My question is around best practices and risks regarding labelled employee ID badges and access control systems.
My company is moving into a new office, and it has an access control system with printable RFID keycards. This system uses smartphone and/or keycard to unlock the front door as well as internal doors such as IDF room for authorized staff. There is debate within the IT department to either:
1) Leave the badges plain, so if stolen it's difficult to tell what it is for, or
2) Print on the badges with company name and a picture of the person, so they can later (if the company desires) be used as an employee ID card. This is so if the company pursues ISO27001 compliance, it can easily take care of ID card requirements.
There's a lot of conflicting opinions out there about whether to have a plain badge, or use a DoD-style badge with information clearly on it.
My question is how does the risk of having printed badges balance with ISO and other compliance requirements? Also, If using printed badges, what mitigations should be in place in case of stolen badges?