Your Emergency Plan Says They Need Access. Will They Get In?

After an emergency, identifying essential employees is only part of the plan. Access to the building may be controlled by someone else.

Originally published September 2011. Updated October 2026 to reflect the announced discontinuation of the Corporate Emergency Access System.

In July 2007, an underground steam pipe exploded in Midtown Manhattan, sending steam and debris into the air and forcing the evacuation of the surrounding area.

Businesses inside the restricted zone suddenly faced a problem that had little to do with whether their employees were willing or able to respond.

They couldn’t get to their buildings.

At the time, I wrote about the Corporate Emergency Access System, or CEAS, which provided credentials intended to help designated essential employees and vendors gain access to restricted areas when authorized by government officials.

The concept addressed an important weakness in many business continuity plans.

A company may know exactly whom it needs after an emergency. That doesn’t mean those people will be permitted through the perimeter.

The Plan Inside the Building Isn’t Enough

Consider what may need attention after an emergency.

Someone may need to inspect the building, assess damage, check critical equipment, stabilize building systems, retrieve essential records or coordinate restoration work.

The company may have employees, property managers, engineers, contractors and vendors ready to respond.

But if police or emergency management officials have restricted access to the area, the company’s internal emergency plan doesn’t determine who gets in.

The authorities controlling the area do.

That’s the planning gap CEAS was designed to address.

CEAS Is Going Away

CEAS has announced that the program and its supporting services will be discontinued at the end of 2026. Annual subscription renewals stopped January 1, 2026, while existing unexpired credentials remain valid until their scheduled expiration dates. ceas.com

CEAS says changing business requirements, technological advances and the widespread adoption of remote work contributed to the decision. ceas.com

Remote work certainly changes how some businesses recover from an emergency.

It doesn’t eliminate the physical building.

If a facility has suffered damage, lost power, taken on water, experienced a mechanical failure or requires emergency stabilization, somebody may still need to reach it.

That makes the underlying question as relevant as it was when I first wrote about CEAS in 2011.

What happens when the people you need cannot get to the place where you need them?

Don’t Assume a Credential Guarantees Access

Even CEAS never meant that a credential holder could simply walk through an emergency perimeter.

Access remained subject to the conditions of the incident and the decisions of the government and law-enforcement authorities controlling the restricted area. CEAS itself describes the program as facilitating access when authorized by government authority. ceas.com

That’s an important distinction for any emergency plan.

• A company can identify critical personnel.
• It can establish call trees.
• It can retain emergency contractors.
• It can maintain contact information and escalation procedures.

But none of those actions, by themselves, guarantee physical access following an emergency.

Ask the Question Before the Emergency

As CEAS sunsets, organizations that relied on it should understand what their emergency-access plan looks like without it.

• Who needs physical access to each facility after an emergency?
• Which functions can actually be performed remotely, and which cannot?
• Which outside contractors or vendors might need access?
• Who communicates with property management, emergency management or public-safety authorities?
• Are there local procedures for essential personnel, contractors or building representatives during restricted access?
• And if nobody can enter the building, what happens next?

Those questions belong in the business continuity plan before an incident occurs.

The Real Lesson Was Never the Credential

When I originally wrote this article, CEAS was the solution I was pointing readers toward.

Fifteen years later, the program is ending.

But the problem it was created to solve hasn’t disappeared.

Business continuity planning isn’t only about determining what your organization will do after an emergency.

It also means identifying the assumptions your plan depends upon—and determining whether your organization actually controls them.

Leadership takeaway: Don’t build an emergency response plan around access you may not control.