Security & compliance · 2026-05-26
Do You Know Who Is in Your Office at 11Pm?
Key Takeaways
- Your building does not background-check your night cleaners. Your vendor does, or nobody does.
- Most tenant handbooks require a named worker roster and badge display — not screening. That gap is the vendor's to fill.
- Individually issued, time-fenced credentials produce an audit log. A shared physical key produces nothing.
- Crew consistency is an access control, not a comfort feature: every substitution is a new unvetted person with credentials to your space.
- Server rooms and IT closets should come off the master key entirely, with a restricted-areas exhibit attached to the agreement.
Here is a question worth sitting with for a moment. Between 6pm and midnight tonight, somewhere between two and six people will let themselves into your office. Can you name them? Do you know who checked their background, and against what?
Doesn't the Building Screen Them?
No. This is the assumption almost every tenant makes and it is wrong. Read your tenant handbook: what buildings typically require is a named worker roster and a badge displayed at all times. That is an identification requirement, not a vetting one. The building knows who is in the lobby. It has not checked anything about them.
Which means the entire screening control sits with your cleaning contractor — and if they do not run a real programme, or if they subcontract the work to someone who does not, nobody has checked anyone.
What Should a Real Screening Programme Cover?
Identity trace, county criminal search across every county of residence for seven years, statewide and federal criminal, national sex offender registry, sanctions screening, employment verification and work authorisation. And — the one almost nobody does — re-screening on a defined cadence, annually or biennially. A check run once at hire says nothing about year four.
One useful test: a vendor who says proudly that they “reject anyone with a record” is describing a programme that is unlawful in New York City under the Fair Chance Act. It is a reliable tell that they either do not run a real programme or do not understand the one they run. The compliant version.
Keys or Badges?
Badges, decisively. A physical key is unauditable — you cannot tell who used it, when, or whether it was copied. An individually issued access card produces an event log: this person, this door, this time. Most managing agents will issue them for a per-card fee, and time-fencing them to your service window means a credential used at 3am generates an immediate exception rather than a question nobody can answer.
If you are stuck with keys, the minimum is a restricted keyway, numbered keys issued to named individuals rather than to “the crew”, a signed custody log with timestamps, and a written procedure for a lost key including who pays for the re-key. Full protocol.
Why Does Crew Turnover Matter Here?
Because every substitution is a new person with credentials to your space whom nobody at the building has vetted and whom your team has never met. In an industry where 41% of contractors report annual turnover above 50%, that is not a rare event — it is the normal condition.
Which reframes crew consistency. It is not a nice-to-have about people knowing where the cupboard is. It is an access control, and capping substitutions belongs in the same category as time-fencing a badge. The turnover data.
What About the Server Room?
It should not be reachable at all. Take it off the master key, issue no credential for it, and attach a restricted areas exhibit to the cleaning agreement listing rooms by number with an access rule and who holds the credential. Saying “please don't go in there” is not a control.
If you are going through a SOC 2 audit, this is Common Criteria CC6.4 territory and your auditor will ask. Four documents answer it: the restricted areas exhibit, the current named access list, the entry log, and vendor NDAs with a screening attestation. How to set it up.
Is This Over-Thinking It?
Possibly, for some offices. But the cost of getting it right is close to zero — it is four paragraphs in an agreement you are signing anyway — and the cost of getting it wrong is the kind of incident that ends careers. It is one of the cheapest risk reductions available to a facilities manager.
Frequently Asked Questions
Can we ask to see the crew's background check results?
Not the individual reports — those are protected consumer reports. What you can and should ask for is the written screening policy, the scope of checks performed, the consumer reporting agency used, the re-screening cadence, and a redacted sample adverse-action file.
Should we require NDAs?
For law firms, financial offices, medical practices and anywhere handling confidential material, yes — signed by each individual on your account, not just by the company.
What if our vendor subcontracts?
Require disclosure in writing, and require that subcontracted staff meet the same screening standard with evidence. Also check whether your building's handbook permits subcontracting at all — many do not.
Ready for a Cleaning Contract You Can Actually Read?
Send us your square footage and how many nights you need. You get a written scope, a fixed monthly price, and the SLA in the same document — usually within two business days.