A decent visitor is roaming around without visitor's ID. As an employee you should do the following, except:

The scenario describes a potential breach of physical security controls. According to information security best practices, such as those outlined in ISO 27001, all employees have a responsibility to uphold security policies. An unidentified visitor without a badge represents a security risk. The appropriate response is to challenge or report the individual to ensure they are authorized to be on the premises. Offering coffee is a social courtesy that completely ignores the security protocol, normalizes a potential policy violation, and fails to mitigate the risk of unauthorized access. The other options represent valid and responsible actions to address the security situation.

B. This is a correct procedure. The receptionist or security desk is responsible for visitor management and can verify the individual's status and take appropriate action.
C. This is a correct first step. Politely challenging an individual by asking their business is a standard security awareness practice to identify and verify unknown persons.
D. This is a correct control. Escorting the visitor (e.g., back to the reception area) prevents them from roaming freely and potentially accessing sensitive areas unsupervised.

1. ISO/IEC 27002:2022 - Information security, cybersecurity and privacy protection — Information security controls.

Control 7.3 Physical entry: The implementation guidance states, "Visitors to secure areas should be supervised or escorted... All personnel should be made aware of the procedures for visitor management and for challenging persons who are not identified." This directly supports that challenging (C), reporting (B), and escorting (D) are correct actions, while ignoring the breach (A) is not.

2. Humphreys, E. (2016). Implementing the ISO/IEC 27001:2013 ISMS Standard. Artech House.

Chapter 11, Annex A.11 Physical and Environmental Security (corresponds to A.7 in the 2022 version): This chapter discusses physical entry controls, emphasizing that visitor access must be controlled and that staff should be trained to identify and challenge unescorted individuals or those without proper identification. The book notes that a failure to challenge is a failure of the human element of the security system (p. 187).

3. Peltier, T. R. (2013). Information Security Policies, Procedures, and Standards: A Practitioner's Reference. CRC Press.

Chapter 7, Physical Security Policy: This section details the components of a robust physical security policy, which includes specific procedures for visitor control. It outlines that "All visitors must be escorted by an authorized employee at all times" and that employees are responsible for reporting policy violations (pp. 155-157). This reinforces that options B, C, and D are components of a formal policy.