The practical test is a fictional handoff. Give an incoming colleague a record from the middle of a busy day and ask them to continue without opening a private chat. They should know what is affected, what must remain paused, which customer-facing statement is safe, and when to ask for a manager. For key custody, rehearse the awkward branch: a key is handed over verbally and the next shift cannot establish who had it. A process that only works when everything is normal is not a process yet.
Evidence context for this decision
Question and population What can an access-control log establish about a cannabis facility entry? The unit is one authenticated access event at one door or zone during a defined period. The population is all access events expected from the system, including denied and system-generated events. Reviewing only successful entries hides attempted access and system gaps. Virginia cannabis oversight, NIST access-control guidance, CISA physical-security resources, and ISO security principles support attributable access and review. They do not establish that a particular access event was authorized in every factual sense. A credential can be shared, a clock can drift, and a door can be propped open after an event. ## Evidence model Retain credential identity, door or zone, event type, timestamp and time zone, system source, result, reviewer, and linked incident or maintenance record. Check clock synchronization across systems before comparing access with inventory, camera, or point-of-sale events. Preserve the raw event and any normalized timestamp. Useful measures include denied events per 100 successful events, events outside approved schedules, and unresolved exceptions per review period. These are operational indicators, not crime rates. A high denied-event count may indicate forgotten credentials or configuration problems. A low count may reflect incomplete logging. | Log evidence | Supports | Does not establish | | --- | --- | --- | | Credential and door | System recorded an access event | Human intent | | Denial | System rejected an attempt | Identity of the person at door | | Schedule exception | Event differs from policy window | Unauthorized conduct | | Corroborating record | A fuller timeline | Complete certainty | ## Interpretation and limits Investigate patterns with proportionality. Compare maintenance windows, shift schedules, badge changes, and camera evidence before attributing a cause. A single schedule exception is a review trigger, not a conclusion. Avoid treating an access log as a personnel-performance score without accounting for role and legitimate duties. Transfer is bounded by system architecture, jurisdiction, retention rules, and credential practice. NIST guidance is a control reference, not a Virginia legal determination. Personal access data should be restricted to the legitimate review purpose and retained according to applicable policy. ## How to compare events without overclaiming The first analytical decision is whether the log is a complete population or a sensor view. A controller may record badge presentations but not a mechanical door opening after a valid release. Another system may record forced-open alarms but omit a door that has lost power. Before calculating an exception rate, document which event types are collected, which doors are excluded, and whether the system was online for the entire period. A denominator built from incomplete coverage gives a precise-looking but misleading result. Time alignment is equally important. Access software may store local time, a camera may store UTC, and an inventory application may use the workstation clock. A five-minute discrepancy can change the apparent order of events during a handoff. Keep the raw timestamp, stated time zone, and any offset correction. Record the source and method of synchronization. If the offset is uncertain, use an interval such as “within ten minutes” rather than inventing a sequence. A normalized timeline is an interpretation layer; it should never replace the original event. Identity quality deserves a separate field. A named badge, PIN, mobile credential, visitor pass, and shared emergency code do not have the same attribution strength. A named credential supports the claim that the system associated an event with an account. It does not prove that the account holder was physically present. Review badge issuance, cancellation, temporary access, and known shared credentials. If a contractor’s account remained active after the work ended, the correct finding is an access-governance gap, not a conclusion about the contractor. Use a staged review. At stage one, filter for denied entries, out-of-window events, repeated retries, impossible sequences, and events during a documented closure. At stage two, join the event to schedules, maintenance tickets, visitor records, camera availability, and the relevant inventory or alarm log. At stage three, document the disposition: explained, requires follow-up, system defect, or unresolved. This preserves the difference between an automated flag and a reviewed exception. It also makes the review reproducible when a later reviewer asks why a particular event was closed. The right summary depends on the question. For access administration, report active credentials past their end date and the median time to disable them. For physical-security review, report denied attempts by zone and the proportion with a documented disposition. For an incident timeline, report the count of corroborated events, not every raw event. Show numerator, denominator, observation window, excluded events, and missingness. Do not rank employees by raw exceptions when role, shift, and legitimate access windows differ. There are several common failure modes. Deduplicating identical timestamps may remove genuine repeated presentations. Treating every alert as a person-level event may count controller retries. Combining successful entries with door-open duration can confuse authorization with occupancy. Exporting only a filtered dashboard can lose later corrections and the original event identifiers. Preserve an immutable export or evidence hash where policy permits, and record who performed the export. If privacy rules restrict raw badge data, use a controlled review set and retain only the minimum fields required for the stated purpose. The transfer boundary is narrow. A method designed for a single-door retail site does not automatically apply to a multi-zone cultivation or processing facility. A threshold chosen for a staffed opening period may be inappropriate for deliveries or emergency access. NIST and CISA materials can inform control design, while Virginia sources determine applicable local obligations; neither source converts a log anomaly into a legal finding. The bounded result is that access logs can establish system-recorded events and support a corroborated timeline when coverage, clocks, identity, and review status are explicit. ## A practical comparison boundary Freeze the export interval and record events arriving after the export as late evidence. Controller synchronization or delayed network delivery can otherwise make a later extract appear to contradict the first timeline. Preserve export time, source version, and missing-event status so the review can distinguish a physical event from a data-delivery correction. ## What a reviewer should request Request the system coverage map, raw event export, credential roster, clock status, maintenance and visitor records, and exception dispositions. A dashboard filtered to successful entries cannot establish coverage or explain a denied event. Keep the original event identifier and export metadata so a later review can reproduce the selection without changing the underlying timeline. ## A final evidence check Before publishing an access exception rate, ask whether all relevant zones, clock offsets, denied events, credential states, and late exports are represented. Ask whether corroborating records were available and whether the review outcome is distinct from the automated flag. If not, report coverage and uncertainty rather than attributing intent to an account holder. State the observation window in local time and include planned openings, deliveries, maintenance, and emergency access in the comparison frame. A rule that treats every event outside customer hours as anomalous will over-flag legitimate work and make the resulting rate a measure of schedule design rather than access risk. ## Reading uncertainty correctly An event linked to a credential can support an account-level review, but it should not be rewritten as a person-level conclusion without corroboration. Preserve shared credentials, proxy access, and system retries as separate limitations. This protects the integrity of the log and makes the escalation proportionate to what the evidence actually shows. ## Bounded conclusion Access logs provide a time-stamped system view of entry attempts. They become useful when identity, zone, clock, result, and corroboration are visible. They can direct inquiry but cannot establish intent or misconduct by themselves. ## Sources 1. Virginia Cannabis Control Authority 2. NIST Access Control 3. CISA Physical Security 4. ISO/IEC 27001 ## What this data can support EPA reports that about 40% of total U.S. energy consumption is used to generate electricity; facility-level cannabis estimates require measured loads and local assumptions. That figure is useful only with its population, period, source, and definition attached. It is not a performance target, a legal conclusion, or
Applying the evidence to key custody
For training, ask the team to explain key custody in plain language and then demonstrate one exception. Listen for whether they can distinguish an observation from an assumption and an approval from an acknowledgement. Coach the missing step with a concrete example. People remember a decision boundary better than a slogan, especially when the work involves opening staff, closing staff, security contacts, and managers. Update the instruction only after observing where the handoff actually breaks. Before changing the checklist, collect two contrasting examples: one ordinary completion and one uncomfortable exception. Compare the sequence, not just the final outcome. In the ordinary example, identify the control that made the decision easy. In the exception, identify the moment when the owner had to improvise. For key custody, that comparison often points to a missing source, an unclear threshold, or a handoff that occurs outside the record. Fix that narrow point, then observe the next cycle and document what changed.
