Access Control Badges -- Plain or Printed IDs?

Question

My question is around best practices and risks regarding labelled employee ID badges and access control systems.

My company is moving into a new office, and it has an access control system with printable RFID keycards. This system uses smartphone and/or keycard to unlock the front door as well as internal doors such as IDF room for authorized staff. There is debate within the IT department to either:

1) Leave the badges plain, so if stolen it's difficult to tell what it is for, or

2) Print on the badges with company name and a picture of the person, so they can later (if the company desires) be used as an employee ID card. This is so if the company pursues ISO27001 compliance, it can easily take care of ID card requirements.

There's a lot of conflicting opinions out there about whether to have a plain badge, or use a DoD-style badge with information clearly on it.

My question is how does the risk of having printed badges balance with ISO and other compliance requirements? Also, If using printed badges, what mitigations should be in place in case of stolen badges?

Answer 1

ISO 27001 recommends following in terms of authentication and securing access:

Two-factor/Multi-factor authentication shall be applied to ensure secure authentication to the most sensitive/critical critical facilities, information systems, and applications.

Example of Two-factor authentication: Card + Pin, Card + Thump (preferred), etc

Hence whether you are going to use plane/printed card it's always recommended to use two-factor authentication to mitigate risks.

Further to your question of whether to use blank cards, the best practice is to print the details of the owner/user of the card as the responsibility of the card should be with the owner/user and it will be used to identify the (part of identification process) user by physical observation in 'visual security checks' (may be at reception/entrance security guards).

Hence It is always recommended to have Two-factor authentication process with printed access cards (could be used as Employee ID card as you've indicated) allowing to have a visual check also top of the Two-factor authentication.

Hope this clarifies...