Which entities are commonly required to implement access control measures?

• A. Contractors
• B. Visitors with appropriate authorization
• C. Facility employees, contractors, and visitors with appropriate authorization
• D. Facility employees

Answer: (C)

Access control measures regulate who can enter different areas, so they must apply to everyone who might need access to the facility. The strongest approach includes all groups that could reasonably enter restricted spaces: facility employees, contractors, and visitors who have appropriate authorization. Employees are on-site regularly and need access to their work areas; contractors come in for maintenance or service and must be verified before entry; visitors may need temporary access for meetings or deliveries and should be escorted or logged. When all three groups are covered, entry points use consistent credentials, verification, and monitoring, reducing the chance of unauthorized access.

Choosing only contractors misses the regular staff; choosing only facility employees misses temporary or service access; choosing only visitors misses both the ongoing workforce and service personnel. Including all three groups ensures comprehensive protection and aligns with common security practices in facility access control.