At the city's 24/7 911 center, relief dispatchers share badges so the next person can get in. How should the CHRO evaluate access-control strategy?
Select an answer to reveal the explanation.
Short Explanation
Sharing a 911 badge is like leaving the station key on a hook labeled anyone. Thin staffing does not make a shared credential a control. Each person needs their own access that still works when relief walks in.
Full Explanation
Shared credentials break access-control strategy because they destroy accountability and allow unknown holders through a secured perimeter. Treating badge sharing among relief dispatchers at a 24/7 911 center as a security-strategy failure—and issuing individual, time-bound access that still covers relief—keeps employee security intact under continuous operations. Convenience is a design constraint, not permission to pool badges.
Allowing badge sharing on night shift because staffing is thin institutionalizes the failure on the highest-risk hours. Replacing badges with a posted door code that never changes creates a static secret anyone can learn and share. Collecting all badges at the supervisor desk and handing them from a bowl recreates pooled credentials with a different prop.
Exam caveat: time-bound access for relief must be provisioned fast enough that crews do not revert to sharing; process speed is part of the control. Operational check: disable shared-badge practices in policy, issue unique credentials with relief activation steps, and audit door logs for the same badge used across overlapping identities. Document ownership so auditors can see who maintains the control.