Site access management is the set of rules, checks and records that decide who may enter a site, what they may do there, and how you prove it afterwards. For a UK service or engineering business, it comes down to four questions. Is this person who they say they are? Are they competent for this task? Have they been inducted and briefed? Can you show all of that to an auditor, client or insurer next month? This guide covers each question and the points where access most often breaks down.
TL;DR
- Site access management is not just a gate or a sign-in book. It links identity, competence, induction, risk documents and a record of who was on site and when.
- On construction sites, CDM 2015 puts the duty on the principal contractor, and the HSE expects site rules and suitable inductions. Contractors visiting your clients' sites will be asked to meet them.
- The weak point is expiry. A certificate, RAMS or induction that was valid on day one may not be valid on day ninety.
- Match the system to the risk: a logbook can be enough for a small, low-risk site, while complex or multi-site work needs digital records.
- Treat the evidence trail as part of the job. If you cannot export it quickly, it will not help you in an audit.
Table of Contents
- What site access management actually covers
- What UK law and the HSE expect
- Why sign-in books are not enough
- Build a tiered zone structure
- Competence is the part most teams under-check
- RAMS: the document that decides who gets in
- Lone workers and out-of-hours access
- Hardware, software and data protection
- A practical process you can run this quarter
- Perspective: access management is an operations problem
- How Curcle fits
- What the software costs in general
- Common mistakes to avoid
- FAQ
- Sources
What site access management actually covers
The phrase gets used in several ways, so it helps to separate them. Search results for it mix physical site security, IT permissions and even company directories. In IT and SharePoint, for instance, "web-only limited access" describes permission levels, which is a different subject from controlling a site gate. This article is about the physical, operational meaning: people, vehicles and contractors entering buildings, plant rooms, construction sites and client premises.
In practice that breaks into five layers:
- Identity: who is this person, and are they employed or engaged by someone you have vetted?
- Competence: do they hold the qualifications, registrations and certificates the task demands?
- Induction and rules: have they been briefed on the site's hazards, routes, emergency arrangements and rules?
- Task documents: is there a current risk assessment and method statement for the work they are about to do?
- Presence and record: when did they arrive, where did they go, when did they leave?
A locked door deals with the first layer at best. Most compliance failures sit in layers two to four.
What UK law and the HSE expect
On construction sites, the Construction (Design and Management) Regulations 2015 require suitable and sufficient safe access to and egress from every construction site, so far as is reasonably practicable. Alongside that, the principal contractor is expected to take reasonable steps to keep unauthorised people out. In practice that usually means a clearly marked reporting-in point, a site-specific induction for everyone, and a record of who is on site so that emergency services and fire wardens know who to account for.
The HSE is plain about the paperwork. Its guidance says the construction phase plan must set out site rules, and suitable site inductions must be provided. Typical site rules cover PPE, radios and mobile phones, smoking, and routes around the site.
Physical perimeter matters too, and it should be proportionate. HSE's public protection guidance notes that a 2 m high fence is an effective barrier for most sites, with exceptions such as city centre or residential locations where children have previously tried to get in. The same document is a useful reminder that controls should match the site's risks. A small site may manage with a logbook and a site manager. A complex project needs something more systematic.
If you are not the principal contractor, you are still affected. Clients and main contractors will ask your engineers to prove competence, hold current RAMS and attend inductions before they are let through the door.
Why sign-in books are not enough
A paper visitor book records that someone turned up. It does not tell you whether their gas, electrical or lifting qualifications were valid that day, whether the RAMS they signed was the current version, or whether they had completed this site's induction. It also fails the practical test: can you produce a clean list of everyone on site in an emergency, and a complete history six months later for an audit?
The more serious problem is drift. The commonly cited risk is the visitor who quietly becomes a regular worker. They arrive for a one-off visit, return weekly, and nobody revisits their paperwork. Site induction guidance makes the same point: access management is not a one-off setup, and qualifications and inductions need continuous monitoring.
Build a tiered zone structure
A flat rule of "everyone with a hi-vis can go anywhere" is how contractors end up in places they should not be. Instead, divide the site into zones and attach a different standard to each:
| Zone | Typical areas | What a person needs |
|---|---|---|
| General circulation | Entrance, welfare, walkways, car park | Site induction completed, correct PPE |
| High-risk | Plant rooms, roof access, confined spaces, live electrical or gas work | Named competence for the task, approved RAMS, briefing |
| Restricted | Isolated systems, hot work areas, energised equipment | All of the above plus a valid permit to work |
This tiered model is common in site access control guidance for working sites. The same source flags a pitfall worth noting: permission propagation delay. If you stand a contractor down, access should end immediately, not at the next overnight sync or the next time somebody checks the spreadsheet.
Competence is the part most teams under-check
Identity checks are easy to picture. Competence checks are where firms slip. For a UK engineering or maintenance business, that means knowing, per engineer and per task:
- Which registrations and certificates they hold, and when each expires.
- Which of those are actually required for the work booked, for example gas, electrical, lifting equipment, refrigerant handling, fire safety or water hygiene.
- Whether subcontractors have supplied evidence, and whether it is still in date.
The NCSC makes a point about digital systems that translates well to the physical world. Identity and access management is about binding a person to a verified identity and applying least privilege, with the strength of verification matching the sensitivity of what is being accessed. Put plainly: the more dangerous or sensitive the area, the more evidence you should require before granting entry, and nobody should have more access than the job needs.
We cover the engineer side of this in more detail in our guide to audit-ready engineer certification tracking, and the gas-specific record requirements in our piece on Gas Safe certificate requirements.
RAMS: the document that decides who gets in
Main contractors and facilities managers often treat RAMS as the gatekeeper. If the risk assessment and method statement are missing, out of date or do not match the task, the work does not start. A sensible precheck looks at the scope, the hazards, the controls, the people named, the equipment and the emergency arrangements, and confirms that the version in hand is the current one.
Our article on RAMS for contractors sets out a five-point precheck that UK principal contractors use before granting access. If you send engineers to other people's sites, read it from the contractor's side: it tells you what you will be asked for.
Lone workers and out-of-hours access
Access management does not end at the gate. Many service engineers work alone in plant rooms, on roofs or in unoccupied buildings. Knowing who is on which site is only useful if someone is also watching for a missed check-in. Tying check-ins to the job record, rather than to a separate phone call or text, means the welfare check and the access record tell the same story. See how to tie lone worker check-ins to jobs for the approach.
Hardware, software and data protection
Physical hardware such as turnstiles, barriers, card readers and biometric scanners handles the moment of entry. Suppliers describe systems that check credentials such as CSCS cards, RAMS and induction status against the gate and can revoke access automatically when documents expire. That level of automation suits large, busy sites with high volumes of people.
If you consider biometrics, take data protection seriously. The ICO has specific guidance on using biometric data for time and access control, and you should read it before deploying anything that captures workers' fingerprints or faces. A card or PIN is often a lower-risk alternative where the site's risk does not justify biometrics.
For most service businesses, the harder problem is not the turnstile. It is the record behind it: who is competent, for what, until when. That is a data problem, and it belongs in the same system that holds your jobs, assets and certificates.
A practical process you can run this quarter
- List your sites and classify them. Mark each as low, medium or high risk, and note who controls access: you, a client or a main contractor.
- Define the zones. For each higher-risk site, write down what counts as general, high-risk and restricted areas.
- Set the entry standard per zone. Name the induction, qualifications, RAMS and permits required.
- Put every engineer and subcontractor on a single register. Include certificates, expiry dates and induction dates.
- Set expiry alerts well ahead of the date. A warning on the day itself is too late to rebook training.
- Link access to the job. An engineer should only be dispatched if the competence required for that job is in date.
- Test the revocation path. If you stood someone down today, how long until their access really stopped?
- Rehearse the audit. Pick a job from three months ago and see how fast you can produce who attended, what they held, which documents applied and when they left.
For the last step, our guide to audit-ready reporting shows what a good export looks like.
Perspective: access management is an operations problem
We built Curcle inside a real UK service and engineering business, so we have seen how site access goes wrong from the inside. It rarely fails at the gate. It fails because the information that should govern the gate lives in four places: a spreadsheet of certificates, an email with the RAMS, a calendar with the schedule and a folder of scanned inductions. None of them talk to each other.
Our view is that access decisions should come from the same record as the job. If an engineer's certificate lapses, the system should show that before they are dispatched, not after a client turns them away. Compliance should sit in the backbone of the platform rather than be bolted on afterwards. And software should help you see what needs attention, not just record what has already happened.
We are also cautious about over-engineering. A small firm with a few low-risk sites does not need turnstiles. It needs a current register, clear rules and a way to prove what happened. Every step you add should earn its place.
— Luke Herridge
How Curcle fits
Curcle is a field service platform for UK engineering, maintenance, facilities and other compliance-led service businesses. It brings jobs, customers, engineers, assets, compliance, stock, quoting and invoicing into one system, with an offline-capable mobile engineer app, audit trails, document and photo capture, and reporting. That means the competence, certificate and job records that should govern site access sit alongside the work itself. It does not replace physical gate hardware, and we would not claim it does. It gives you the record those decisions depend on.
Plans are published on the pricing page: Starter from £99 per month, Professional from £249 per month and Business from £499 per month, with Enterprise priced on request. If you run multi-site facilities contracts, our facilities management software page shows how SLA and compliance tracking work across sites, and the compliance inspection page covers recurring audits and renewals. Security details are on our trust and security page.
What the software costs in general
For context, one industry roundup suggests mid-market visitor and access tools typically run from £100 to £500 per month, with premium enterprise systems exceeding £4,000 per year per location. Costs rise with contractor onboarding, permit-to-work modules and integrations. Those figures cover visitor-management products specifically, so compare like with like: ask what the tool records about competence, not only who walked in.
Common mistakes to avoid
- Treating induction as a one-off. Re-induct when the site, the plan or the risks change.
- Trusting the certificate you saw once. Record the expiry, not just the fact that you saw it.
- Giving blanket access. Least privilege applies to buildings as well as to IT.
- Keeping separate lists for each client. One register per person, with each client's requirements layered on top.
- Ignoring revocation. Test how quickly you can remove access, then fix the delay.
- Collecting biometric data without a clear need. Check the ICO guidance first.
FAQ
What is site access management?
It is the process of deciding who may enter a site, confirming they are competent and inducted, and recording their presence. It combines identity checks, qualifications, site rules, risk documents and an attendance record. On construction sites, it is tied closely to the principal contractor's duties under CDM 2015.
Does a visitor sign-in book meet UK requirements?
For a small, low-risk site, a logbook managed by a competent site manager may be proportionate. HSE guidance stresses that arrangements should match the risks. On complex or high-risk sites, a book on its own does not show competence, induction status or current RAMS, so most firms add digital records.
What should a site induction cover?
The HSE says site rules should cover topics such as PPE, radios and mobile phones, and smoking, among others. A good induction also covers access and egress routes, emergency arrangements, welfare facilities and the hazards specific to the site. It should be recorded against the individual.
Can I use biometric access for my engineers?
You can in some circumstances, but it involves special category data under UK GDPR, so you need a clear justification and a lawful basis. Read the ICO's guidance on biometric time and access control first. For many service businesses, cards or PINs achieve the same goal with less risk.
How do I stop expired certificates reaching site?
Keep one register of every engineer's and subcontractor's qualifications with expiry dates, set alerts well before they lapse, and check competence at the point of dispatch. Doing this in the same system as your job scheduling means the check happens automatically rather than relying on someone remembering.
Sources
- The Construction (Design and Management) Regulations 2015, regulation 17
- HSE: Site rules and induction
- HSE: Protecting the public (HSG151)
- NCSC: Introduction to identity and access management
- ICO: Biometric data for time and access control
- Site induction pack checklist (swiftRMS)
- Site access control guide (Site Commander)
- Access control solutions (Synel UK)
- Web-Only Limited Access in SharePoint Online
- Best visitor management systems (Elia)