AO coverage. Addresses the Maintenance Personnel objective: maintenance personnel without required access authorization are supervised during maintenance activities.

Who needs an escort. The authorized maintenance personnel list marks each individual as authorized or not for the areas and systems in question. Anyone not on that list as authorized — including long-familiar contractors we have worked with for years, which is the case where discipline usually slips — is escorted. Facilities staff who only need the mechanical room and never the server room are handled by area rather than by exception.

Escort qualification. An escort is a designated employee who is technically able to recognize what the technician is doing, not simply the nearest available body. For work inside the server room the escort is from IT; for electrical and HVAC work the escort is facilities with IT present if the work touches racks, power to racks, or cooling for racks.

During the visit. The escort remains physically present for the entire visit, including breaks and trips to the vehicle. The technician's work is observed directly — screen included when a laptop or console is involved. The escort has explicit authority to stop work, and the visit brief tells the technician that up front so stopping is not treated as an accusation.

Preparation before entry. Where practical, CUI is removed from the immediate work area before the technician arrives: screens locked, printed material cleared, and the specific system placed in a state that exposes nothing. Sessions on nearby workstations are logged out rather than locked when the work will be lengthy.

Record. The escort log records the technician, the sponsoring vendor, the work performed, the escort's name, and entry and exit times, and is cross-checked against badge reads and camera coverage of the server room door.

Maintenance. Quarterly reconciliation of escort logs against badge records to find unescorted entries; annual refresher for the escort pool on what to watch for and when to stop work.

Accepted gap. Overnight janitorial service cannot be escorted for the whole shift within our budget. Instead, cleaning access excludes the server room and the engineering area entirely — those doors are on a separate badge group cleaned during business hours under escort — and the general office areas are covered by clean-desk enforcement and camera coverage.

• Authorized maintenance personnel list with authorization status by area and system
• Escort procedure including escort qualification and stop-work authority
• Escort logs for recent visits with entry and exit times
• Badge group configuration excluding cleaning staff from the server and engineering areas
• Quarterly reconciliation of escort logs against badge reads