Legal Considerations in Access Control

Legal Considerations in Access Control Implementation

When implementing an access control system, there are important legal considerations that need to be taken into account. Adequate security of information and information systems is a fundamental responsibility for us. Access control plays a vital role in determining the activities allowed for legitimate users and mediating any attempts to access system resources.

In order to ensure the integrity of access control configurations, it is crucial to prevent unauthorized principles from gaining access to sensitive permissions.

This is where legal frameworks such as the General Data Protection Regulation (GDPR), Sarbanes-Oxley Act (SOX), Health Insurance Portability and Accountability Act (HIPAA), Gramm-Leach-Bliley Act (GLBA), Family Educational Rights and Privacy Act (FERPA), California Consumer Privacy Act (CCPA), and New York SHIELD Act come into play. These frameworks provide guidelines and requirements for the implementation of access control.

By adhering to these legal considerations, we can safeguard the privacy and security of data, ensure compliance with relevant regulations, and mitigate the risk of data breaches. In the following sections, we will explore specific compliance requirements related to GDPR, SOX, HIPAA, and the importance of access control in meeting these obligations.

For organizations operating in India, implementing access control requires compliance with a rapidly evolving legal landscape. The primary framework governing data security and access management is the Digital Personal Data Protection (DPDP) Act, 2023, supported by rules from the Indian Computer Emergency Response Team (CERT-In)

Core Door Components & Specifications

Locking Mechanism (Magnetic Lock / EM Lock): Use a minimum of 600 lbs (272 kg) holding force for internal doors, and 1200 lbs (544 kg) for perimeter doors. They must be wired as Fail-Safe (drops lock instantly when power cuts).

Egress Switch / Request to Exit (REX) Sensor: A PIR (Passive Infrared) motion sensor mounted on the secure inside frame. It automatically unlocks the door when someone approaches from the inside to exit.

Emergency Door Release (Break-Glass type (Green)): A physical manual override switch placed on the exit side of the door. Breaking the glass must physically cut power to the EM lock, bypassing all software or controller failures. Mount exactly adjacent to the door frame at 1.2 meters for easy reach during a fire evacuation.

Door Status Monitor (Magnetic Contact): A sensor that detects whether the door is physically open or closed. This is the hardware component that triggers the "Door Held Open Too Long" or "Forced Entry" alerts in your SOP.

Readers & Biometrics: Mount at 1.2 meters (4 feet) from the finished floor level. This complies with accessibility guidelines for differently-abled employees.

Access Management Software: While the physical locks and readers handle the hardware execution, the Access Management Software acts as the central brain of the entire door infrastructure. Without it, the hardware cannot enforce permissions, log events, or remain legally compliant.

1. Core Software Modules for Door Control

·        Credential Mapping Engine: Links an individual’s identity (Employee ID, Visitor Pass) to specific door controllers. It dictates who can open Door A but not Door B.

·        Time Zone & Access Level Manager: Restricts access by time. For example, standard employees can open doors from 9:00 AM to 6:00 PM, while the server room door requires 24/7 restriction.

·        Real-Time Event Viewer: Captures and displays active door states (e.g., "Door 01: Access Granted to User X" or "Door 04: Forced Entry Alert").

2. Software Configurations Required by Indian Law

Anti-Passback (APB) Engine (Prevention of Tailgating)

·        How it works: The software tracks the "In/Out" status of a credential. If a card is swiped at an entry reader, the software will block that same card from being used to enter again until it logs an exit swipe at the corresponding exit reader.

·        Legal Value: Prevents employees from passing their badge backward to let an unauthorized person into the facility, ensuring audit logs remain accurate for liability tracking.

Automated Data Lifecycle Management (DPDP Act Compliance)

·        Consent Flagging: The software user database must feature a mandatory checkbox or field indicating that biometric consent was explicitly captured.

·        Auto-Purge Rules: The system must be configured to automatically delete inactive user profiles (e.g., terminated employees or expired visitor profiles) from the local memory of the edge door controllers after a set period.

NTP Time Sync & Forensic Auditing (CERT-In Mandate)

·        Server-to-Controller Sync: The software must continuously broadcast the synchronized NIC/NPL network time down to every connected door controller panel.

·        Log Locking: Access logs stored within the software database must be configured as Read-Only / Append-Only. No administrator or security guard should have the software permissions to alter, edit, or delete a door access log event.

3. Hardware-Software Communication Security

·        Encrypted Protocols: The software must communicate with edge door controllers using encrypted protocols (like TLS 1.3 for network communication and OSDP - Open Supervised Device Protocol for the wiring between the reader and the door panel).

·        Legacy Risk: Avoid older Wiegand wiring configurations in your software setup, as Wiegand transmits card data in clear text, making it vulnerable to physical wire-tapping.

General Data Protection Regulation (GDPR) Compliance

The General Data Protection Regulation (GDPR) is a privacy regulation that safeguards the personal data of European Union (EU) citizens. As organizations collect and store personal data, it is crucial to prioritize customer awareness, consent, and data security to comply with the GDPR’s requirements.

When implementing an Identity and Access Management (IAM) solution for GDPR compliance, access management, access governance, authentication, and identity management should be key components. By incorporating these elements, organizations can effectively track access to personal data, manage access rights based on organizational changes and customer preferences, and empower consumers to exercise their rights to restrict data collection.

Key Considerations for GDPR Compliance:

1.   Customer Awareness: Organizations must inform individuals about the purpose and consequences of personal data collection, ensuring they are aware of their rights under the GDPR.

2.   Consent Management: Obtaining explicit and informed consent from individuals before collecting and processing their personal data is crucial for GDPR compliance.

3.   Data Security: Implementing robust security measures to protect personal data from unauthorized access, loss, or disclosure is essential.

4.   Access Management: Organizations should implement a comprehensive access management system to ensure that only authorized individuals can access personal data.

5.   Access Governance: Regularly reviewing and updating access rights based on organizational changes and customer preferences helps maintain compliance and prevent data breaches.

6.   Authentication: Implementing strong authentication mechanisms, such as multi-factor authentication, enhances security and strengthens GDPR compliance.

7.   Identity Management: Effective management of user identities and roles helps control access to personal data and maintain compliance with the GDPR.

By adhering to GDPR compliance requirements, organizations can demonstrate their commitment to data privacy and protection, fostering trust among their customers and avoiding potential legal consequences.

Sarbanes-Oxley Act (SOX) Compliance

The Sarbanes-Oxley Act (SOX) is a crucial legislation that aims to prevent corporate fraud and ensure the integrity of financial reporting for publicly-traded organizations, especially within the financial services sector. SOX compliance is of utmost importance to maintain data security and protect against financial malpractice.

For organizations to meet SOX compliance requirements, implementing robust IAM (Identity and Access Management) solutions is essential. These solutions enable centralized administration of access management and provide granular access controls, ensuring that only authorized personnel can access sensitive financial data.

Key Components for SOX Compliance:

1.   Centralized Administration: IAM solutions offer centralized administration, allowing organizations to efficiently manage user access rights and permissions.

2.   Separation of Duties (SoD) Policies: Implementing SoD policies ensures that no individual has complete control over financial reporting, minimizing the risk of fraudulent activities.

3.   Regular Auditing: Regular auditing helps to identify any potential access control gaps or vulnerabilities and ensures continuous compliance with SOX requirements.

4.   Logging and Tracking Tools: IAM solutions provide logging and tracking capabilities, allowing organizations to monitor user activity and track any unauthorized or suspicious access attempts.

5.   Granular Access Controls: IAM solutions enable organizations to define and enforce granular access controls, ensuring that users have appropriate access levels based on their roles and responsibilities.

By implementing IAM solutions for SOX compliance, organizations can significantly reduce the risk of data breaches and protect the integrity and security of their financial reporting processes.

Health Insurance Portability and Accountability Act (HIPAA) Compliance

HIPAA, the Health Insurance Portability and Accountability Act, plays a crucial role in protecting the privacy and security of protected health information (PHI) collected and stored by healthcare organizations. As healthcare data security becomes increasingly important, it is essential for organizations to implement robust IAM solutions that ensure HIPAA compliance.

An IAM solution designed for HIPAA compliance should prioritize credential protection, offering secure authentication methods to prevent unauthorized access. Additionally, the solution should provide multiple ways to onboard healthcare business partners, facilitating seamless collaboration while maintaining the integrity of PHI.

Centralized access governance is another critical component of HIPAA compliance. This ensures that access to protected health information is granted only to authorized healthcare providers, minimizing the risk of data breaches. Access logging and automated reporting mechanisms further enhance healthcare data security, allowing organizations to track and monitor access to patient records and generate comprehensive audit reports for HIPAA compliance purposes.

The DPDP Act, 2023 Compliance

·        Data Fiduciary Obligations: Organizations (Data Fiduciaries) must implement reasonable security safeguards to prevent personal data breaches, making strict logical and physical access controls a statutory mandate.

·        Purpose Limitation: Access to personal data must be strictly limited to the specific purpose for which the individual (Data Principal) gave consent.

·        Notice and Consent Management: Access control systems must integrate with consent management modules to dynamically revoke or grant employee access based on the user's current consent status.

·        Significant Data Fiduciaries (SDFs): If classified as an SDF by the government, your organization must appoint an independent Data Auditor to review your access logs and security frameworks regularly

CERT-In Cyber Security Directions

·        Mandatory Logs: Under the CERT-In directives, companies must securely maintain ICT system logs for a rolling period of 180 days.

·        Local Time Synchronization: All access control logs, server timelines, and identity management systems must connect to a standard time source using National Informatics Centre (NIC) or National Physical Laboratory (NPL) time servers to ensure legally defensible forensics.

·        Incident Reporting: Any unauthorized access that leads to a cyber incident or data breach must be reported to CERT-In within 6 hours of identification

Sector-Specific Regulations

·        Banking and Finance (RBI): The Reserve Bank of India mandates strict multi-factor authentication (MFA), role-based access control (RBAC) for core banking systems, and continuous privilege access management (PAM) monitoring.

·        Healthcare (DISHA / ABDM): Under the Ayushman Bharat Digital Mission, access to electronic health records requires patient consent, explicit digital signatures, and granular view-only permissions for medical practitioners.

Core Legal & Technical Principles

·        Principle of Least Privilege (PoLP): Users and devices must be given the minimum level of access required to perform their duties, preventing privilege creep and reducing the impact of a breach.

·        Identity and Access Management (IAM): Automating provisioning and deprovisioning is legally critical. Lingering access for former employees is one of the most common grounds for liability in negligence claims following a data breach.

·        Audit and Accountability: Legal defensibility requires undeniable proof of due diligence. Systems must log all access attempts, approvals, and denials, and keep this data secured against tampering

Legal Liabilities for Non-Compliance

·        Statutory Penalties: The DPDP Act penalises the failure to observe reasonable security safeguards to prevent data breaches with fines up to ₹250 Crore.

·        Criminal Liability: Section 66C (Identity Theft) and Section 66D (Cheating by Personation) of the Information Technology Act apply directly to individuals using stolen or unauthorized access credentials

Life Safety & Hardware Fail-Safe Integrity

·        Wire Fail-Safe Locks: Ensure all electromagnetic locks on emergency exit routes are wired as Fail-Safe (loss of power automatically cuts lock magnetism to open the door).

·        Integrate Fire Alarm Override: Connect the central Fire Alarm Control Panel (FACP) directly to the PACS power supplies via a physical relay. Triggering a fire alarm must cut power to all access-controlled exit doors instantly, independent of software status.

·        Install Break-Glass Units: Place green, emergency break-glass manual overrides next to every secured exit door along the evacuation route to bypass software crashes.

Privileged Access Management

Privileged Access Management 

Privileged access management (PAM) is defined as the provisioning of tools that help organizations manage and secure accounts that have access to critical data and operations. Any compromise in these ‘privileged’ accounts can lead to financial losses and reputational damage for the organization.

Every organization’s infrastructure is built with multiple levels of deployments, data stores, applications, and third-party services. Some of these components are critical for operations, while some may be as mundane as email.

But each of these is accessed by user accounts, which are of two types:

Human users: They are typically employee accounts, encompassing all departments, including HR, DevOps, and network administrators. 

Automated non-human users: These are third-party applications and services that require an account to integrate with the organization’s systems.

‘Privilege’ is defined as the authority that an account has to modify any part of the company’s technology architecture, starting from individual devices to the office network. This privilege allows the bypassing of security restraints that are normally applied across all accounts.

A standard account is a norm among employees, with the least privileges attached to it. These accounts are used to access and operate limited resources such as internet browsing, emails, and office suites. A privileged account possesses more capabilities than a standard account. This elevated access is gained using privileged credentials.

Despite the numerous headline-making incidents in recent years, cybercrime continues to rise with reported data breaches increasing by 75% over the past two years. For those that suffer a breach, the repercussions can be costly:

increased public scrutiny, costly fines, decreased customer loyalty and reduced revenues. It is no wonder that cybercrime has risen towards the top of the concern list for many organisations and the customers with whom they do business.

You’ve heard many of the stories. Equifax, Uber, Facebook, My Heritage, Under Armor, and Marriott. Personal data from millions of their customers was stolen. Even though the number of breaches went down in the first half of 2018, the number of records stolen increased by 133 percent to almost 4,5 billion records

worldwide. Unfortunately things are only likely to get worse. According to a 2018 study from Juniper Research, an estimated 33 billion records will be stolen in 2023 – this represents a 275 percent increase from the 12 billion records

that are estimated to have been stolen in 2018.

Are you ready for more bad news? Thanks to the demands of the application economy, the threat landscape has expanded and protecting against these threats has only gotten more challenging.

Victims of the future

Digital transformation is a necessity for organisations to not only survive, but thrive in the application economy. But these transformations are creating an expanding set of new attack surfaces that must be defended, in addition to the

existing infrastructure that you’ve been protecting for years. These new points of vulnerability include:

DevOps adoption: In more sophisticated IT shops, continuous delivery/ continuous testing practices have introduced automated processes that see no human intervention at all. In many cases, these scripts or tools are often using hard-coded administrative credentials that are ripe for theft and misuse.

Hybrid environments: As your IT environment has evolved to include

software-defined data centres and networks, and expanded outside of your four walls to incorporate public cloud resources and software-as-a-service (SaaS) applications, the traditional way of approaching administration and management quickly falls apart – mainly because it fails to protect new attack surfaces like management consoles and APIs.

Internet of Things: Smart devices are proliferating in our lives, from phones to watches, from refrigerators and cars to medical implants and industrial machinery. And because these devices have connectivity, not only can they be hacked, but they are already being compromised where security is inadequate or non-existent.

Third-party access: Outsourcing development or IT operations has become the

norm. In addition, many companies are sharing information with partners. However, many of these third-party employees are being granted ‘concentrated power’ via administrative access. Who is watching how they are using or potentially misusing that access?

Take hold of the flame

Stealing and exploiting privileged accounts is a critical success factor for types of attacks. This is not surprising when one considers that privileged identities have access to the most sensitive resources and data in your environment; they literally hold the keys to the kingdom.

Thankfully, there is a positive angle you can take on this fact. If privileged accounts are the common thread amongst the innumerable attack types and vulnerability points, then these accounts – and the credentials associated with them – are exactly where you should focus your protection efforts.

For many, focusing on ‘privileged users’ is difficult because its population can be so diverse. Privileged accounts and access are not just granted to employees with direct, hands-on responsibility for system administration, but also to contractors and business partners. You may even have privileged unknowns who are securing ‘shadow IT’ resources without your knowledge. And finally, in many cases, privileged accounts aren’t even people – they may be applications or configuration files empowered by hard-coded administrative credentials.

This begs the question, if you can’t even get a clear tally of who represents your privileged user population, how can you hope to protect these accounts?

By securing those accounts at each stop along the breach kill chain.

Breaking the chains

What is a kill chain? It’s the series of steps an attacker typically follows when carrying out a breach. While the chain can comprise numerous steps, there are four key ones in which privileged credentials represent the cornerstone of an attack. These include:

1. Gain access and expand: To access the network, insiders might exploit the credentials they already have, while outsiders will exploit a vulnerability in the system to steal the necessary credentials.

2. Elevate privileges: Once inside, attackers will often try to elevate their privileges, so they can issue commands and gain access to whatever resources they’re after.

3. Investigate and move laterally: Attackers rarely land in the exact spot where the data they’re seeking is located, so they’ll investigate and move around in the network to get closer to their ultimate goal.

4. Wreak havoc: Once they have the credentials they need and have found exactly what they’re looking for, the attackers are free to wreak havoc (e.g. theft, business disruption, etc.).

If you can prevent an unauthorised user – insider or outsider – from gaining access to the system in the first place, you can stop an attack before it even starts.

To prevent unauthorised access, you must:

• Store all privileged credentials in an encrypted vault and rotate these credentials on a periodic basis.

• Authenticate all users, applications, and services before granting access to any

privileged credential.

• Employ automatic login and single sign-on so users never know the privileged credential.

Limiting privilege escalation

In many networks, it’s common for users to have access to more resources than they actually need – which means attackers can cause maximum damage quickly and even benign users can cause problems inadvertently. This is why granular access controls are so important.

To limit privilege escalation, you must:

• Adopt a ‘zero trust’ policy that only grants access to the systems people need for work.

• Implement filters and white/black lists to enable fine-grained access controls.

• Proactively shut down attempts to move laterally between unauthorised systems.

Monitoring privileged activity

Whether it’s a trusted insider who wandered into the wrong area or an attacker with malicious intent, there’s a very good chance that at some point users will gain access they shouldn’t have.

The challenge, then, is to improve visibility and forensics around user activity within sensitive systems. To deter violations at this late stage of the kill chain, you must:

• Ensure that all privileged access and activity is attributed to a specific user.

• Monitor all privileged activity to proactively detect unusual behaviour and trigger automatic mitigations.

• Record all user sessions so that all privileged activities can be played back in DVR-like fashion.

• Review and certify privileged access on a periodic basis to ensure that it is still required.

Risk Assessment & Quality Control Procedure For Access Control System

Risk Assessment & Quality Control Procedure For Access Control System 

A security risk assessment plays a critical role in evaluating the vulnerabilities and potential risks associated with access control systems. Our expertise in premises security allows us to assist organizations in identifying, analyzing, and implementing effective security controls to safeguard their assets.

When conducting a risk assessment, several factors come into play, including the size of the organization, its growth rate, available resources, and the nature of its asset portfolio. By conducting a comprehensive security assessment, we help organizations identify their critical assets, assess potential risks, implement mitigating controls, and proactively prevent threats and vulnerabilities.

Industries such as healthcare, finance, and government have specific regulatory requirements, such as HIPAA, PCI-DSS, and Sarbanes-Oxley Audit Standard 5, that mandate security risk assessments. With our expertise, we can ensure that your organization complies with these regulations while enhancing the overall security of your access control systems.

Quality Control Procedure For Access Control System

1.0   SCOPE:                                                                                                                      .

This procedure applies to all the inspection activities related to monitoring and measurement of products and Processes related for the Installation or testing of subject activity where applicable for the project and Applicable to:

 

·        Method Statement.

·        Quality Control Procedure.

·        Inspection and Test Plans.

·        Risk Assessments

·        FORMS.

 

2.0   PURPOSE:

The purpose of this procedure is to :

o   Identify processes / products those are to be installed before using them in intended application.

o   Define the methods to verify the quality of products and ensure that products that meet the stated requirements are only used in the intended application.

o   Define the responsibilities of concerned personnel related to quality control processes.

 

3.0   REFERENCES

 

Project Quality Plan

Material Approvals

4.0   DEFINITIONS:

                           PQP                                      : Project Quality Plan.

               PSP                                      : Project Safety Plan.

               QCP                                     : Quality Control Procedure.

               HSE                                     : Health, Safety and Environment

               MS                                       : Method Statement

               ITP                                       : Inspection Test Plan

               QA/QC                                : Quality Assurance / Quality Control Engineer.

               SK                                        : Store Keeper

               WIR                                     :  Work Inspection Request

               MIR                                     : Material Inspection Request.

               MAR                                    : Material Approval Request

       

 

5.0 RESPONSIBILITIES:

 

5.1 Project Manager

 

-   Project Manager is the overall responsible for the project in terms of work execution, safety, planning & quality. The Project Manager will maintain the planning progress and coordination of works with the main contractor.

 

-   The work progress shall be carried out as per planned program and all the equipment’s required to execute the works shall be available and in good condition as per project planned.

-   Specific attention is paid to all safety measures and quality control in coordination with Safety Engineer and QA/QC Engineer and in line with PSP and PQP.

5.2 Construction Manager

 

-        Construction Manager is responsible to supervise and control the work on site.

-        Coordinating with QA/QC Engineer and site Team and foremen for all activities on site.

-        Control and sign all WIR’s before issuing to Consultant approval.

5.3 Site Engineer

 

-   The method of statement to the system shall be implemented according to the Consultant project specifications and approved shop drawings.

-   Provision of all necessary information and distribution of responsibilities to his Construction team.

-   The work progress shall be monitored in accordance with the planned work program and he will provide reports to his superiors.

-   The constant coordination with the Safety Engineer to ensure that the works are carried out in safe working atmosphere.

-   The constant coordination with the QA/QC Engineer for any works to be carried out and initiate for the Inspection for the finished works.

-   He will ensure the implementation of any request that might be raised by the Consultant.

-   Efficient daily progress shall be obtained for all the equipment and manpower.

-   He will engage in the work and check the same against the daily report received from the Foremen.

-   The passage of all the revised information to the Foremen and ensure that it’s being carried out properly.

5.4 QA/QC Engineer (MEP):

 

-   The monitoring of executions of works at site and should be as per the approved shop drawings and project specifications.

-   Ensure WIRs and MIRs are being raised for activities in timely manner and inspected by the Consultant.

-   Check and insure that all activities / work done / completed prior to offer for consultant inspection.

-   He will follow and carried out all the relevant tests as per project specifications.

-   Obtain the required clearance prior to Consultant’s inspections.

-        Should acquire any necessary civil works clearances and coordination.

-        Coordinate with site construction team.

-        One who will assist the Consultant Engineer / Inspector during inspection.

5.5 Site Foreman

 

-   The carrying-out of work and the proper distribution of all the available resources in coordination with the Site Engineer on a daily basis.

-   Daily reports of the works are achieved and coordinated for the future planning with the Site Engineer.

-   Incorporate all the QA/QC and Safety requirements as requested by the concerned Engineer.

-   Meeting with any type of unforeseen incident or requirement and reporting the same to the Site Engineer immediately.

5.6 Safety Officer

 

-   The implementation of all safety measures in accordance with the HSE plan and that the whole work force is aware of its proper implementation.

-   The implementation of safety measures is adequate to maintain a safe working environment on the work activity.

-   Inspection of all the site activities and training personnel in accident prevention and its proper reporting to the Construction Manager and the Project Manager.

-   The site is maintained in a clean and tidy manner.

-   Ensure only trained persons shall operate the power tools.

-   Ensure all concerned personals shall use PPE and all other items as required.

-   Ensure adequate lighting is provided in the working area at night time.

-   Ensure high risk elevated areas are provided are barricade, tape, safety nets and provided with ladders.

-   Ensure service area/inspection area openings are provided with barricade, tape, and safety nets.

-   Ensure safe access to site work at all times.

5.8   Store Keeper (SK)

 

-   Responsible for overall Store operations in making sure to store the material delivery to the site and keep it in suitable area that will keep the material in safe from rusty and damage.

-   One who will acknowledge the receiving of materials at site in coordination with QA/QC and concerned Engineer.

       5.9   Emergency Absents

 

-   If QA/QC not available the adequate QA/QC Engineer will be responsible for quality control activities.

-   If the P.M. not available the Construcion manager will be resposible for all of his activities.

-   If the HSE Engineer not available the adequate HSE Engineer are resposible for safety activities.

-   If Engineer not available Construction manager will assign his duties to the concerned supervisor, forman or alternate Engineer.

-   Replacing staff, in case of absent, with another designation can be accepted only for a minimum period of days absent otherwise the Contractor shall replace the relevant person with same designation which required approval from CONSULTANT.

      6.0  PROCEDURE:

-   Check that all the following documentations have been approved by the Consultant to proceed with the installation activities:

 

·  Quality Control Procedure     

·  Method Statement                 

·  Inspection Test Plan              

·  Check List                                        

·  Risk Assessment                                           

·  Shop Drawing Submittals related to work

 

-   Check all the delivered materials are inspected and approved by the Consultant’s Engineer.

-   Ensure that the respective work area has been cleared by previous trades for start-up installing the system.

-   Ensure that the installation of the material is as per approved shop drawings, approved method statement, Manufacturer’s recommendation, and prevailing quality standards.

-   Ensure the following checks are performed during the installation progress:

-   Check all materials are as per approved submittal.

-   Check all Material are installed as per approved shop drawings.

-   Check if coordinated with other services.

-   Check installation if it is carried out as per approved method statement.

-   Check that the system checked and approved by Consultant.

-   Ensure WIRs are issued on time without delay. (Min. 24 Hours notice for site inspection).

-   Ensure all inspection is performed as per approved Inspection Test Plan.

-   Check ITP, Check List, WIR, and NCR (if any) are signed off and cleared by the Consultant Engineer.

7.0 ATTACHMENTS

7.1 Method Statement                                   

7.2 Inspection and Testing Plan                                               

7.3 Check List for Installations

7.4 Risk Assessment                                                   

7.5 Attachments:

7.5.1 Manufacturer recommendations.

7.5.2 Emergency Evacuation Plan.

                    7.5.3 Technical Details.