Does anyone have a policy of having a sign in sheet at every branch to record all visitors to the office? What is your policy on who must log in and when?

no. That would be a lot of monitoring.

We require any non-bank employee who is accessing non-public areas to sign the visitor log.

Many many banks (including very large banks) use visitors' logs and visitors' badges. Many regulators at some point will require them.

Aside from any banking security reason, if there is a disaster you will know who was in the building (or a good idea of who might have been in the building).

We don't log anyone that comes into the branches, but we do log everyone that comes into our corporate building, including employee children, spouses, etc. They all have to read and acknowledge the confidentiality agreement.

Ditto- Any vendors who must go behind the teller line sign a vendor log. Most of our vendors are the same people over and over (ATM servicing, cleaning our coin machine, Etc) so the first time they come we take a copy of ID and it stays on file.

My current bank doesn't log anyone. My prior bank kept a log of everyone who accessed non-public areas. I believe my current bank should, but...

And have you made the recommendation? Perhaps it is a case of "we've never had this problem before..." but social engineering can bite you especially this way. We had a story in Tech Talk (I believe) some time ago about a fellow who actually took over a meeting room in the company's building as he gathered data. And when many employees saw calls from in the building, they revealed all that was asked of them.

The recommendation has been made by myself (Compliance Officer), the Information Security Officer (prior and current) and the Physical Security Officer, but management refuses to "change the personality" of the Bank. There are many other security issues that have been brought to management’s attention that they refuse to do anything about, but I shouldn’t discuss those in an open forum.

You are not alone. Many banks won't take action on this topic until something happens or their regulator pushes them on it, at which time they will have to do more than if they had just put some security controls in place themselves.

I agree Kathleen. If they regulator has to tell you to do something rather than you doing it yourself you will always end up doing more work than you would have if you had just put something in place yourself. I just can't get through to management on that one.

We are an extremely customer friendly, small (and rural) bank. A vendor log was recommended by audit at the time there were many unknown workmen in the building with various bags of all sizes and shapes. In this age/time, no one batted an eye about the requirement to sign a log including date, name, purpose and business name with times in and out. The log is still operational and one more thing that can help protect the bank and bank assets.

I am curious how others are having non-bank personal sign in. Are you have them sign in themselves or are you have an employee enter their information into some sort of tracking spread sheet?

I can't see having a person log themselves. If a person want to go to your server room or adjust security cameras, you want to know that they were expected or needed, you want a name, a company, see an ID, etc.

Many banks that have a paper signin book have you sign yourself in (in front of a bank representative who is at the desk) - which entails your name, your company, time, who you are seeing, etc.

You show ID.

They call the person expecting you and you wait.

Others who are computerized enter that data. They call the person and you wait.

You don't just wander off into the building.