Security at a defence industry facility cannot be assessed only through its perimeter barriers. Old permissions left active after a project change, temporary contractor access that becomes permanent, and a departing employee's live access card are also management concerns. This guide focuses on keeping access aligned with work, rather than treating every employee as a suspect.
Certification and classification requirements must be assessed for the relevant project. Facility Security Certificates, Personnel Security Certificates and permissions under Law No. 5188 serve different purposes. None alone grants unrestricted access to every area or unlimited private security powers.
Identify who owns the access decision
An HR notification that someone has joined is not the same as authorisation to enter a particular project area. The responsible manager, security lead and, where needed, information security team should decide what access the work requires. The person who technically configures a card should not make that business decision alone.
An authorisation record may identify the role, approver, permitted scope and conditions for review. Keep the information proportionate to the purpose. NPSA's role-based personnel security approach is a useful foreign practice resource for examining a role's access to critical assets, rather than making speculative judgements about private life.
Treat role and project changes as access changes
Remaining employed by an organisation does not necessarily justify retaining permissions for a previous department. When someone moves to a new role or project, check whether former access has been removed. The same principle can apply to suppliers, maintenance teams and temporary personnel.
A change is not complete merely because an email was sent. Make approval, technical implementation and confirmation visible as separate steps. Gate staff should know which list is current, with no unresolved conflict between old printed lists and updated digital records.
Align device and material rules with actual needs
Rules for phones, laptops and removable storage should reflect the information security requirements of the relevant area. Do not assume every device must be prohibited in the same way at every facility. Equipment needed for technical maintenance should be assessed in advance by the authorised project representatives.
Private security officers implement the approved physical admission process; they do not independently certify the technical safety of data on a device. Any inspection or safekeeping arrangement should explain the lawful authority, receipt, protection and return of property. An X-ray image does not establish that a device's software is safe.
Coordinate departures and incident reporting
Access cards, keys, temporary permissions and digital accounts may have different owners. Use a coordinated closure checklist and assign responsibility for confirmation when someone leaves the organisation or project. Reminding a person of confidentiality obligations does not justify excessive personal data collection or a private company conducting an official security investigation.
Incident records should separate observation from interpretation. Seeing a device in an unauthorised area can be recorded without declaring that espionage has occurred. Share records and evidence only with authorised people to the extent necessary.
Ask questions that can be answered with records
Were old permissions removed after the last role change? Are any expired technical visitor cards still active? Was urgently granted access subsequently reviewed? Sample records should support the answers. Testing can be conducted without publishing sensitive layouts or security details. The aim is to make the reasoning and implementation of access decisions traceable, rather than claim that all risk has been eliminated.
