Opening & hardware
Door, frame, lock, egress, power, monitoring, accessibility, environment, and failure behavior.
The reader is not the system.
An access-control decision joins an opening, locking hardware, credential, identity process, controller, network, software, life-safety interface, operating team, and audit trail. Scope the whole chain.
Scope controlled openings before products.
For every door, gate, lift destination, garage, and restricted area, define who needs access, when, with which exception path, what the opening should do during fire alarm, power loss, network loss, and system failure, and who owns daily administration.
Access path in view
The door is a system, not a reader.
A sound review follows the credential through the decision point and all the way to the physical opening.
01
02
03Published 8 September 2026 · reviewed 9 September 2026. Editorial illustrations generated for Hamed Helped; they do not depict a named site, vendor, or client.
Decision criteria
Six layers have to agree at the opening.
People & credentials
Enrollment, proofing, issuance, lifecycle, lost credential, role change, visitor, contractor, and termination.
Decision architecture
Where access rules run, what works offline, how time and schedules behave, and who can override.
Connected systems
Video, intercom, visitor, lifts, alarms, identity, HR, tenant systems, mobile wallets, and incident workflows.
Administration & response
Daily changes, exceptions, alarms, investigations, evidence retention, vendor support, and escalation.
Security & exit
Updates, remote access, keys, backups, recovery, device support, data export, and replacement path.
Questions to ask
Ask about the day after handover.
- Who administers access every day?
Map new joiners, tenant changes, visitors, vendors, role changes, terminations, lost credentials, and after-hours exceptions.
- What happens without the network?
Define local decision behavior, cached rights, monitoring, alarms, operator awareness, and restoration.
- What happens during a life-safety event?
Require jurisdiction- and design-specific review of egress, door release, fire-alarm interface, overrides, and testing.
- Which identity is authoritative?
Name the source of identity and access rights, synchronization path, conflict handling, and deprovisioning evidence.
- Who can reach the controllers remotely?
List accounts, approval, authentication, duration, monitoring, logging, support purpose, and revocation.
- Can the property change providers?
Document credentials, hardware constraints, controller ownership, configuration export, records, keys, and transition support.
Evidence table
Separate design acceptance from operating evidence.
| Claim or decision | Evidence | Owner | When checked |
|---|---|---|---|
| Opening behavior | Door schedule, hardware and interface design, failure modes, approved test result | Designer + life-safety stakeholders | Design, commissioning, material change |
| Identity lifecycle | Source-of-truth map, approval rules, joiner/mover/leaver test, exception log | Security + identity owner | Before rollout and periodically |
| Offline operation | Documented behavior and observed test for network, server, cloud, and power loss | Operations + system owner | Commissioning and recovery exercise |
| Remote support | Named accounts, approvals, authentication, session records, review and revocation | System owner + security | Before support access and at review |
| Exit readiness | Configuration, credential, record, hardware, key, and transition inventory | Property owner + procurement | Before contract and at renewal |
Failure modes
Four signals that the scope is too small.
The bill of materials is the design
Products are listed before people, openings, exceptions, operating roles, and failure behavior are agreed.
Mobile equals modern
A credential form is chosen without mapping identity proofing, phone loss, privacy, offline behavior, and alternatives.
Integration means API
A technical connection exists but ownership, error handling, incident response, support, and evidence do not.
Handover ends the project
Administration, updates, remote support, records, backups, recovery, and provider exit have no durable owner.
Secure the system
Place access control inside the building’s cyber-physical boundary.
Evidence trail
Sources behind this guide
- 01NISTGuide to Operational Technology (OT) Security — SP 800-82 Rev. 3 (external link)
Primary guidance that includes physical access control systems in OT scope.
- 02Security Industry AssociationSIA Proptech Report (external link)
Commercial-real-estate research covering security technology priorities, interoperability, and buying considerations.
- 03Security Industry AssociationSecurity Convergence 2024 (external link)
Industry research on the meeting point of physical and cybersecurity responsibilities.