Visitor Sign-in Gaps
Nobody booked him in, but he has a ten o'clock.
What Is Visitor Sign-in Gaps?
A visitor register is the building's record of who was inside and who vouched for them, and an unbooked caller at the door is where that record either gets made or quietly does not. In this exercise you cover a reception desk for half an hour and answer the intercom yourself. You practise reading the register before the door opens, confirming a caller's story with the host they name rather than with the caller, signing them in, printing the badge, and escorting them instead of pointing at the lift.
What You'll Learn in Visitor Sign-in Gaps
- Read the visitor register before opening a door, so a caller's own account is not the only evidence you have
- Confirm an unbooked visitor with the host they name, rather than with the visitor who named them
- Create the register entry before the door opens, so the record carries who vouched for the visitor
- Issue the badge and treat an Escort required line as an instruction rather than a decoration
- Report a near miss so that hosts who think a calendar invite is a booking find out before the next visit
Visitor Sign-in Gaps — Training Steps
-
Covering The Desk
It is a Tuesday morning in Building A at Marrowfield Logistics. Alice has the front desk for half an hour while the reception team does its weekly handover upstairs. The notice goes round the floor every time the desk is left uncovered.
-
The Buzzer
At 10:08 the entry intercom beside the desk starts buzzing. The camera at the street door shows a man in a jacket, standing square to the lens and waiting. Nothing round his neck, and nobody else at the desk to take it.
-
Answer The Door
He is not hiding from the camera and he is not in a hurry. He looks like every consultant who has ever turned up five minutes early.
-
A Ten O'Clock
He gives his name without being asked for it.
-
Today's Register
Before the door opens, there is one thing on the desk worth reading: the register the reception team keeps in Foyerline. It holds everyone a host booked in for today.
-
What Do You Say?
He is polite, he is early, and he has a meeting time. He is also not on the register, and the person who would normally sort this out is upstairs in a handover. The question is not whether to believe him. It is whether anything other than him says he is expected.
-
He Names Her
A genuine visitor knows exactly who they are there to see, and answers without thinking about it.
-
Ask Sarah
A name is not a check. Anyone who has read the company's website can name somebody in Marketing. The check is asking her.
-
She Is Expecting Him
Sarah answers before he has finished waiting.
-
Sign Him In
He is confirmed, so he goes on the register before he comes through the door rather than after. The register is not a formality either. It is the only list that says who was inside the building today and who vouched for them.
Security Framework Coverage
MITRE ATT&CK
- T1656 Impersonation
CIS Controls
- CIS 14.2 Train Workforce Members to Recognize Social Engineering Attacks
- CIS 14.6 Train Workforce Members on Recognizing and Reporting Security Incidents
NIST CSF
- PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind