Office Security Policy

2025.1

Reviewed: 9/25/2024
Updated: 9/25/2024

Purpose and Scope:

1. This policy establishes the rules governing controls, monitoring, and removal of physical access to company's facilities.
2. This policy applies to all staff, contractors, or third parties who require access to any physical location owned, operated, or otherwise occupied by IMPLAN.

Controls and Procedures

Policy:

1. Key access & card systems a. The following policies are applied to all facility access cards, keyfobs, and keys:

   • Employees should use only the keyfob that has been assigned to them
   • In the event of a lost keyfob, the employee should notify Human Resources or the Director of Infrastructure and Technology. Once notified, that keyfob will be disabled and, should the situation require, a new one will be issued.

2. Staff & contractor access procedure
   a. Access to physical locations is granted to employees and contractors based on individual job function and will be granted by Human Resources.
   b. Any individual granted access to physical spaces will be issued a physical key or access key card. Key and card issuance is tracked by Human Resources and will be periodically reviewed.
   c. In the case of termination, Human Resources should ensure immediate revocation of access (i.e. collection of keys, access cards, and any other asset used to enter facilities) through the offboarding procedure.

3. Visitor & guest access procedure
   a. The following policies are applied to identification & authorization of visitors and guests:

   • Visitors and guests must be accompanied by an IMPLAN staff member while on the premises.

4. Audit controls & management
   a. Documented procedures and evidence of practice should be in place for this policy. Acceptable controls and procedures include:

   • New employee procedure
   • Termination of employment procedure
   • Log review and notification procedure
     Enforcement
     a. Employees, contractors, or third parties found in violation of this policy (whether intentional or accidental) may be subject to disciplinary action, including:
   • Restricted or removed access