Access Control Buyer's Guide: How to choose an Access Control system for your business

Assess your building's Access Control requirements

The first thing to consider when thinking about purchasing an access control system is what you want it to do, what you want to protect, and how you want it to function.

Different access control systems will provide different options, so determining what you actually require from it is a necessary first step. Questions to consider:

• Will the access control be internal, external or both? Will it need to last in potentially harsh environments?
• Do you want to include perimeter access such as gates and barriers? Will that also include vehicle access too?
• How many doors, buildings and sites will it include?
• How many people will it need to incorporate? Will they each need individual access permissions or can they be grouped?
• What types of doors will it need to cover? Do you have loading docks that need to be part of the system too?
• What are you expecting it to protect against? Opportunistic property theft, wayward members of the public, serious criminal intent, information theft, staff misconduct?
• Does it need lockdown capabilities?

Having a clear understanding of your specific security requirements will help you to choose an access control system that is right for you.

Type of Access Control credentials and authorisation methods

There are several methods of authentication and identification used by access control systems, so you need to choose a system that will allow you to use the one(s) you want and need.

PINs: A simple entry code entered on a PIN pad doesn't require any supplementary cards or fobs, but does rely on staff and contractors remembering the code. Good security practice would have the code changed regularly, and it would need to be reset if it was compromised or if a staff member left. Using a PIN would also limit monitoring capabilities if one code was used by many people, and it would be easy for someone to copy the code or pass it on to an unauthorised person.

Smartcards: Credit-card sized cards that are used with scanners at entrances are quicker than entering a PIN and are distributed individually, allowing easy monitoring and tracking who uses which access point. Smartcards for access control can utilise different technologies and frequencies, be programmed to specific access rights per person, and be managed from a central system. Cards can still be lost, stolen, or passed to someone else, but unlike with PINs, if a person leaves or a card is compromised, that card can be disabled on its own, leaving everyone else unaffected.

Fobs: Much like smartcards, small keyfobs are individually assigned, can be programmed per person and are managed from a central system. While they also carry the same risks, they also carry the same benefits, including being quick to scan. However, fobs are designed to be attached to keyrings, so may be less likely to be misplaced or stolen, and due to their smaller size may also be more convenient.

Mobile: Smartphones and watches can be used as access credentials via an app or wallet that stores individual details on the device, ensuring they are kept safe, and utilise the security features of the device to keep them protected. Mobile credentials therefore do not need additional things like cards, instead making use of something used every day. There is still a concern of losing or forgetting a phone, or of theft, not everyone may have access to a smartphone or watch, and not all devices may be able to utilise the feature.

Biometrics — Fingerprints and Face: Biometric authentication uses things that are unique to a person, such as fingerprints and faces, so they cannot be stolen or passed on. Good modern biometric technology has safeguards against spoofing and fraud, with live detection technology ensuring that a real person is using the scanner, not a photograph or video. Biometrics also do not require the use of additional cards or fobs, cutting the risk of them being lost, and speeding up the authentication process. They also reduce ongoing costs as new cards or fobs do not need to be purchased for new staff or to replace lost credentials. Facial authentication is particularly appropriate where touch-free entry is required.
However, the use of biometrics is governed by strict data protection laws, which require careful and secure handling of the data, including under what circumstances it can be collected, how long it can be kept, and what can be done with it.

The nature of your business may influence the method(s) you use — for example environments with high hygiene requirements will need a touch-free access control system, whereas a small office with one access controlled door may use a smartcard based system.

For additional layers of security, multi-factor authentication is recommended, combining different methods for stronger safeguards.

Size and scalability: Choosing a system that can expand

When choosing an access control system, ensure that it will not only meet your present requirements but will allow you to expand it in future if you need to.

• Are there restrictions on the number of connected access points?
• Can new doors be added easily?
• Can it grow across additional sites if necessary?
• What is the maximum number of users it can include?
• How easy is it to upgrade both the hardware and the software?
• What does the software licence cover?

Access Control data security and data protection

The use of an access control system requires collecting and managing data on those enrolled in it, so it is important to ensure this data is kept safe and secure. Choose a system that is encrypted to appropriate specifications, and is regularly updated and maintained to the highest standards (for example ISO 27001 and Cyber Essential accreditation). A system that can provide records of access and straightforward audit trails would also be beneficial.

In addition, the collection and use of personal data requires adherence to data protection laws, and access to it must be restricted only to authorised personnel.

Another consideration for system security is whether you want your data to be stored locally, on-site, with only specified access to it, or on a cloud-based system accessible from anywhere. Also check whether your data will be stored in such a way that the provider of your access system will be able to read it.

Access Control system reliability

Will your chosen access control system operate reliably in all circumstances and provide a safe and secure environment under even unexpected conditions? During normal operation, an access control system is designed to only allow entry to authorised people, so doors will usually only open when a recognised credential is presented.

However, how will your access control system operate outside of everyday use, such as:

• Power cuts, either total or partial
• Connectivity failure
• Fire alarm activation
• Lockdowns
• Damage to readers, computers or wiring
• Software or firmware issues

Ensure your access control system will not place anyone in danger in an emergency, but will also not leave your site vulnerable should an issue arise. One way of addressing this could be by utilising access authentication to enter a building or area, but using a simple 'press to exit' button for emergency use.

Check your chosen access control provider is reliable in their products and service. Read up on their history, their products and their customer case studies. Do they have the required accreditations and memberships that show they are reliable and trustworthy with your system?

Pick an access control provider that won't just tell you what you want to hear — choose one that will give you the secure system that you need.

Access Control software and ease of management

How easy an access control system is to use should be an important factor when choosing which one to install for your business. You need to use a system that can provide everything you require but also is straightforward to operate.

• Is the software compatible with your IT setup?
• How intuitive is it to use?
• Do you need specialist training, and if so, is this provided?
• Is it simple to add and remove authorised persons?
• Does it allow multiple users or limited logins per business?
• Does it provide everything you need immediately, or is additional work or integration needed?
• Can it speed up and streamline your admin, reporting and/or audit processes?
• Does it offer automations for reports and/or processes?
• How easy is it to add new access control points?
• Does your access control software easily integrate with other software, to avoid duplication?

Installing an exciting new access control system is only the first step in your access control process — you need to be able to run it, use it and manage it in the way you want, with minimal or no outside assistance.

How much an Access Control system costs

An access control system is a significant investment, but the cost will be affected by a number of factors, including:

Number of access points: The cost for your access control system will increase as the number of access points to include increases, as more hardware will be required.

Existing system integration: If your access control system will need to work with existing systems such as fire alarms or time and attendance, the cost may increase as work may be required to ensure a seamless integration.

Type of authentication: Different types of authentication will incur different costs; if you want to use smartcards or fobs, make sure you know how much these cost, and how often will may need to purchase more.

Maintenance contracts and/or software licences: Contracts and licences may be a one-off cost, a monthly payment, or a yearly subscription, or they may not be included at all; make sure you discuss these during your consultation and survey so they don't come as a surprise later.

In addition, do the setup costs solely include the access control hardware and software, or have you been informed of other factors such as additional materials and installation time?

You may also want to think about potential future expansion of the system, and how cost-effective this will be.

Make sure you don't overspend on unnecessary features, so ask about different versions (such as 'lite' or 'enterprise' options for different business sizes), and check that all the system functions you need are included in the price.

Price is an important deciding factor when choosing an access control system, so make sure you know how much it will cost upfront, that you pay only for what you need and that you aren't surprised by hidden costs.

Future proofing your Access Control system

An access control system should last for as long as you want it, so when deciding on a system make sure it will provide the service you need, not just now but in the future.

Your access control system must be able to grow with your business, not just in size but in scope and function if necessary, and must remain secure against new types of threat both physical and virtual.

Will your chosen system be able to easily incorporate new users, credentials, sites, integrations and features without incurring huge additional costs or disruption? And will your provider help to keep your system up to date should it be required?

In addition, should the worst happen and your chosen provider ceases operations, how easy would it be to integrate their system with a new provider? Would you need to purchase an entirely new system, or could existing hardware work alongside other software without issue?

Keeping your access control system future-proof — or at least, future-ready — is a significant requirement and should be seriously considered when choosing an access control provider for your business.