COUNTY OF SAN MATEO
SUBJECT: Building Access and Cardkey Policy
RESPONSIBLE DEPARTMENT: County Manager / Clerk of the Board
DATE: January 2, 2014
This policy outlines the building access guidelines and expectations for all individuals who possess County cardkeys. Each cardkey shall contain the individual’s legal name as it appears on a government-issued identification such as a driver’s license (no nicknames are allowed), their photograph, and their department or other designation, such as County Bar Association, Grand Juror, Vendor, etc. Each cardkey will have the level of access specifically recommended for that cardholder by his/her Department head or other authorized person so described in this memo.
San Mateo County assigns Cardkey Administrators to manage cardkey systems. These administrators are responsible for issuing cards, setting access levels and deactivating cardkeys. The Information Services Department (lSD) is the primary Cardkey Administrator for the County, controlling access to most County facilities that have card readers. Due to Federal Law, Crime Lab staff manage cardkey access to the Crime Lab. The Sheriff maintains separate access control systems for Adult Correctional Facilities and the Probation Department manages access to the Juvenile Detention Facilities.
It is the responsibility of department heads, division directors, and/or their designees to select one or more persons to maintain cardkey oversight for their facilities and to act as liaison with the lSD Cardkey Administrator.
Strict adherence by County departments, employees and other cardholders to policies and procedures regarding appropriate and inappropriate cardkey use is required. Full cooperation of each and every member of those groups is required so that the integrity of the building security plan can be maintained.
II. CARDKEY AUTHORIZATION AND DEACTIVATION PROCEDURES:
A. County Employees
1. Departments that have exclusive use of a building should determine access to that building. Departments that are in multi-use buildings should determine access to their areas.
2. It is the responsibility of each department head, or his or her designee, to determine and assign their employees’ access rights based on job requirements. Three components are required in assigning access rights, as follows: (1) access area, (2) hours and (3) days of the week. Example: Hall of Justice, 6:00a.m. to 6:00 p.m., Monday through Friday. One way to approach this issue may be to ask, “How would not granting access affect the employee’s ability to perform their assigned duties?” If the impact is significant, access should be granted.
3. Departments should request that the cardkey be prepared in advance of the employee’s first day, so that the appointment for their badge photo/pickup can occur on or before the employee’s first day of County service.
4. Departments are required to immediately collect cardkeys from employees leaving County service. The department designee should notify the Cardkey Administrator to deactivate the employee’s cardkey effective on the last day of County service. For security purposes, the last day of County service is defined as the last day an employee performs services on property either owned or leased by the County.
5. The Human Resources Department should submit a monthly report of all terminated employees to the ISO Cardkey Administrator. This will provide redundancy and ensure that cardkeys are deactivated in a timely manner.
6. At the time an employee separates from County service, the department will ensure that access to County buildings and systems is terminated pursuant to County and/or Departmental policy. It is recommended that departments begin this process prior to the employee’s last day of County service. Departments will send the collected badges to the ISO Cardkey Administrator for verification of cancellation and destruction of the badge.
7. At least once a year, the ISO Cardkey Administrator will provide a list of all active cardkeys for departmental review. Departments will be responsible for reviewing the list and informing the Cardkey Administrator of cardkeys that need immediate deactivation.
B. Non-County Employees
1. For Extra-Help, Contractors, Providers, etc. – all facilities: These types of workforce member’s cards are always set to expire by December 31 (or sooner if the agreement/contract for their services ends prior to December 31).
2. For Vendors- all facilities: Vendor cards are always set to expire by December 31 (or sooner if they are working on a project with an estimated completion date prior to December 31). Vendor cards generally do not permit access through cardkey doors but will allow vendors to circumvent security screening due to their need to enter the buildings with construction materials, tools and large pallets of paper, office supplies, etc. If a vendor is working in a secured building after hours, departments are responsible for having a County employee on-site with the vendor at all times.
3. For Press- Existing press members with cardkeys will maintain access. The cardkeys are set to terminate each year on December 31. Prior to December 31 of each year, the Communications Director in the County Manager’s Office will verify reporter’s continued employment and reauthorize access. Cardkeys for reporters not re-authorized will be collected. No additional members of the press will be issued cardkeys.
4. Attorneys- court facilities only: Only attorneys in good standing with the County Bar Association for a period of at least two full years will be issued cardkeys. As long as attorneys remain members of the County Bar their cardkeys will remain activated. This program is administered through the Bar Association. Generally, attorney cardkeys will only be deactivated should an attorney leave or be suspended by the County Bar. A suspension from the County Bar is automatic if the attorney is disciplined by suspension from the State Bar for misconduct. In those instances, the County Bar would contact the Cardkey Administrator and let them know that the cardkey must be deactivated immediately.
5. Other- all facilities: Cardkeys issued to members of Grand Juries, Boards and Commissions, and others as determined by the BSWG (Building Security Work Group) and the Sheriff, will be set to expire on December 31 of current fiscal year or the end of member’s term, whichever is later.
6. During the year-end review cycle, described in II.A.? above, departments will identify cards that are no longer needed and those that should be extended.
A. The fact that an individual has been issued a cardkey does not authorize that individual to bring weapons into County facilities.
1. Weapons: With the exception of sworn law enforcement personnel who are authorized to carry firearms, chemical agents and impact weapons in the performance of their job duties, County officers, officials and employees, including those who possess concealed weapon permits, are prohibited from bringing weapons into County facilities. For the purpose of this provision, weapons are defined as instruments of offensive or defensive combat including, but not limited to, firearms, stun guns, explosive devices, toxic or irritant chemical dispensers, knives (of any type) and clubs.
2. Exception: Certain non-sworn County employees, such as Legal Exhibits Technicians, Sheriff’s Property Officers, and members of the District Attorney’s Office authorized to carry weapons by the District Attorney, will be allowed to transport weapons into, out of and within the boundaries of County facilities as their assigned job responsibilities dictate. Weapons will be unloaded and firing mechanisms secured during transport.
B. Cardkey Privileges: Prior to receiving a cardkey, cardholders are required to read and sign a “Cardkey Rules” form that addresses cardholder responsibilities for possessing cardkeys, as follows:
1. The badge is the property of the County of San Mateo and must be returned when the cardholder terminates their employment, contract, rotation, class, or assignment.
2. If a cardkey is lost or stolen, the cardholder must immediately notify their supervisor, manager or sponsoring County contact/liaison and the lSD Service Desk calling (650)363-4108. The lSD Cardkey Administrator will immediately deactivate the cardkey. When a replacement cardkey is requested by an appropriate departmental authority, the department will be charged for the replacement cost.
If the old cardkey is found prior to the issuance of a new card, the Cardkey Administrator may reactivate the cardkey. If the new cardkey has already been issued, then the old cardkey must be submitted to the Cardkey Administrator for destruction. Under no circumstances shall an employee have more than one activated cardkey at any given time.
2. When requested by an appropriate departmental authority, a cardkey will be replaced at no charge if the badge is broken, or if the cardholder’s name, title, or department changes. The old cardkey must be submitted to the Cardkey Administrator for destruction.
3. Badges must be maintained in good condition. The placement of pins and unauthorized stickers on the badge is prohibited. (NOTE: For individual safety or therapeutic concerns, Health System staff and contractors who work in a psychiatric setting may cover their last name with a sticker.)
4. Except as provided in 8.5. below, it is expressly prohibited for anybody issued a cardkey to give or sell his/her cardkey or provide access to another person (including other County employees) to secured County facilities. This includes swiping the cardkey to allow access to others.
5. Employees with evening, week end or 24-hour access may, with department head approval, allow family members and close acquaintances to accompany them during non-business hours into secured County facilities. (For the purpose of this discussion, non business hours are defined as any instance when building security screening is not in operation or public entrances are locked.) However, employees may be legally and financially responsible for the actions of these individuals while in the confines of said facilities for which they were granted access
6. Employees that are terminated should immediately return their badges to their department’s Payroll Coordinator or direct supervisor. The department is required to notify the lSD Cardkey Administrator by normal means so that the employee’s cardkey can be deactivated. If the card must be deactivated immediately, the department must call the lSD Service Desk at 650-363-4108. The cancelled or deactivated cardkey will no longer activate the door mechanisms and should be sent to the ISO Cardkey Administrator for verification and destruction.
C. Vendor/Attorneys/Press Members/Other Access: To maintain the operation of County facilities, the need will arise to provide unobtrusive access to contractors and vendors/attorneys/press members/others, whether supervised or unsupervised. In some instances, it may be determined to be in the County’s best interest to issue cardkeys to long standing contractors. On the other hand, supervised and/or screened entry may be required for contractors and vendors with limited or short term access requirements. Upon request by authorized departmental personnel, the Cardkey Administrator may issue temporary cards with vendor-specific access and time zones.
D. General Public: The general public will use predetermined public access doors in each County facility. When entering court facilities, the public and their belongings will be processed through x-ray and metal detector checkpoints staffed with Sheriff’s Deputies and contract security personnel.
E. Notification: In order to maintain the integrity of the building security system, it is the responsibility of each employee to notify his/her supervisor if they observe other employees or members of the public attempting to circumvent, manipulate or undermine building security. The County should take every precaution in preserving the anonymity of those employees who report occurrences of unauthorized access, cardkey misuse or illegal weapons on the premises.
F. Violations: Any cardkey holders found to have violated these policies may lose cardkey privileges. County employees may be subject to disciplinary action up to and including dismissal from employment.
G. Keypad Access Codes: The Building Security Work Group and the Information Services Department do not recommend keypad security technology for controlling access as such systems have been found to be ineffective and they create an additional layer of maintenance. However, for departments that do have keypad security systems in place, the access codes should be changed on a regular interval, not longer than 180 days.
H. Authorization Procedure for Regular “Hard” Keys: Department heads or their designee will be responsible for issuing and tracking regular “hard” keys. As with cardkeys, access to specified areas will be based on the employee’s access requirements. It will be the responsibility of the department heads to collect these keys from employees as they change assignments or leave County service