Visitor management SOP template for security teams

The visitor log is the document that gets subpoenaed, and most sites treat it as a clipboard by the door. This visitor management SOP covers pre-registration to badge return, written so a new officer on their first lobby shift can follow it.

Who counts as a visitor?

Everyone who is not on your payroll and not carrying a permanent credential. Write the list out, because the arguments happen at the edges.

• Business visitors and guests
• Vendors and contractors
• Delivery personnel
• Interview candidates
• Government inspectors
• Family members of employees
• Tour groups

The employee's spouse dropping off lunch is a visitor. So is the vending machine technician who has been coming for nine years. If your SOP has an unwritten exception for familiar faces, that exception is your actual policy, and it is the one that will be examined after an incident.

Before they arrive

What the host has to submit

1. The request, at least 24 hours ahead where the visit is planned
2. Visitor's full name, company and purpose of visit
3. Dates, expected arrival time, and which areas they will enter
4. Whether special access or an escort is needed
5. Confirmation that the visitor has agreed to site policies

What security checks before the day

• Run the name against your denied persons list
• Confirm the host is authorized to sponsor visitors at all
• Confirm the requested areas match the visitor type
• Tell the host about any problem before the visitor is standing in your lobby

That last line is the whole reason pre-registration exists. Turning someone away at the desk with their host watching is a bad afternoon for everyone, and it is entirely avoidable with one email the day before.

The denied persons list only works if it is maintained and reachable from the desk. A binder in a drawer is not a list. Keep one current copy, name an owner who updates it, and make sure the night officer can reach the same version the day officer used.

Check-in, step by step

1. Greet. "Good morning, welcome. How may I help you?" Set the tone before you start asking for documents
2. Collect. Full name, company, who they are here to see, and why
3. Match. Check them against the expected visitor list
4. Request ID. Government-issued photo ID, for everyone
5. Verify. Photo matches the person, name matches the registration
6. Log. Arrival time, ID type, host name
7. Badge. Name, date, host, and the areas authorized
8. Brief. Safety information, restricted areas, what to do if the alarm sounds
9. Notify. Call the host to collect the visitor or arrange the escort

Someone who is not on the list

Walk-ins turn up at every site, so the procedure for them is not an edge case.

1. Run steps 1 through 5 exactly as above
2. Contact the proposed host and confirm the visit is expected
3. Host confirms, issue the badge and continue
4. Host is unreachable or does not confirm, ask the visitor to wait or reschedule
5. Document anyone turned away, including the time and the reason

Documenting a refusal protects the officer more than it protects the site. When the complaint arrives a week later, "there is no record" and "here is the entry" are very different positions to be in.

Verifying ID without a scanner

Acceptable identification: a driver's license from any state, a state-issued ID card, a passport, a military ID, or a Permanent Resident Card.

When the ID cannot be verified: explain politely that valid photo ID is required, offer to reschedule, call a supervisor if the visitor pushes, and write it up either way. The script matters here. An officer who has practiced the sentence delivers it calmly; an officer improvising escalates.

What the badge has to do

A visitor badge has exactly one job: to make an unescorted stranger visible to any employee who glances up.

• Visible. Worn above the waist, on the outside
• Date-specific. Valid only for the day it was issued
• Obviously different. Different color, shape or size from an employee badge, readable from across a corridor
• Returnable. Surrendered at departure, not kept as a souvenir

On the badge itself: visitor name, company, date, host name or department, areas authorized if restricted, and a badge number you can trace. If your badge looks like an employee badge from ten feet away, it is doing the opposite of its job.

Badges are a physical inventory, and physical inventories walk. The same discipline that keeps site keys accounted for applies here. See the key control policy template for the issue-and-return pattern.

When does someone need an escort?

Tie the rule to the area, not to your read of the person. That way the officer never has to make a judgment call about who looks trustworthy.

• Any visitor in a sensitive or restricted area
• Contractors working in secure zones
• Any visitor whose host is not present
• Large groups and tours
• Anything the host or security flags in advance

The escort's job is narrow and absolute: stay with the visitor, keep them out of unauthorized areas, make sure site policies are followed, and walk them back to the lobby at the end. An escort who steps away to take a call has stopped being an escort.

Where the escort rule and the badge reader disagree, the escort rule wins. Access control beyond badge readers covers tailgating and the gaps a reader cannot see.

Departure, which is where this usually breaks

1. Collect the badge. "May I have your visitor badge, please?"
2. Log the departure time
3. Check for belongings so the phone on the lobby chair is not tomorrow's problem
4. Thank them. "Thanks for coming in. Have a good day"
5. Void or destroy the badge if it was date-specific

Now the part that decides whether your log is worth anything. Most sites have open entries going back months, because visitors leave through the parking garage and nobody chases it.

An open entry is not paperwork. In an evacuation it is a name you have to account for, which is exactly why the log exists in the first place. Roll unresolved entries into the shift handoff rather than leaving them for the day shift to find. The shift handoff SOP covers where that belongs.

The categories that need their own rules

Contractors and vendors

• Safety orientation before work begins
• Longer-term credentials with an expiration date, not a stack of day passes
• Tool and equipment inspection where the site requires it
• Insurance verification where the contract requires it

Delivery personnel

• Direct them to the designated delivery area, every time
• Verify the delivery is expected
• A full badge may not be warranted for a two-minute drop
• Escort if the delivery point sits inside a secure zone

VIP visitors

• Expedited check-in is fine
• Escort arranged in advance by senior personnel
• ID verification still happens. Seniority is not an exemption
• Security notified before arrival, not on arrival

Government inspectors

• Verify credentials, and the warrant or authorization if one applies
• Contact legal or management immediately
• Do not obstruct, and do not volunteer information nobody asked for
• Escort throughout and document every area accessed

The inspector case is the one to rehearse. It arrives without warning, the officer is alone at the desk, and the wrong instinct in either direction causes real damage. Put the phone number for legal on the desk, not in a binder.

What the log must capture

Once the SOP is written, it has to live where the officer works. That means it belongs in the post orders for the lobby, not in a policy folder on a shared drive. Writing post orders that work covers getting a procedure from a document into a shift, and the site security assessment checklist is where you find out whether the lobby layout supports it at all.