A departing employee hands in a badge, but a mobile credential remains active. A reassigned engineer keeps a key needed for the previous role. A contractor's site contact changes without an update reaching the desk. Each situation shows why personnel changes need a physical-access workflow rather than a single “property returned” checkbox.
For NYC buildings and hotels, the goal is a coordinated, authorized change at the right time, followed by evidence that the intended access state was reached. This guide is part of the key and credential control program. It is an operational template to adapt with the employer, property management, HR, and system owners; it is not employment-law advice.
Start with an authorized change notice
Identify who can initiate and approve the change. The notice should establish the correct person, affected property or properties, relevant assignment, authorized effective time, and the responsible coordination contact. Include a correction path if the identity or scope is wrong. Do not rely on a forwarded rumor or an informal conversation as the sole basis for ending access.
Limit the personnel information distributed to security staff. The team needs the facts necessary to implement the decision and handle questions, not the reasons for an employment decision or unrelated HR records. Apply the property's access restrictions to the notice and its attachments.
NIST SP 800-53 PS-4 addresses credential revocation and retrieval of security-related property when employment ends. PS-5 addresses access review when personnel transfer. These are useful framework controls; their timeframes are organization-defined and do not create a universal NYC offboarding deadline.
Reconcile the person across access records
Build a scope list from authoritative records rather than asking only which badge the person remembers having. Depending on the property, the list may include physical keys, badges or fobs, mobile credentials, temporary replacements, parking or service-area permissions, and shared access knowledge that needs an authorized review.
Match records using the property's reliable person identifier. Similar names, duplicate personnel records, and vendor-company accounts can lead to the wrong access being changed or an old credential being missed. If one credential serves multiple properties, identify the responsible owner for each scope instead of assuming a local change covers the portfolio.
- Compare the current authorization list with issued-asset records.
- Ask system owners to identify associated active credentials.
- Include temporary replacements and unresolved lost-item records.
- Flag shared credentials or shared access knowledge for the approved review process.
Do not publish credential numbers or detailed access scopes in a broadly circulated departure announcement. The operational worksheet and the general staffing update have different audiences.
Separate recovery from revocation
Record the physical handback of each expected item, including the receiving staff member and time. Keep an unreturned item visible as an exception. Collecting one badge does not establish that every key was returned or that the corresponding electronic permission has ended.
The authorized system operator should record the actual access change and how the result was confirmed under the installed system's procedure. Avoid assuming that a central screen update instantly reaches every device or that all mobile and physical credentials behave identically. If a device or system is unavailable, escalate the gap and document the approved interim decision.
| Workstream | Completion evidence |
|---|---|
| Physical recovery | Expected items reconciled with actual returns |
| Electronic permission | Authorized action and confirmation of resulting state |
| Shared access | Reviewed decision by the responsible system or property owner |
| Authorization lists | Current roster or approved-person list updated |
| Open exceptions | Named owner, next action, and follow-up time |
A missing high-access key should enter the missing-key escalation process. Its significance should not be reduced to an administrative note just because the personnel change is otherwise complete.
Coordinate the handoff without exposing personnel details
The desk and incoming shift need the current operational instruction, effective time, point of contact, and any approved response to a future access request. Keep language factual and respectful. Do not turn the handoff into an allegation about the departing person.
For a role transfer, describe the access that remains authorized as well as the access being removed. For contractors, make the provider's personnel-change notification responsibility explicit in the agreement or operating process. NIST PS-7 offers a framework for defining those provider responsibilities, but the property's actual contract and approved arrangements govern the handoff.
Urgent safety concerns require the property's emergency or threat-response procedure. Routine offboarding instructions should not invent a confrontational response or ask a desk officer to make employment decisions.
Close on reconciliation and verification
Assign a reviewer who can compare the authorized request with the resulting records. Where staffing permits, use a person other than the operator who performed the changes. Resolve discrepancies or document an authorized exception with an accountable owner. Do not mark the entire process complete while an unresolved item has simply moved to another inbox.
A later physical-access review can sample departures and role changes to check that the workflow remains effective. Useful measures include missing closure evidence, unreturned items, and unresolved changes by age. Choose internal targets deliberately; do not describe a management target as a statutory deadline.
Retain the necessary evidence under a reviewed retention and access policy. The FTC's guidance for businesses supports limiting personal information to a legitimate need and protecting it appropriately. A useful closure record demonstrates the access decision without becoming an unnecessary archive of sensitive employment details.
