Start with gates, then compare scores
To compare visitor management systems, agree on the buying rules before watching demonstrations: define mandatory requirements, set the scorecard weights, test the same scenarios and compare the full cost of the configuration you would purchase.
Only rank systems for award after they pass every mandatory gate. This recommended decision rule prevents strong usability or attractive pricing from compensating for an unacceptable privacy arrangement or a failed admission-control requirement.
The method below combines a 100-point scorecard with a pass/fail pilot and a completed fictional buying decision. The weights, rating scale and test thresholds are recommendations from this guide—not an industry standard, certification or independent product ranking.
The UK Government’s Sourcing Playbook, version 4, recommends proportionate performance measures, cost modelling and pilots within its public-service sourcing framework. These principles offer a useful procurement reference, but its government-specific requirements are not universal purchasing obligations. The Sourcing Playbook
- Map the reception journeys Define Agree the required arrival, approval, exception and departure outcomes before comparing software. This is the recommended starting point for this buying method.
- Set supplier assurance expectations Specify NIST SP 1305, October 2024, supports defining and communicating supplier cybersecurity requirements. State what assurance your proposed deployment needs. NIST guidance
- Check the visitor-data lifecycle Review OAIC’s guide, published 5 June 2018 with a later legislative update notice, addresses information-lifecycle protection and destruction or de-identification subject to exceptions. Use it as Australian guidance, not a universal legal checklist. OAIC guidance
- Pilot the complete reception process Test The Sourcing Playbook, version 4, uses pilots to explore operating constraints, requirements and risks. For this evaluation, test arrivals, failed handoffs and outage recovery under equal conditions. Sourcing guidance
- Compare eligible candidates 100 points Use this guide’s recommended weights: workflow 20; security 15; privacy 15; integrations 10; continuity 15; usability 10; deployment 5; commercial fit 10. Rank only candidates that pass every mandatory gate.
- Preserve the buying rationale Award Contract for the tested configuration and record the costs, accepted limitations and decision owners. A high score never overrides a failed mandatory gate under this method.
Give every supplier the same evaluation brief
Give every candidate the same short evaluation brief. Describe your entrances, staffing hours, visitor types, expected demand, approval rules, existing systems and required records. Separate launch requirements from optional future improvements.
Assign facilities ownership of reception workflows and exceptions; IT ownership of technical assurance and integrations; the privacy lead ownership of data handling; and procurement ownership of comparable quotations and contract terms. Name a final decision owner to resolve trade-offs.
Describe outcomes rather than feature labels. For example, require an absent host’s visitor to reach a named backup, with an auditable entry decision, rather than asking for “advanced notifications.” Ask each supplier whether that outcome depends on native functionality, an integration, a paid service or staff action.
NIST’s October 2024 SP 1305 addresses establishing cybersecurity supply-chain risk management and defining and communicating supplier requirements. Apply that approach by stating your assurance expectations before supplier selection. NIST SP 1305
Once the brief is agreed, use the visitor-management buyer’s shortlist to identify candidates—not as a substitute for your own gates and pilot.
If an AI assistant will help prepare the trial, consult the 20-listing AI signup-route audit and confirm delegation permission before attempting registration.
Set mandatory gates that points cannot override
Have the responsible local owners approve the acceptance conditions for each mandatory gate. Record the result as pass, fail or unknown. Unknown means the evidence is insufficient, not necessarily that the capability is absent; it should nevertheless block an award until resolved.
| Mandatory gate | Recommended evidence needed to pass | Decision owner |
|---|---|---|
| Required arrival and approval workflow | A witnessed test shows that required checks cannot be bypassed and unresolved arrivals reach the designated decision-maker. | Facilities and security |
| Acceptable supplier assurance | IT accepts the relevant assurance scope, access controls, incident arrangements and unresolved risks for the proposed service. | IT/security |
| Acceptable data handling | The privacy owner approves collection, access, storage locations, retention, deletion and applicable contractual terms. | Privacy/legal |
| Required integrations | The intended configuration completes critical end-to-end transactions, including failure and recovery cases. | IT and the connected-system owner |
| Approved continuity procedure | A controlled outage exercise preserves required decisions or stops admissions; recovery reconciles the test records. | Facilities, IT and security |
| Purchasable, supportable scope | A written offer covers the tested configuration, required dependencies, support and an acceptable cost ceiling. | Procurement and finance |
For privacy context, the Australian OAIC’s Guide to securing personal information, published 5 June 2018, addresses protection throughout the information lifecycle and destruction or de-identification when information is no longer needed, subject to exceptions. Its update notice addresses legislative changes applying to information held after 11 December 2024. The guide is Australian, is not itself legally binding and is being updated; it is not a universal legal checklist. OAIC guidance
Ask your privacy owner to determine the applicable requirements, then test the relevant settings and review the contractual commitments. A generic compliance statement is not a sufficient pass condition.
Keep gates separate from scoring. A gate establishes minimum acceptability; the scorecard distinguishes the quality, effort and cost of acceptable solutions. If a gate changes, document why and apply the revised requirement to every candidate.
Apply the practical 100-point scorecard
The recommended weights below total 100 points. Adjust them to your site before demonstrations, then freeze them for the comparison. Each category contains three checks, weighted equally within that category. These are suggested evaluation criteria, not claims about any product.
| Category | Weight | Three checks to score separately |
|---|---|---|
| Visitor workflow and exception handling | 20 | Expected and unexpected arrivals; absent-host and approval handoffs; departure and unresolved-visit closure |
| Security and supplier assurance | 15 | Administrator authentication and permissions; traceability of relevant actions; assurance evidence and incident responsibilities |
| Privacy and record lifecycle | 15 | Control over collected data; retention and deletion processes; restricted access and controlled exports |
| Integrations and administration | 10 | Required transactions end to end; directory and configuration maintenance; visible failures and recovery ownership |
| Continuity and visitor accountability | 15 | Approved outage operation; roster retrieval and explicit gaps; recovery without missing or duplicate visits |
| Visitor and staff usability | 10 | Unassisted arrival journey; assisted and locally required language journeys; routine reception and host tasks |
| Deployment and support | 5 | Configuration and training effort; support escalation during operating hours; rollout and ongoing ownership |
| Total cost and commercial fit | 10 | Complete evaluated-period cost; growth and renewal terms; exit obligations and cost certainty |
Use one rating scale
Score each check from 0 to 5. Define the required outcome and any stretch outcomes before testing.
- 0 — Failed or unknown: no usable evidence of meeting the requirement. Keep failed and unknown distinguishable in the decision record.
- 1 — Major gaps: only a small part of the required outcome is demonstrated.
- 2 — Partial fit: useful functionality is demonstrated, but material requirements remain unmet.
- 3 — Meets the agreed requirement: demonstrated in the proposed configuration, including any explicitly accepted manual procedure.
- 4 — Meets the requirement and one predefined stretch outcome: for example, lower operator effort within the agreed test.
- 5 — Meets all predefined stretch outcomes: demonstrated consistently across the agreed scenarios.
To distinguish ratings of 4 and 5, define more than one stretch outcome for each check where those ratings will be available. Do not award extra points for an attractive feature that was never part of the evaluation. For commercial checks, define the budget, acceptable terms and cost-headroom bands in advance rather than automatically rewarding the cheapest headline quote.
Calculate the weighted result
Average the three check ratings within each category, then calculate:
Category points = category weight × average rating ÷ 5.
Add the category points and round only the final total, using the same precision for every candidate.
Hypothetical calculation: a category weighted at 15 points with check ratings of 3, 4 and 5 has an average rating of 4. It therefore contributes 12 points to the total.
For every rating, preserve the tested plan and configuration, date, observer, observed result, dependencies and reason for the score. Keep supplier statements, document review and witnessed tests distinguishable. A procurement pilot is not independent certification.
Run a fair pass/fail pilot
Give every finalist the same fictional records, scenario script, preparation time and opportunity to correct defects. Test the subscription, integrations and hardware configuration proposed for purchase. Where configurations differ, record the difference and include its cost.
The Sourcing Playbook describes pilots as a way to understand the operating environment, constraints, requirements and risks, and to inform specifications. Apply that principle by testing the whole reception process rather than relying on a demonstration. The Sourcing Playbook
Test ordinary arrivals and difficult handoffs
These proposed pass conditions need local approval; they are not universal operational or safety standards.
| Scenario | Proposed pass condition | Evidence to retain |
|---|---|---|
| Expected visitor | The guest reaches the correct host and the visit is recorded without an unexplained duplicate. | Arrival record, notification result and operator actions |
| Unexpected visitor or absent host | A designated backup receives the exception; the entry decision remains unresolved until an authorized person acts. | Escalation and decision history |
| Missing required answer | Omitting the answer cannot bypass the required decision. | Observed result and applicable configuration |
| Assisted arrival | Staff complete the approved assisted journey without collecting unnecessary additional information. | Completion result and assistance required |
| Restricted administrator | The account cannot view or change records outside its agreed scope. | Permission configuration and witnessed access attempts |
| Retention, deletion and export | Selected test records follow the approved lifecycle and export rules; any untestable component remains explicitly unresolved. | Before-and-after records and documented limits |
| Integration failure | Staff identify the failure, avoid assuming success and complete the approved recovery or hold procedure. | Error visibility, ownership and reconciliation result |
| Network outage and recovery | Staff follow the approved fallback or stop admissions; test arrivals and departures are reconciled after recovery. | Fallback record, central record and discrepancy check |
| Visitor-accountability exercise | Authorized staff retrieve the agreed roster, identify its limitations and reconcile fictional visitors under the local drill procedure. | Timed retrieval and discrepancy record |
| Departure | The visit closes correctly; any required credential action is checked separately. | Departure record and credential outcome where applicable |
Set measurable thresholds before starting
Illustrative thresholds only: a team might require at least 19 of 20 ordinary test arrivals to complete within 90 seconds, with every required approval handled correctly and no unexplained missing or duplicate records. These are proposed test settings, not benchmarks. Choose thresholds that reflect your staffing and operating needs, and define exactly when timing starts and stops.
Mark each scenario pass, fail or unknown against its agreed conditions. A critical scenario failure fails the corresponding gate. Give all candidates the same correction window and retest rules; retain the original result as well as the retest.
Have evaluators score independently before discussing differences. Resolve disagreements by returning to the evidence, not by averaging away a failed mandatory requirement.

Compare the complete deployment cost
The Sourcing Playbook recommends cost modelling to improve understanding of delivery costs and guard against low-cost bid bias. The Sourcing Playbook
For this comparison, use the same evaluation period, currency, tax treatment, site count, visitor volume and support coverage for every candidate. Request written confirmation of the full configuration tested in the pilot.
Include software, required modules, devices, installation, integrations, messaging allowances, consumables, training, internal administration, support and exit costs where applicable. Distinguish supplier charges from your own labour estimates, and one-time costs from recurring costs. Label unquoted items unknown, not zero.
Use a base case and a growth case. Ask each supplier to price your current scope and the same hypothetical expansion. Record what triggers repricing and how renewal changes would be calculated. If future costs cannot be established, identify the uncertainty rather than presenting an invented allowance as a quote.
Keep internal effort visible even when there is no supplier charge. In the cost category, score the complete evaluated-period amount against the pre-agreed budget; assess growth, renewal and exit terms through the other two checks.
If free access is part of your shortlist, consult the free visitor-management systems buying guide, then confirm the exact entitlements needed for your pilot and deployment.
Worked example: the highest score does not always win
Completed hypothetical example: every supplier label, rating, result and decision below is invented. None represents a real product, customer, quote or independent test.
A fictional facilities team evaluates three suppliers for the same reception scope. It uses the weights above and sets a minimum award score of 75/100, alongside mandatory gates. That threshold is a fictional purchasing choice, not an industry benchmark.
The ratings below are category averages after the team has scored the individual checks.
| Category | Weight | Fictional Supplier A | Fictional Supplier B | Fictional Supplier C |
|---|---|---|---|---|
| Visitor workflow | 20 | 4 | 5 | 4 |
| Security and assurance | 15 | 4 | 4 | 4 |
| Privacy and lifecycle | 15 | 4 | 4 | 4 |
| Integrations and administration | 10 | 3 | 5 | 4 |
| Continuity and accountability | 15 | 4 | 2 | 4 |
| Usability | 10 | 4 | 4 | 3 |
| Deployment and support | 5 | 3 | 4 | 4 |
| Cost and commercial fit | 10 | 3 | 4 | 4 |
| Weighted total | 100 | 75 | 80 | 78 |
Supplier A: acceptable, with more administration
Supplier A passes every gate and reaches 75 points. It performs well in usability but requires more routine integration administration than the predefined stretch target. Its cost fits the approved budget without reaching the preferred headroom band. It remains an eligible alternative.
Supplier B: highest diagnostic score, but ineligible
Supplier B earns 80 points but fails the mandatory continuity gate during its outage exercise. After the equal correction window and retest, the required fallback and reconciliation outcome remains unmet. Its score is retained for diagnostic comparison only; stronger workflow and integration results do not cancel the failed gate.
Supplier C: selected, with a recorded usability limitation
Supplier C passes every gate and earns 78 points. It meets the usability requirement but does not achieve the stretch target for staff effort. The team accepts that limitation and records the additional training arrangement. Its higher integration, deployment and commercial ratings outweigh Supplier A’s usability advantage under the agreed weights.
Decision: select Supplier C, subject to the contract matching the tested configuration and accepted terms. Keep Supplier A as the eligible alternative. Supplier B remains ineligible unless it passes the same gate and retest process available to every candidate.
Check whether the decision depends on the weights
As a hypothetical sensitivity check, moving 5 points from integrations to usability produces 76 points for A and 77 for C. C remains ahead, but narrowly. The team records why integration administration matters enough to retain the original weights rather than changing them after seeing the results.
Use sensitivity analysis to expose trade-offs—not to manufacture a preferred winner.
Make the award traceable to the evidence
Before signing, confirm that the selected supplier’s offer covers the tested plan, configuration, dependencies, support coverage and accepted limitations.
Retain a concise decision record explaining:
- Which gates passed, who accepted them and what evidence supported acceptance.
- How each category score was calculated and why the selected candidate won.
- Which manual procedures or limitations were accepted, with a named owner.
- Which costs are quoted, estimated or still unknown.
- What must happen before rollout, including training, configuration and acceptance testing.
- When to repeat relevant tests after material changes to integrations, permissions, policies or scope.
If no candidate passes every mandatory gate, return to the market or formally reconsider the requirements with the responsible owners. Do not quietly weaken a gate to make the scorecard produce a winner.
Conclusion
Compare visitor management systems by applying the same requirements, tests and cost assumptions to every candidate. Freeze the weights before demonstrations, resolve unknowns and exclude failed mandatory gates from the award ranking. Select the strongest eligible fit—and record the limitations you are accepting.
Sources
Source pages checked 12 October 2026.
Pricing and plan details can change; verify current terms with the vendor.
