A vendor’s HSA access is enforced by a security turnstile they have a logical access-control system that ensures anti pass-back. The device is…

The fundamental purpose of an anti-passback system is to prevent a single access credential from being used for consecutive entries without an intervening exit. To be effective, the logical access-control system must change the credential's state from "outside" to "inside" (or an equivalent state) immediately upon the successful authentication of the badge. Waiting for the person to complete the access cycle would introduce a vulnerability. During the time between the badge presentation and the completion of the cycle, the badge could be passed back to another individual for a fraudulent second entry before the system has updated its state, thereby defeating the control.

A. The system should log, but not change the anti-passback state for, an unauthorized badge presentation.

B. Waiting for the access cycle to complete is too late and creates a window for the credential to be misused.

C. The system's trigger is the logical event of an authorized badge read, not the physical movement of a person.

1. PCI Security Standards Council, Card Production and Provisioning Physical Security Requirements, Version 3.0, May 2022. Requirement 2.1.4 states: "Where technically feasible, implement anti-passback functionality to prevent a card from being used to enter an area twice without first exiting." The testing procedure confirms the system prevents such an action, which logically requires the state to change immediately upon authorization to be effective.

2. National Institute of Standards and Technology (NIST), Special Publication 800-116 Revision 1: A Recommendation for the Use of PIV Credentials in Physical Access Control Systems (PACS), June 2018. Section 5.3, "Anti-Passback," explains the mechanism: "The PACS maintains the state of each PIV card holder (i.e., inside or outside of a controlled area). When a card holder enters a controlled area, the PACS changes the state of the card holder to ‘inside.’" This state change is initiated by the credential presentation and authorization event.