About the business
I manage IT for a mid-size company. We have a small server room holding our core equipment, and a handful of people need to get in: my team, a vendor who handles maintenance, and occasionally facilities. It's a small room.
Everything the company runs on sits inside it.
The problem: a shared key and no record
The server room had an ordinary lock and two copies of one key. One lived in my desk drawer. The other moved between team members and, now and then, the vendor. Nobody wrote anything down.
During a security review, the auditor asked a simple question. "Who entered this room last month, and when?"
I couldn't answer. I could guess who had probably gone in, based on who was working that week and who had asked me for the key, but I couldn't prove any of it.
In a security review, a guess counts the same as no answer.
Nobody had done anything wrong. That wasn't the point. The point was that if something had gone wrong, I'd have had no way of finding out who, or when.
What we changed: one person, one credential, every entry recorded
We put an access reader on the server room door. Everyone who needs the room has their own credential, and nobody shares. For this door we use two steps: a card plus a palm scan. A lost or lent card on its own doesn't open it.
Every attempt is logged, allowed or refused, with the person, the door and the time. The vendor doesn't get a permanent credential. Their visits are booked in advance for a fixed time window, and each entry is logged under their name like everyone else's.
Because the second step is a palm scan, that's biometric data, and we treated it that way. The few people enrolled gave written consent. We documented how long we keep the data and what happens to it when someone leaves. If you're in Illinois, Texas, or a state whose privacy law treats biometrics as sensitive data, check the rules before you start. (General information, not legal advice.)
There's one honest limit worth saying out loud. The log shows who badged in. It doesn't show whether a second person followed them through. We closed that gap separately, with a self-closing door and a simple rule that nobody holds it open. A credential record isn't a head count, and that problem has its own fixes.
The result: a real answer when someone asks
At the next review, the auditor asked the same question. This time I pulled up the log and showed every entry for the month. The whole conversation took a couple of minutes.
That was it.
I also look at the log every week now, so anything unusual shows up early instead of after a problem.
None of this is about catching people. It's about being able to give a clear, provable answer to one question: who was in the room?
If you couldn't prove today who entered your server room last month, tell us how the room is controlled now. We'll give you an honest view of the minimum worth doing.
Free door-by-door access review
Send us your door list, or just tell us what's behind each door. We'll reply with the weak spots and what to fix first, cheapest first.
- Free
- Reply within 24 hours
- No obligation