Facility executives often find that the guardians of an organization’s checkbooks are skeptical about requests for security and access control upgrades. That’s because they’re not easy to justify in strictly financial terms. But conveying to management exactly why an upgrade should take place is of utmost importance.
As facility executives at one health care organization realized, the cost of a security system upgrade can be justified in many ways. Union Memorial Hospital, located just outside Baltimore, hasn’t experienced any serious security breaches, says Neil MacDonald, vice president of operations. Nonetheless, earlier this year, hospital management decided it was time for a security upgrade.
Several factors prompted their decision. First and foremost was ensuring a safe environment for both patients and staff. Many patients drive past several hospitals on their way to Union Memorial, MacDonald says. “We need everyone to feel that they’re coming to a safe environment.” In addition, the hospital’s workforce is largely female, and due to the 24/7 nature of a hospital, employees come and go at all hours of the day and night. Management wanted to ensure their safety, as well.
Another reason for the upgrade was that the previous technology, a time-lapse recorder that used videotape, was outdated and difficult to use. If an incident occurred, reviewing the tapes required a security employee to review multiple tapes for hours to determine whether the time-lapse recorder captured an image that was usable. The poor quality of the tape made the review process even more difficult.
The new system uses digital recording. “Retrieval of information will be as simple as keying in a date and time for a specific camera,” MacDonald says. In addition, a future project is to link the new system with the time and attendance system. Employees coming to work will use their badges to enter the facility, which will also let the time and attendance system know that they’re now on the job.
The new system also allows an operator located within the facility to monitor the security systems installed in other hospitals within the Medstar Health network — a seven-member network of which Union Memorial is part.
Newer technology almost always enhances the safety of the facility. That can help attract both employees and tenants. Depending on the age of the current access control system, a newer one may be more efficient to run and operate, and easier for employees to use. In addition, many newer systems provide improved audit trails, should a security incident occur.
However, facility executives often find that top management is reluctant to fund security, says Shayne Bates of Koffel Associates. Employers do usually have a genuine desire to protect their employees and clients, but facility executives often fail to effectively convey to management the limitations of the current system and the reasons a security upgrade is necessary.
As a starting point, deciding whether to implement an effective access control system isn’t an option in some organizations, Bates says. Instead, it’s mandated by any number of regulations. Federal agencies, for example, have to comply with Homeland Security Presidential Directive/HSPD12, which outlines the requirements for positively identifying federal employees and contractors who would have access to federal offices and information systems. Health care facilities must comply with the Health Insurance Portability and Accountability Act of 1996, or HIPAA, which requires health care providers to protect patient information. Access control plays a role in organizations’ efforts to comply with both of these regulations.
Enhancing security through an access control system upgrade also can provide a marketing advantage, says Fred D. Miller, president of SRG Security Resources Group. In a tight rental market, touting a building’s state-of-the-art access control system can be a way to gain an edge with potential tenants.
In addition to tenants, the security of the facility can influence an organization’s ability to attract employees, says Ed Taraba, security specialist with CUH2A. For example, to attract top talent, a safe environment is critical.
Employee convenience also can come into play when considering an upgrade to the access control system. Some older systems may require all employees to enter and exit a building through a few revolving doors or turnstiles. Traffic often slows down at the beginning or end of the work day. “They can become bottlenecks,” says Taraba. “It becomes hard for staff to get in and out because a line forms.”
To eliminate this, some organizations have turned to optical turnstiles that either don’t have an arm, or have an arm that can be turned on and off. Identification cards are scanned, and once the system recognizes employees, they’re allowed through.
The technology incorporated into newer access control systems can boost the productivity of security employees. For instance, many of today’s systems allow the system operators or administrators to connect to the system from a remote location, via either the Internet or a private network. That reduces the number of times that a technician needs to be dispatched to diagnose incidents that occur within a remote facility, says Howard Belfor, chair of the ASIS Council on Physical Security, and regional president with SST.
Similarly, some newer systems allow facility executives to unlock all the doors from one computer. Occupants’ permissions for accessing a facility or parts of a facility can often be changed from a single computer. In addition to saving time, this capability makes it more likely that all points of entry are updated when an employee leaves a company and should no longer be able to enter the corporate offices, Belfor says. This feature also can be used when employees change their regular working hours, and need to access the facility at different times or days.
Most of today’s access control systems contain integrated databases, making it easier and faster for security employees to search the records to investigate an incident, as the work can be done electronically.
Moreover, many new access control systems not only track the times that individuals enter a facility — they also record the times they leave. Having this information can aid in investigating security incidents.
Most newer access control systems can run on the corporate information technology network. “They’re using the same highway as IT, so it’s one more return on the investment,” Belfor says. In contrast, many systems installed more than 10 years ago typically were stand-alone systems, says Bozeman.
Along with interfacing with time and attendance applications, many newer access control systems can link with other building systems, such as the elevator, lighting or HVAC systems, Miller says. Once an employee swipes a card to enter a facility, the lights come on and the heating or cooling system kicks in. Not only does this increase employees’ safety, but it saves energy by ensuring that these systems are running only when needed.
The access control system also can connect to other life safety systems, such as security cameras or fire alarm system, says Bill Bozeman, president and CEO with PSA Security Network. Should the fire alarm go off, facility executives would be able to determine quickly which occupants are inside and need to evacuate. When linked with security cameras, the system provides an additional check. “It provides an incredible amount of information,” Bozeman says. If an employer needs to know, for instance, which of its employees were in the facility between 3 and 7 p.m. on Thursday, July 12, 2007, that information can be quickly accessed.
At first glance, it might seem that upgrading an access control system would reduce an organization’s legal liability for any incidents that subsequently occur. However, facility executives should be careful not to overstate the potential reduction in liability.
“Liability reductions don’t occur because you deploy security controls,” says Belfor. “It’s how you implement them.” If facility executives take a “set it and forget it” approach, the organization’s liability probably won’t shrink, he says. Instead, the system needs to be consistently and properly monitored, evaluated and used.
As part of making the case for an upgrade to the access control system, facility executives should complete a risk assessment that outlines a facility’s areas of exposure, says Bates. By using the risk assessment as a foundation for decision-making, the facility executive is more likely to effectively plan for and use resources, he says. In contrast, spending solely in response to a security incident tends to lead to scatter-shot purchases.
In addition, using a risk assessment as a foundation for the access control system may help if a legal challenge is later brought against the organization, Miller says. The organization can show that the system chosen and implemented was based on a solid analysis of the risks facing the organization, and the potential solutions that would mitigate those risks.
Once the request for an access control upgrade is approved, proper implementation is key, Belfor says. That means thoroughly examining the current system to identify any deficiencies. It’s also important to consider any changes to the building, such as the construction of a new wall, which will necessitate a change in the access control system.
Effective and thorough implementation requires due diligence. It’s not enough to depend on the advice of a security solutions provider, because that person won’t be as knowledgeable about the building, its occupants and the current system.
When deciding on a system, facility executives should consider its potential use as a management tool, given the data that it will capture, Belfor says. “Make sure that you’re not under-powering the data, and your ability to attach it to other data,” he says. It’s generally easier to integrate with other applications when a system is based on an open platform or architecture.
If an access control system is already in place, facility executives will want to consider systems that will work with the access control cards already in use, as well as the ones that will be issued, Taraba says. That way, the organization won’t have to issue new cards to occupants who already have them.
Properly presented, the case for a security upgrade often should receive an open reception. “There’s not an owner in the world that doesn’t take security seriously,” says Bozeman. And, he says, interest in security has only grown. “Security has gone from the outhouse to the penthouse.”
Karen Kroll, a contributing editor for Building Operating Management, is a freelance writer who has written extensively about real estate and facility issues.
