10.1 Personnel, Package & Vehicle Screening and Visitor/Vendor Policy

Why screening is a design decision, not a lobby accessory

Physical security systems fail in public view more often than they fail in a locked closet. Personnel, package, and vehicle screening—paired with visitor and vendor management—are the Domain 2 Task 2 countermeasures that decide whether an access-controlled door is actually a control or merely hardware people walk around while carrying a carton. A card reader on the inner door does not inspect the crate that arrived at the dock. A camera records the officer who waved a recognized executive’s guest through the portal. On the Physical Security Professional exam, the correct specification is the system of methods plus policy, not the most expensive portal in a brochure.

Start by naming the inspection object. People, bags, mail, handheld packages, and vehicles are different physics problems. A control that is excellent against one object is silent against another. That is why a walk-through metal detector and a loading-dock bill-of-lading check can both be “screening” and still leave a hole if you buy only one of them.

Personnel screening: magnetometers and what they miss

A walk-through magnetometer (walk-through metal detector) is a portal that senses conductive and ferrous metal in a body-sized aperture. You specify zone count, sensitivity, and throughput (people per minute) from the risk assessment and the queue the building will actually produce at shift change. Operators calibrate with the manufacturer’s test object at the start of each shift and after a power bump or sensitivity change. An alarm is not a verdict. It is a prompt for secondary screening with a handheld wand, a consistent scan pattern (head-to-toe, both sides, bags already removed), and a private room when clothing, a religious garment, or a medical device requires it.

Write the medical-device alternative into post orders. People with implanted devices may request a pat-down even when the portal is generally treated as safe. If the officer has to invent that policy in front of a line, you will get both a complaint and a bypass. Same-gender screening, where the facility requires it, is a staffing plan, not a hope.

Know what the portal does not do. It will not find a ceramic blade, a liquid, a powder explosive, or a non-metallic firearm component. It will not inspect the briefcase the visitor sets beside the coil. If the program screens bodies and then waves bags onto the reception counter, the portal is theater. PSP items love that mismatch: capital spent on people, zero process for parcels.

Choose 100 percent versus random screening from threat and labor, and then enforce the choice. Random employee screening can be a legitimate insider-threat measure after legal and labor review. Visitor screening is more often 100 percent because the population is unknown. “Recognized faces skip the portal” is how social engineering walks in beside a director.

Package, mail, and explosive-trace applications

X-ray cabinets and conveyors produce a transmission image. Dual-energy colorization commonly paints organic, inorganic, and mixed materials in different hues so operators hunt for anomalies instead of staring at a grey blob. Operators need initial and recurrent image-interpretation practice. Threat image projection (TIP) inserts fictional threats into live images so supervisors can measure vigilance instead of assuming it. Radiation safety, lead curtains, interlocks, and a place to isolate a suspect bag are part of the specification.

When X-ray is not justified—small office, low threat, no mail volume—a documented hand-search protocol still beats an honor system. Hand search is slower and more invasive; write when it is used (alarm on X-ray, inoperative machine, oversized item) so officers are not improvising.

Explosive trace detection (ETD) is an application decision, not a default lobby fashion. A swab of a bag zipper, vehicle door handle, cargo seal, or mail tray is analyzed, typically by ion mobility spectrometry. Specify ETD where the assessment says blast or high-profile targeting is credible: a high-risk loading dock, a special-event vehicle checkpoint, a mailroom that already manages powder hoaxes. Officers must expect nuisance positives from lotions, fertilizers, and some solvents. The SOP therefore needs a secondary method and a supervisor release—not an automatic building evacuation for every hit, and not a shrug that ignores a hit. ETD does not replace X-ray geometry, and X-ray does not replace chain-of-custody when a package becomes evidence.

Keep incoming mail out of the public lobby when volume or threat warrants a dedicated room. USB sticks and “forgotten” vendor media are packages too; a clean-desk and media-intake rule belongs with the X-ray conversation because a portal will not see stored code.

Vehicle screening and under-vehicle inspection

Vehicle screening starts before the facade. A truck that idles against glass while the officer “will get to it” has already defeated standoff. Low-threat sites use under-vehicle inspection mirrors and a flashlight, plus cabin and cargo looks when the threat warrants. Higher-threat sites specify under-vehicle inspection systems (UVIS)—drive-over cameras with an operator display—and a separate bay so a rejected vehicle can reverse without entering the inner perimeter.

Pair the look-under with identity and cargo matching: driver credential versus bill of lading, trailer seal numbers versus paperwork, passenger count versus the access list. A UVIS image of a clean undercarriage does not prove the cargo matches the purchase order. Pop-up barriers or a serpentine after the checkpoint keep a vehicle from turning the screening lane into a sprint to the lobby. Pedestrian and vehicle lanes should not mix at the same unstaffed opening.

Guard procedures that make hardware a control

Post orders should state who is screened (employees with briefcases included or not—pick one), what happens on alarm, the duress phrase if an officer is being coerced to pass someone, and the rule that an unmanned portal is a closed portal. Two-person integrity at a vehicle gate during high-threat periods is a staffing cost; it is also how you keep one officer from being rushed. Officers do not leave the checkpoint to “just run this badge back to reception.” They radio for a runner. They do not accept a photocopy of a license as identity when the policy requires the physical credential.

Visitor and vendor policy: escort, badges, time limits, docks, after-hours

Visitor and vendor rules fail when they are a paper log in a drawer. A workable program has pre-registration for known visits, government-issued photo ID at reception, a badge that is visually distinct from employee badges (color, large visitor mark, no encoded access unless the visit requires it), and an expiry. Escort rules should be explicit: unescorted visitors only after a briefing and only into pre-approved zones; contractors in mechanical rooms, IDF closets, or roof plants remain escorted or under two-person vendor rules.

Time limits belong in the access-control system so a badge dies at 17:00 even if reception forgot to collect it. Collecting the badge still matters for the next day’s inventory and for the person who would otherwise keep a live sticker for a week.

Loading-dock contractors are not lobby visitors. They arrive with tools, trucks, and often after-hours access. Issue job-limited credentials, inventory tools in and out when theft or device implant is in the threat model, require facilities hot-work permits, and close the dock door except during an active unload. A contractor who props the dock “for a minute” has opened a vehicle-sized hole in the envelope.

After-hours visits need a tighter script. The security operations center or listed central station verifies the visit against a call-ahead list. A second person meets the vendor. Interior doors do not unlock globally because one elevator reader went into unlock. The credential is disabled at job complete—not “Monday when day-shift security comes in.”

Visitor logs, copies of identification, and contractor watchlists are personally identifiable information. Retention and who may view them belong with the data rules in the next sections of this chapter; do not treat the reception binder as unclassified scrap paper.

The expensive-portal trap

The classic failure is capital spend without a package or vendor path: a six-figure magnetometer in a marble lobby, parcel totes and HVAC contractors through an unstaffed dock, and visitor stickers that never expire. If you remember one exam heuristic, remember this: if a person, bag, or vehicle can reach a protected space without meeting a written inspection and a credential rule, the portal you bought is not the countermeasure.