Modern access control demands more than a secure reader. It requires trusted credentials, protected communications, sound identity management, continuous monitoring and a resilient security architecture.
Access control is one of the most visible components of physical security, yet its effectiveness depends on much more than the technology installed at a doorway. A sophisticated reader cannot compensate for weak credentials, poorly configured software, unsecured wiring or an employee whose access rights were never withdrawn after leaving the organisation.
The fundamental principle remains “defence in depth”. Access control should combine preventive, detective and responsive measures so that a single failure does not automatically result in unauthorised entry. The objective is not to make every door equally difficult to access, but to apply controls proportionate to the risks, assets and people being protected.
Select credentials based on risk
The choice of credential should begin with a risk assessment, not a product catalogue. Conventional proximity cards may remain adequate for low-risk applications, but their suitability should be evaluated against the consequences of cloning, loss, theft or unauthorised sharing.
For new installations and upgrades, organisations should favour secure contactless smart cards or other credentials that use strong cryptographic authentication and mutual authentication between the credential and reader. Systems that identify a card solely by its publicly readable serial number should generally be avoided for sensitive applications. Reading a serial number is not equivalent to authenticating a credential.
Mobile credentials can offer additional convenience, particularly when managed through secure provisioning and revocation processes. However, smartphones introduce their own considerations, including device compromise, loss, account recovery and dependence on battery power or connectivity. Credential selection must therefore consider the complete lifecycle, not merely the convenience of presentation.
Secure the communication between reader and controller
The reader is only one part of the access control chain. Information must travel from the reader to a controller, which validates the credential and determines whether access should be granted.
Traditional Wiegand connections remain in service, but their limitations make them less suitable for new installations where stronger protection is required. The Security Industry Association’s Open Supervised Device Protocol (OSDP) provides a modern alternative, supporting bidirectional communication, device supervision and, when properly configured, Secure Channel encryption. The association’s 2026 implementation guidance also emphasises selecting independently verified devices and implementing the protocol correctly.
Organisations should specify OSDP Secure Channel where supported, verify device compatibility and ensure that encryption is actually enabled rather than assuming that protocol support guarantees protection. https://www.securityindustry.org/2026/02/10/implementing-osdp-access-control-follow-this-simple-checklist/
Reader wiring should be protected against physical access, tampering and interception. Use appropriate conduits, secure junction boxes, supervised circuits and tamper-resistant fixings, particularly at perimeter doors. Where practicable, locate controllers and door-release circuitry in secured areas rather than leaving critical components exposed beside the reader.
Strengthen authentication at sensitive doors
A single credential may be sufficient for routine office access. Server rooms, data centres, research laboratories, control rooms and other sensitive areas may require two or more independent authentication factors.
Combining a card with a PIN or a suitable biometric can reduce the risk associated with stolen or shared credentials. Biometrics, however, require careful consideration of spoofing resistance, accuracy, accessibility, privacy and the protection of biometric data. They should not be deployed simply because the technology is available.
Multifactor authentication must also be supported by effective procedures. Shared PINs, predictable codes and poorly controlled enrolment can undermine otherwise sophisticated systems. For high-risk facilities, access decisions should be based on verified identity, current authorisation and the required level of assurance.
Manage identity and access rights throughout the lifecycle
Access privileges should reflect an individual’s current role, work location and operational responsibilities. Apply the principle of least privilege, granting only the minimum access needed for the job. Separate ordinary employee permissions from administrative privileges and restrict access to critical areas by time, location and business need.
Establish a formal process for issuing, changing, suspending and revoking credentials. Lost cards should be disabled immediately, and access rights should be withdrawn promptly when employment or a contractor engagement ends. Temporary workers and visitors should receive time-limited credentials, with sponsorship and identification checks appropriate to the risk.
Conduct periodic reviews with department heads and system owners to identify dormant accounts, excessive privileges and inappropriate access. Anti-passback rules can help identify credential sharing or repeated entry anomalies, but they are not a complete solution to tailgating. Use appropriate door hardware, turnstiles, mantraps, security personnel and video monitoring where the risk justifies them.
Treat access control as a cybersecurity asset
Modern access control systems increasingly use IP networks, remote administration, cloud platforms and integration with other building technologies. They must therefore be protected against cyberattack as well as physical tampering.
Change default passwords, enforce multifactor authentication for administrative and remote access, use role-based permissions and encrypt communications. Place access control equipment on appropriately segmented networks, restrict unnecessary internet exposure and maintain an inventory of controllers, readers, servers, software versions and connected services. Apply security patches through a controlled process, monitor vendor vulnerability notices and maintain tested backups. Remote maintenance should be authorised, time-limited and logged. Organisations using cloud-managed systems should examine data handling, service availability, incident notification, recovery arrangements and contractual responsibilities.
Monitor, Investigate and Respond
An effective system does not merely record whether a card was accepted or rejected. It should provide useful alerts for reader tampering, forced doors, doors held open, controller failures, unusual access attempts and loss of communication.
Integrating access events with CCTV enables investigators to correlate credential use with observed activity. Video verification can also help security teams distinguish routine exceptions from suspicious behaviour. Alerts must be assigned clear ownership, response times and escalation procedures; otherwise, excessive notifications can overwhelm operators.
Logs should be protected against unauthorised alteration, synchronised to a reliable time source and retained according to defined operational, legal and privacy requirements. Regular testing should cover alarm delivery, door-release behaviour, controller failure and recovery after network or power interruptions.
Build privacy, resilience and accountability into the design
Access logs, identity records and biometric information can reveal sensitive details about individuals. Collect only what is necessary, limit access to records, define retention periods and document legitimate purposes for processing. Where biometric systems are considered, evaluate less intrusive alternatives and implement appropriate safeguards.
Finally, test the complete installation before commissioning and periodically thereafter. Verify credential revocation, access schedules, emergency egress, backup power, offline operation, fail-safe and fail-secure behaviour, and recovery following a system outage. The correct door response during a fire or other emergency must follow applicable life-safety requirements and the approved design.
The best access control system is not necessarily the one with the most features. It is the one that reliably authenticates people, enforces appropriate permissions, detects anomalies, protects information and continues to perform safely when something goes wrong. Technology establishes the capability; disciplined management, competent integration and regular testing turn it into effective security.
