Start with gates, then compare scores

To compare visitor management systems, agree on the buying rules before watching demonstrations: define mandatory requirements, set the scorecard weights, test the same scenarios and compare the full cost of the configuration you would purchase.

Only rank systems for award after they pass every mandatory gate. This recommended decision rule prevents strong usability or attractive pricing from compensating for an unacceptable privacy arrangement or a failed admission-control requirement.

The method below combines a 100-point scorecard with a pass/fail pilot and a completed fictional buying decision. The weights, rating scale and test thresholds are recommendations from this guide—not an industry standard, certification or independent product ranking.

The UK Government’s Sourcing Playbook, version 4, recommends proportionate performance measures, cost modelling and pilots within its public-service sourcing framework. These principles offer a useful procurement reference, but its government-specific requirements are not universal purchasing obligations. The Sourcing Playbook

Give every supplier the same evaluation brief

Give every candidate the same short evaluation brief. Describe your entrances, staffing hours, visitor types, expected demand, approval rules, existing systems and required records. Separate launch requirements from optional future improvements.

Assign facilities ownership of reception workflows and exceptions; IT ownership of technical assurance and integrations; the privacy lead ownership of data handling; and procurement ownership of comparable quotations and contract terms. Name a final decision owner to resolve trade-offs.

Describe outcomes rather than feature labels. For example, require an absent host’s visitor to reach a named backup, with an auditable entry decision, rather than asking for “advanced notifications.” Ask each supplier whether that outcome depends on native functionality, an integration, a paid service or staff action.

NIST’s October 2024 SP 1305 addresses establishing cybersecurity supply-chain risk management and defining and communicating supplier requirements. Apply that approach by stating your assurance expectations before supplier selection. NIST SP 1305

Once the brief is agreed, use the visitor-management buyer’s shortlist to identify candidates—not as a substitute for your own gates and pilot.

If an AI assistant will help prepare the trial, consult the 20-listing AI signup-route audit and confirm delegation permission before attempting registration.

Set mandatory gates that points cannot override

Have the responsible local owners approve the acceptance conditions for each mandatory gate. Record the result as pass, fail or unknown. Unknown means the evidence is insufficient, not necessarily that the capability is absent; it should nevertheless block an award until resolved.

Mandatory gateRecommended evidence needed to passDecision owner
Required arrival and approval workflowA witnessed test shows that required checks cannot be bypassed and unresolved arrivals reach the designated decision-maker.Facilities and security
Acceptable supplier assuranceIT accepts the relevant assurance scope, access controls, incident arrangements and unresolved risks for the proposed service.IT/security
Acceptable data handlingThe privacy owner approves collection, access, storage locations, retention, deletion and applicable contractual terms.Privacy/legal
Required integrationsThe intended configuration completes critical end-to-end transactions, including failure and recovery cases.IT and the connected-system owner
Approved continuity procedureA controlled outage exercise preserves required decisions or stops admissions; recovery reconciles the test records.Facilities, IT and security
Purchasable, supportable scopeA written offer covers the tested configuration, required dependencies, support and an acceptable cost ceiling.Procurement and finance

For privacy context, the Australian OAIC’s Guide to securing personal information, published 5 June 2018, addresses protection throughout the information lifecycle and destruction or de-identification when information is no longer needed, subject to exceptions. Its update notice addresses legislative changes applying to information held after 11 December 2024. The guide is Australian, is not itself legally binding and is being updated; it is not a universal legal checklist. OAIC guidance

Ask your privacy owner to determine the applicable requirements, then test the relevant settings and review the contractual commitments. A generic compliance statement is not a sufficient pass condition.

Keep gates separate from scoring. A gate establishes minimum acceptability; the scorecard distinguishes the quality, effort and cost of acceptable solutions. If a gate changes, document why and apply the revised requirement to every candidate.

Apply the practical 100-point scorecard

The recommended weights below total 100 points. Adjust them to your site before demonstrations, then freeze them for the comparison. Each category contains three checks, weighted equally within that category. These are suggested evaluation criteria, not claims about any product.

CategoryWeightThree checks to score separately
Visitor workflow and exception handling20Expected and unexpected arrivals; absent-host and approval handoffs; departure and unresolved-visit closure
Security and supplier assurance15Administrator authentication and permissions; traceability of relevant actions; assurance evidence and incident responsibilities
Privacy and record lifecycle15Control over collected data; retention and deletion processes; restricted access and controlled exports
Integrations and administration10Required transactions end to end; directory and configuration maintenance; visible failures and recovery ownership
Continuity and visitor accountability15Approved outage operation; roster retrieval and explicit gaps; recovery without missing or duplicate visits
Visitor and staff usability10Unassisted arrival journey; assisted and locally required language journeys; routine reception and host tasks
Deployment and support5Configuration and training effort; support escalation during operating hours; rollout and ongoing ownership
Total cost and commercial fit10Complete evaluated-period cost; growth and renewal terms; exit obligations and cost certainty

Use one rating scale

Score each check from 0 to 5. Define the required outcome and any stretch outcomes before testing.

  • 0 — Failed or unknown: no usable evidence of meeting the requirement. Keep failed and unknown distinguishable in the decision record.
  • 1 — Major gaps: only a small part of the required outcome is demonstrated.
  • 2 — Partial fit: useful functionality is demonstrated, but material requirements remain unmet.
  • 3 — Meets the agreed requirement: demonstrated in the proposed configuration, including any explicitly accepted manual procedure.
  • 4 — Meets the requirement and one predefined stretch outcome: for example, lower operator effort within the agreed test.
  • 5 — Meets all predefined stretch outcomes: demonstrated consistently across the agreed scenarios.

To distinguish ratings of 4 and 5, define more than one stretch outcome for each check where those ratings will be available. Do not award extra points for an attractive feature that was never part of the evaluation. For commercial checks, define the budget, acceptable terms and cost-headroom bands in advance rather than automatically rewarding the cheapest headline quote.

Calculate the weighted result

Average the three check ratings within each category, then calculate:

Category points = category weight × average rating ÷ 5.

Add the category points and round only the final total, using the same precision for every candidate.

Hypothetical calculation: a category weighted at 15 points with check ratings of 3, 4 and 5 has an average rating of 4. It therefore contributes 12 points to the total.

For every rating, preserve the tested plan and configuration, date, observer, observed result, dependencies and reason for the score. Keep supplier statements, document review and witnessed tests distinguishable. A procurement pilot is not independent certification.

Run a fair pass/fail pilot

Give every finalist the same fictional records, scenario script, preparation time and opportunity to correct defects. Test the subscription, integrations and hardware configuration proposed for purchase. Where configurations differ, record the difference and include its cost.

The Sourcing Playbook describes pilots as a way to understand the operating environment, constraints, requirements and risks, and to inform specifications. Apply that principle by testing the whole reception process rather than relying on a demonstration. The Sourcing Playbook

Test ordinary arrivals and difficult handoffs

These proposed pass conditions need local approval; they are not universal operational or safety standards.

ScenarioProposed pass conditionEvidence to retain
Expected visitorThe guest reaches the correct host and the visit is recorded without an unexplained duplicate.Arrival record, notification result and operator actions
Unexpected visitor or absent hostA designated backup receives the exception; the entry decision remains unresolved until an authorized person acts.Escalation and decision history
Missing required answerOmitting the answer cannot bypass the required decision.Observed result and applicable configuration
Assisted arrivalStaff complete the approved assisted journey without collecting unnecessary additional information.Completion result and assistance required
Restricted administratorThe account cannot view or change records outside its agreed scope.Permission configuration and witnessed access attempts
Retention, deletion and exportSelected test records follow the approved lifecycle and export rules; any untestable component remains explicitly unresolved.Before-and-after records and documented limits
Integration failureStaff identify the failure, avoid assuming success and complete the approved recovery or hold procedure.Error visibility, ownership and reconciliation result
Network outage and recoveryStaff follow the approved fallback or stop admissions; test arrivals and departures are reconciled after recovery.Fallback record, central record and discrepancy check
Visitor-accountability exerciseAuthorized staff retrieve the agreed roster, identify its limitations and reconcile fictional visitors under the local drill procedure.Timed retrieval and discrepancy record
DepartureThe visit closes correctly; any required credential action is checked separately.Departure record and credential outcome where applicable

Set measurable thresholds before starting

Illustrative thresholds only: a team might require at least 19 of 20 ordinary test arrivals to complete within 90 seconds, with every required approval handled correctly and no unexplained missing or duplicate records. These are proposed test settings, not benchmarks. Choose thresholds that reflect your staffing and operating needs, and define exactly when timing starts and stops.

Mark each scenario pass, fail or unknown against its agreed conditions. A critical scenario failure fails the corresponding gate. Give all candidates the same correction window and retest rules; retain the original result as well as the retest.

Have evaluators score independently before discussing differences. Resolve disagreements by returning to the evidence, not by averaging away a failed mandatory requirement.

Illustration showing a network outage exercise, staff-assisted fallback and reconciliation of test visits after recovery.
Illustration showing a network outage exercise, staff-assisted fallback and reconciliation of test visits after recovery. - Illustrative pilot sequence: observe the interruption, use the approved fallback and reconcile the test visits.

Compare the complete deployment cost

The Sourcing Playbook recommends cost modelling to improve understanding of delivery costs and guard against low-cost bid bias. The Sourcing Playbook

For this comparison, use the same evaluation period, currency, tax treatment, site count, visitor volume and support coverage for every candidate. Request written confirmation of the full configuration tested in the pilot.

Include software, required modules, devices, installation, integrations, messaging allowances, consumables, training, internal administration, support and exit costs where applicable. Distinguish supplier charges from your own labour estimates, and one-time costs from recurring costs. Label unquoted items unknown, not zero.

Use a base case and a growth case. Ask each supplier to price your current scope and the same hypothetical expansion. Record what triggers repricing and how renewal changes would be calculated. If future costs cannot be established, identify the uncertainty rather than presenting an invented allowance as a quote.

Keep internal effort visible even when there is no supplier charge. In the cost category, score the complete evaluated-period amount against the pre-agreed budget; assess growth, renewal and exit terms through the other two checks.

If free access is part of your shortlist, consult the free visitor-management systems buying guide, then confirm the exact entitlements needed for your pilot and deployment.

Worked example: the highest score does not always win

Completed hypothetical example: every supplier label, rating, result and decision below is invented. None represents a real product, customer, quote or independent test.

A fictional facilities team evaluates three suppliers for the same reception scope. It uses the weights above and sets a minimum award score of 75/100, alongside mandatory gates. That threshold is a fictional purchasing choice, not an industry benchmark.

The ratings below are category averages after the team has scored the individual checks.

CategoryWeightFictional Supplier AFictional Supplier BFictional Supplier C
Visitor workflow20454
Security and assurance15444
Privacy and lifecycle15444
Integrations and administration10354
Continuity and accountability15424
Usability10443
Deployment and support5344
Cost and commercial fit10344
Weighted total100758078

Supplier A: acceptable, with more administration

Supplier A passes every gate and reaches 75 points. It performs well in usability but requires more routine integration administration than the predefined stretch target. Its cost fits the approved budget without reaching the preferred headroom band. It remains an eligible alternative.

Supplier B: highest diagnostic score, but ineligible

Supplier B earns 80 points but fails the mandatory continuity gate during its outage exercise. After the equal correction window and retest, the required fallback and reconciliation outcome remains unmet. Its score is retained for diagnostic comparison only; stronger workflow and integration results do not cancel the failed gate.

Supplier C: selected, with a recorded usability limitation

Supplier C passes every gate and earns 78 points. It meets the usability requirement but does not achieve the stretch target for staff effort. The team accepts that limitation and records the additional training arrangement. Its higher integration, deployment and commercial ratings outweigh Supplier A’s usability advantage under the agreed weights.

Decision: select Supplier C, subject to the contract matching the tested configuration and accepted terms. Keep Supplier A as the eligible alternative. Supplier B remains ineligible unless it passes the same gate and retest process available to every candidate.

Check whether the decision depends on the weights

As a hypothetical sensitivity check, moving 5 points from integrations to usability produces 76 points for A and 77 for C. C remains ahead, but narrowly. The team records why integration administration matters enough to retain the original weights rather than changing them after seeing the results.

Use sensitivity analysis to expose trade-offs—not to manufacture a preferred winner.

Make the award traceable to the evidence

Before signing, confirm that the selected supplier’s offer covers the tested plan, configuration, dependencies, support coverage and accepted limitations.

Retain a concise decision record explaining:

  • Which gates passed, who accepted them and what evidence supported acceptance.
  • How each category score was calculated and why the selected candidate won.
  • Which manual procedures or limitations were accepted, with a named owner.
  • Which costs are quoted, estimated or still unknown.
  • What must happen before rollout, including training, configuration and acceptance testing.
  • When to repeat relevant tests after material changes to integrations, permissions, policies or scope.

If no candidate passes every mandatory gate, return to the market or formally reconsider the requirements with the responsible owners. Do not quietly weaken a gate to make the scorecard produce a winner.

Conclusion

Compare visitor management systems by applying the same requirements, tests and cost assumptions to every candidate. Freeze the weights before demonstrations, resolve unknowns and exclude failed mandatory gates from the award ranking. Select the strongest eligible fit—and record the limitations you are accepting.

Sources

Source pages checked 12 October 2026.

Pricing and plan details can change; verify current terms with the vendor.