Act quickly, but keep the response controlled
When a staff or contractor access card is lost, report it immediately, disable that credential and issue any replacement through the normal identity and approval process. Do not simply hand over a spare card, change every door setting or assume the missing card is harmless because it has not yet been used.
The response should protect the site without creating confusion at reception or blocking safe movement. A written procedure gives facilities, security and IT teams the same sequence to follow.
1. Record a clear report
Capture the cardholder’s name or identifier, the credential number if known, when and where the loss was noticed, and the person receiving the report. Record only information that is useful for the response; avoid circulating personal details in an open group chat.
Ask whether another item was lost with the pass, such as keys or a document identifying the premises. That can change the assessment, but staff should not delay disabling the credential while trying to reconstruct every detail.
2. Disable the individual credential
An authorised administrator should remove or suspend the missing credential in the access-control system and record the action. Where the system serves several buildings or zones, confirm which permissions were attached to that card rather than making assumptions from the person’s job title.
The NPSA user guide to automatic access-control systems says lost or stolen tokens should be reported and removed from the system immediately. NPSA also warns that poor token design can allow one lost, stolen or copied token to compromise more than one credential. The appropriate technical response therefore depends on the system actually installed.
3. Decide whether any wider action is justified
Review relevant facts: the access level, areas involved, whether the pass identified the site, and whether there is evidence of theft or attempted use. A single deactivated staff card does not automatically require a complete system reset. Equally, an administrator credential or a token linked to a shared code may need specialist advice.
Escalate suspected crime through the organisation’s established process and involve the system maintainer when configuration changes are needed. Preserve relevant records without publishing door names, access groups or other operational detail.
4. Verify identity before issuing a replacement
Use the site’s normal identity, sponsorship and authorisation checks. The person reporting the loss may be familiar to reception, but familiarity is not a substitute for the approved issue process. For a contractor, confirm that their engagement and required access remain current.
If a temporary pass is necessary, make its validity and permissions proportionate to the immediate need. Record who authorised it, when it expires and how it will be returned or disabled. Avoid a permanent “temporary” card that moves between people without accountability.
5. Brief the people who need to know
Tell relevant reception or security staff what action has been taken and what they should do if the missing card is found or presented. Share the minimum operational information needed. A site-wide message containing unnecessary personal details can create a separate privacy problem.
NPSA guidance describes access control as part of a wider security arrangement and recommends a robust visitor entry and exit process. The organisation’s response should fit its existing controls for doors, visitors, alarms and incident reporting rather than relying on a card system in isolation.
6. Review access records proportionately
If the circumstances justify it, an authorised person can review relevant access events for the necessary period. Define the purpose of the review and limit who sees the result. An access log can contain personal information; it should not become a general tool for monitoring staff movements without a clear justification.
The ICO’s data-minimisation guidance says organisations should hold the minimum personal information needed for their purpose. Its storage-limitation guidance explains that the UK GDPR does not set one retention period for every type of record; organisations should justify how long records are needed and review them.
7. Close the incident and improve the process
Confirm that the original credential remains disabled, the replacement has the correct access and any temporary pass has been returned or cancelled. If the missing card is later found, do not automatically reactivate it; follow the authorised process and check whether a replacement is already live.
A short review may reveal practical improvements: clearer reporting contacts, faster out-of-hours administration, distinct visitor passes, better leaver procedures or less access than the old card carried. Test the process with a fictional lost-card exercise rather than using a real employee’s record for training.
Discuss the access-control requirement
K9 Security Services lists access-control and commercial security services. To discuss a premises, send an enquiry with the postcode, the type of site and the outcome required. Do not include access codes, credential data or detailed door arrangements in an initial message.
This checklist is general operational guidance. The correct response depends on the system, the organisation’s policies and the circumstances of the loss; it does not certify a specific installation or guarantee a security outcome.