Compliance

§105.255 Security measures for access control.
(a) General. The facility owner or operator must ensure the implementation of security measures to:

(1) Deter the unauthorized introduction of dangerous substances and devices, including any device intended to damage or destroy persons, vessels, facilities, or ports;

(2) Secure dangerous substances and devices that are authorized by the owner or operator to be on the facility;

(3) Control access to the facility; and

(4) Prevent an unescorted individual from entering an area of the facility that is designated as a secure area unless the individual holds a duly issued TWIC and is authorized to be in the area. Individuals seeking unescorted access to a secure area in a facility in Risk Group A must pass electronic TWIC inspection and those seeking unescorted access to a secure area in a facility not in Risk Group A must pass either electronic TWIC inspection or visual TWIC inspection.

(b) The facility owner or operator must ensure that the following are specified:

(1) The locations where restrictions or prohibitions that prevent unauthorized access are applied for each MARSEC Level, including those points where TWIC access control provisions will be applied. Each location allowing means of access to the facility must be addressed;

(2) The types of restrictions or prohibitions to be applied and the means of enforcing them;

(3) The means used to establish the identity of individuals not in possession of a TWIC, in accordance with § 101.515 of this subchapter, and procedures for escorting them;

(4) Procedures for identifying authorized and unauthorized persons at any MARSEC level; and

(5) The locations where persons, personal effects and vehicle screenings are to be conducted. The designated screening areas should be covered to provide for continuous operations regardless of the weather conditions.

2.3.1.5. Provide methods of identification for all employees and visitors. (See para 2.3.4. & 2.3.5.)

2.3.2.1. Implement procedures for escorting visitors, contractors, vendors, and other non facility employees to their destinations when necessary. See Note 2

2.3.6 CDC Facilities should register privately owned vehicles and contractor vehicles that are allowed routine access to the facility at the security office. Records should be maintained that include matching personnel with permit number and motor vehicle identification. Temporary permits should be issued to vendors and visitors for parking in designated areas. Security personnel should conduct random checks of parking permits.

2.3 Visitors

a) Procedures for how visitors are managed at the vendor facility must be documented and followed.
b) All visitors to the facility must be registered ahead of their arrival.
c) The registration must include name and company they represent.
d) If the visitor requires access to the HSA or cloud-based provisioning environment, this must be approved by both the Security Manager and the Production Manager.
e) Any unsolicited visitors must be turned away.
f) An authorized employee must accompany all visitors at all times while they are in the facility.
g) Visitors must enter through the reception area.

2.3.1 Registration procedures

a) The vendor must apply the same registration procedures to all visitors entering their facility. These procedures must include the following:

o Confirmation of previously agreed appointment

o Verification of identification against an official, government issued picture ID

b) The vendor must maintain records, manually or electronically, of all visitors who enter the facility. If a manual logbook is used, it must contain consecutive, pre-numbered, bound pages.
c) All logs must be protected from modification.
d) The following information must be recorded in the logbook:

o Name of the visitor, printed and signed

o Number of the official ID document(s) presented and the date and place of issue

o Company the visitor represents (if any)

o Name of the person being visited or in charge of the visitor o Purpose of the visit

o Visitor badge number

o Date and time of arrival and departure

o Signature of the employee initially assigned to escort the visitor

e) The vendor must retain visitors’ registration records for at least 90 days.

2.3.2 Visitor Security Notification

At a minimum, the vendor must make visitors aware of vendor security and confidentiality requirements, and the vendor-provided escort must ensure the visitor’s adherence to those requirements.

2.3.3 Visitor identification

a) Each visitor entering the facility must be issued with and must wear visibly on their person a security pass or ID badge that identifies them as a non-employee.
b) If the security pass or ID badge is disposable, the visitor’s name and date of entry to the facility and, if multi-day, the validity period must be clearly indicated on the front of the badge.
c) If the security pass or ID badge is the access-control type that enables a record to be kept of the visitor’s movement throughout the facility:

o The visitor must be instructed on its proper use.

o The vendor must program the visitor access badge or card to enable the tracking of movement of all visitors. It should be activated only for areas that the visitor is authorized to enter.

o Visitors must use their access card in the card readers to the room into which they enter.

o Badging to track access must be used wherever feasible.

d) Unissued visitor access badges must be securely stored.
e) Any un-badged access must be recorded in a log. Logs may be electronic and/or manual.
f) Employees responsible for escorting visitors while they are inside the facility must ensure that the visitor surrenders their ID badge to the receptionist or guard before leaving the building

Global compliance standards

Standards