-device PIN policy
The visitor-management terminal at the gate carries an admin PIN. Rotate on installation, after staff turnover, and quarterly. Document who holds it in the property runbook — never a shared sticky note.
QR-pass integrity window
Pre-issued QR passes expire at a defined window — typically the visit calendar day, not "any time". Confirm the system enforces expiry; an indefinite QR is an indefinite pass.
SMS allocation per host
Visitor SMS bundles run out. Confirm the contract states the monthly SMS allocation, the overflow rate, and the dashboard that shows current consumption. Failed SMS is failed access.
Network segmentation for the terminal
Gate devices belong on a dedicated VLAN with outbound-only egress to the vendor cloud. Never on the user LAN; never on the CCTV VLAN; never on guest Wi-Fi.
Power and connectivity fallback
A 30-minute UPS for the terminal plus an LTE failover on the gate router. A power blip should not become a visitor queue at reception.
Policy table
Six decisions to write down before the contract is signed.
Every row below is a place a vendor SLA usually goes vague. Pick the wording you want, name an owner, and lock the decision into the contract or its appendix.
| Decision | Sample wording | Owner |
|---|---|---|
| SMS allocation | 500 visitor SMS per month included; KES 1.50 per overflow SMS billed monthly. | Operations + vendor |
| Data ownership | Visitor logs owned by the property; vendor processes only. Export available on request and on contract exit. | Operations + legal |
| Support hours | Vendor responds Mon-Fri 08:00-17:00 EAT for Severity 2/3. Severity 1 access-loss handled 24x7 via documented escalation. | Vendor SLA |
| Biometric enrolment scope | Staff and recurring contractors enrolled; visitors stay on QR/SMS path. Biometric template stored in-country, encrypted at rest. | IT + operations |
| Retention period | Visitor logs retained 90 days; biometric templates retained for active staff only, deleted on off-boarding within 7 days. | Operations + ODPC |
| Incident handover | On an incident, security supervisor can request log export within 24 hours via the documented contact; chain-of-custody logged in the ticket. | Security supervisor |
Rollout sequence
The 14-day rollout 912 uses on property engagements.
Walk the site with the property manager
Map the gates, reception points, lifts, parking, and after-hours entrances. Tag which need visitor management, which need biometric access, and which need both. Photograph each device location.
Provision the network and power story
Stand up the dedicated VLAN, the LTE failover, and the UPS before any terminal lands on site. Test failover before staff training.
Train reception and security
A 2-hour handover covers QR scanning, walk-in registration, SMS retries, evacuation override, and the gate-device PIN. Sign-off sheet stays on file.
Enrol staff biometrics
Schedule enrolment windows by floor or department. Capture two fingers and one face template per person; document the consent record per ODPC guidance.
Run a 14-day evidence review
After two weeks of live use, pull the visitor log, the SMS-consumption report, and the access-denial events. Tune the policy where reception is queueing or denials are spiking.
Off-boarding
Five things to do the day a vendor exits.
Ready to talk about this in context for your business?
Schedule a strategy call