Which department typically owns the access control policy for a facility?

• A. Public Relations.
• B. Finance.
• C. Security or Facilities Management, in collaboration with IT for system integration.
• D. Human Resources.

Answer: (C)

Ownership of a facility’s access control policy lies with Security or Facilities Management, with IT providing the technical integration to enforce it. The policy sets who may enter which areas, under what conditions, and how credentials are issued, updated, or revoked, plus how access events are recorded and audited. Security or facilities leadership is responsible for protecting people and assets and for establishing the rules that govern entry to secure spaces. IT must be involved to ensure these rules are actually implemented in the physical access systems—badge readers, door controllers, central management software, and integration with HR for onboarding and offboarding—so the policy is enforceable and auditable. Other departments may contribute information or processes, but they do not own the policy itself.