What is access control and how does it work?
The four parts of an electronic access control system, the rule it checks at every door, what a year of lost keys and departures looks like with keys and with cards, and the signs it is time to upgrade from traditional locks.
Technical figures checked against the sources listed at the end.
Access control is a system that decides who may open which door, and when, without handing out keys. A person presents a credential, such as a card, fob, phone or PIN, to a reader; a controller checks it against a rule that names the person's group, its doors and its hours; if the rule allows it, the controller releases an electric lock for a few seconds and records the event. Taking someone's access away is one change in the software instead of rekeying every lock and cutting new keys.
This guide uses one example throughout: a 20-person office on one floor of a Brooklyn loft building, with three doors under control: the suite entry off the elevator lobby, a supply room and a server closet. The building's street door belongs to the landlord's system and is left out. It is an example, not a client's office.
01What is access control?
Access control means letting the right people through a door at the right times, and keeping a record of it. The NIST security glossary defines it as the process of granting or denying specific requests to use information or to enter specific physical facilities. A key does the first half crudely: anyone holding it can open the lock at any hour, and the lock keeps no record of who did. Electronic access control adds the two things a key cannot do: rules about who and when, and a log.
The term covers two worlds. In IT, access control decides who can sign in to which files and systems. This article is about physical access control: doors, gates and elevators. The idea is the same in both: a request is granted or refused against a rule, and the decision is written down.
Most systems in offices and apartment buildings are networked. Every controlled door reports to a controller, and one piece of software manages all of them, so a change made once applies at every door. The simplest form is a standalone electronic lock, with a keypad or card reader built into the lock and its user list stored inside it. It suits a single door, but each lock has to be changed on its own, at the door.
02How does access control work? Four parts and one rule
Every tap at a reader runs the same short sequence: the credential is read, the controller checks its rule, the lock releases or stays locked, and the event is logged. Figure 1 follows it at the example office. Pick a person, a door and a time, and watch the controller check its rule table.
Swipe the drawing sideways to see the controller.
A card is held to the reader at the suite entry. The reader reads its number: card 4417.
CheckingThe answer comes when all three checks are done.
| Group | Doors | Days | Hours |
|---|---|---|---|
| Staff | Suite entry, supply room | Mon to Fri | 7 AM to 8 PM |
| IT lead | All three | Every day | any hour |
| Cleaning crew | Suite entry, supply room | Mon to Fri | 6 PM to 10 PM |
| Former employee | None | None | disabled |
LOG waiting for the event
The four parts of an access control system
- Credential. What a person carries or knows: a card, a key fob, a phone, a PIN, or a fingerprint or face. It holds or produces an identifier the system recognizes.
- Reader. Mounted beside the door on the outside, usually on the latch side. It reads the credential and passes the number to the controller. It decides nothing.
- Controller. A circuit board in a metal enclosure, usually in a closet or above the ceiling, that holds the rules and makes the decision. Most hardwired controllers keep their own copy of the user list, so the doors keep working when the internet connection drops. Ask how the system you are offered behaves.
- Lock. An electric strike in the frame, a magnetic lock on the header, or an electrified lockset in the door. The controller releases it through a relay for a few seconds, and it locks again on its own.
The parts you do not see at first
Three more parts make a door behave properly. A door position contact, a small magnetic switch in the frame, tells the controller whether the door is shut; without it the system cannot know that a door was forced or left standing open. A request-to-exit device, usually a motion sensor above the door or a switch in the lever, tells the controller that the door opened for someone leaving, so it raises no alarm. A lock power supply feeds the locks and charges a standby battery that carries them through a short outage; how long depends on the battery and the load, so ask how it was sized. The software, on a server in the building or in the cloud, holds the people, the groups, the schedules and the log. Our guide to commercial access control installation draws every part of one controlled door with each signal between them.
The rule: who, where and when
The controller does not keep a list of doors for each person. It keeps groups. Staff is one group, the cleaning crew another, the IT lead a third, and each group gets a list of doors and a schedule. This is role-based access control, the model NIST researched and that became the standard ANSI/INCITS 359: permissions belong to roles, and people are assigned to roles. Adding a new hire means putting one person in a group, not choosing doors one by one.
On every tap the controller runs three checks. Who: is the credential on the list and active? Where: is this door one of the group's doors? When: is it inside the group's days and hours? In Figure 1 the cleaning crew's card is refused at the suite at 8:52 AM on a Tuesday and opens it at 7:40 PM that evening. Nothing about the card changed, only the time. A former employee's card fails the first check at every door, because it was disabled on her last day, and the refusal is logged like any other event.
Security texts also describe discretionary access control, where the owner of a resource decides who may use it, and mandatory access control, where a central policy assigns levels that users cannot change. Those terms come from computer security. Door systems in offices and buildings are organized by groups, which is role-based in all but name, sometimes with a person-level exception such as one employee who also opens the server closet.
03Electric locks, power and the way out
The lock is the part people worry about, and the one with the most requirements attached. An electric strike replaces the strike plate in the frame; when it is released, its keeper swings so the latch can pass. A magnetic lock is an electromagnet on the header with a steel plate on the door; it holds while powered and lets go when power is cut. An electrified lockset puts the release inside the door's own lever lock, with power brought across the hinge. Our glossary compares the electric strike and the magnetic lock side by side.
Fail-safe and fail-secure describe the outside of the door when power is lost. A fail-secure strike stays locked from outside; a fail-safe lock opens, and every magnetic lock is fail-safe. Neither term is about getting out. A strike with a lever handle lets anyone inside open the door mechanically, with no power at all.
We pick the lock for each door around its use and the building's fire and life safety requirements. A magnetic lock needs a free way out from inside at all times: usually a motion sensor that cuts its power as someone walks up, a push button beside the door, and release by the fire alarm where the building's requirements call for it. The model codes, NFPA 101 among them, require doors on the way out to open from the inside without a key, a tool or special knowledge; the code in force where the building stands and the building's own requirements set the details. This is general information, not legal advice.
04Credentials: cards, fobs, phones, PINs and biometrics
A card and a fob are two shapes for the same chips, so choose the shape by how people carry it and the chip by what it protects.
- 125 kHz proximity cards and fobs. They send the same fixed number every time, with no cryptography, so a recording of that number works as well as the card. NIST guidance on facility access treats an identifier read without a cryptographic challenge as copyable. A new system should not issue them.
- Encrypted 13.56 MHz smart cards and fobs. Card and reader prove themselves to each other with keys that stay on the chip, and the exchange changes with every tap, so a recording is useless. The card type still matters: published research in 2008 broke the cipher of an early, widely used 13.56 MHz card family, so a 13.56 MHz label alone does not make a card hard to copy.
- Phones. The credential lives in an app and talks to the reader over Bluetooth or NFC. It can be issued and revoked with nothing to hand over or collect, and people rarely lend their phones. Plan a backup card for a dead battery and for anyone who does not want the app.
- PINs. Nothing to carry, but anyone who sees a code has it. Best as a second factor with a card on a sensitive room.
- Fingerprint and face readers. Nothing to lend, but everyone enrolls in person, and a fingerprint cannot be reissued. New York Labor Law section 201-a bars most private employers from requiring employees to be fingerprinted as a condition of employment, so plan a card option. This is general information, not legal advice.
Our comparison of key cards, key fobs, PIN codes and mobile phone credentials covers copying, remote deactivation and moving a building off old prox cards in detail.
05Keys vs electronic access control over one year
Rekeying a lock changes its pins so the old key stops working, which means every person who should still get in needs a new key. That is the arithmetic keys cannot escape: one missing key that opens D doors costs D rekeyed locks and a new key for each of the H people who hold one. In the electronic system the same event is one credential disabled, and nobody else notices. Figure 2 runs one ordinary year at the example office both ways.
Swipe the drawing sideways to see the whole year.
With keys
Each rekey: 6 locks rekeyed and 20 new keys, one per key holder.
With electronic access
Every opening logged with the card, the door and the time.
The year has not started. Each event appears as the cursor passes it.
With the figure's defaults, 6 doors and 20 key holders, and a rule of rekeying only when a key is actually missing, the year ends with 2 rekeys: 12 locks rekeyed and 43 keys cut. Rekey after every departure, the only way to be sure a returned key was not copied first, and it becomes 4 rekeys: 24 locks and 81 keys. The electronic office disables 5 credentials, issues 5, and lets the contractor's card expire on its own. It also has a record of every opening, which the keyed office does not have at all.
Electronic access does not remove every key. Most controlled doors keep a mechanical cylinder as an override, for a failed reader or a long power cut, and those keys stay with a very small number of people. If one of them goes missing, the override cylinders are rekeyed the old way. The override list is short and known, which is the point. A restricted keyway, where blanks are sold only to people the key owner authorizes, slows copying, and a written key log helps; neither tells you who opened the supply room last Tuesday.
06When to upgrade from traditional locks to electronic access control
Upgrade when keys stop being accountable: when a key has gone missing and you rekeyed, or should have; when you cannot say how many copies exist; when people need different doors or hours; or when you need a record of who opened a door. A shop where two owners hold the only keys may never need it. Answer the six questions in Figure 3 for your own space.
Swipe the drawing sideways to see the outcomes.
- A key went missing or was not returned in the last two years
- You cannot say how many copies of your keys exist
- Different people need different doors or different hours
- You need to know who opened a door and when
- You hand keys to vendors, contractors or temps
- You manage doors at more than one site
One system for every door people use daily
Put every door people use each day on one networked system with groups, schedules and one log. Doors nobody uses daily can stay keyed, with a door contact that reports when they open.
- A missing key means rekeying every lock it opens and cutting new keys for everyone. Electronic access turns that into one credential disabled.
- A key opens its lock at any hour. A group with a schedule lets the cleaning crew in from 6 PM to 10 PM and nowhere else.
Next stepA walk of every door, written as a door schedule, one line per door, before any hardware is chosen.
You rekeyed after someone left
This is the clearest signal. If an employee leaves without returning a key, or you cannot be sure the key was not copied, the careful move is to rekey every lock that key opens, and Figure 2 shows how that multiplies. Two or three rekeys in a few years is usually the point where owners start asking about cards.
You do not know who has copies of your keys
Keys get copied for cleaners, contractors and vendors, and copies made years ago may still exist. There is no way to list them or turn them off. Credentials can be listed, and each one disabled.
People need different doors or different hours
A key opens its lock at any hour. If the cleaning crew should be in from 6 PM to 10 PM on weekdays and nowhere near the server closet, that is a group with a schedule, not a key you hand over and hope about.
You need a record, or you have had an incident at a door
After stock goes missing or someone gets in who should not have, the first question is who opened the door and when. A lock cannot answer it. An access log can, and paired with a camera at the door it shows who was holding the card; our article on combining cameras and access control covers that pairing, and our guide to video surveillance for NYC office buildings covers the cameras.
You manage more than one location
Keys for several sites mean key rings, trips and a spreadsheet of who holds what. With one system, adding or removing a person at every site is one change from wherever you are, and the controllers at each site keep deciding locally if the link drops.
When keys are still fine
A small space with a handful of long-standing key holders, no turnover and nothing that needs a record can stay on keys. Keep a written key log, use a restricted keyway, and rekey the day a key goes missing.
07What upgrading to electronic access control involves
An upgrade starts with a walk of every door you want to control. At each one we note what the door and frame are made of, the hardware already on it, which way it swings, who uses it and when, and how a cable can reach it from the nearest closet. That becomes a door schedule, one line per door, and the hardware, the cable and the programming all come from it. Our guide to how to secure multiple entry points in a commercial building shows how to give each door a job before choosing its parts.
- Doors and frames usually stay. A strike goes into the existing frame, a reader goes on the wall, and the existing cylinder often stays as the override. Glass doors take a lock on the header or in the frame, because nothing can be cut into the glass.
- Cable and power. Each door gets a cable back to its controller. In pre-war buildings with plaster on masonry, that may mean surface raceway or an existing chase. Every penetration we make through a fire-rated wall or floor is fire-stopped. Power for the controllers and lock power supplies is coordinated with the electrician.
- Approvals. A tenant changing a suite door usually needs the landlord's written approval, because the door and frame belong to the building. Whether a permit applies depends on the scope and the building; we check during the site visit and say what applies before work is scheduled.
- Enrollment and handoff. Groups and schedules are entered from the door schedule, every door is tested, and the administrator accounts are handed over in your company's name, not the installer's.
What it costs depends on the number of doors, what each door is made of, the cable path to each, the credential type and whether the software carries a subscription, so a price comes after the doors are counted. Our access control installation service page shows what we install, and the commercial access control and office access control pages show those settings.
08Access control: frequently asked questions
What are the main components of an access control system?
Four parts do the work: a credential such as a card, fob, phone or PIN; a reader at the door; a controller that holds the rules and decides; and an electric lock, such as a strike or a magnetic lock. Each door also needs a door position contact, a request-to-exit device and a lock power supply with a standby battery, and software holds the people, schedules and log.
How does an access control system decide who gets in?
The controller checks three things on every tap: whether the credential is on its list and active, whether this door is one of the doors its group may use, and whether the time is inside the group's days and hours. Only when all three pass does it release the lock. Every decision, granted or denied, goes into the log.
What happens to electronic locks when the power goes out?
A battery in the lock power supply carries the locks and the controller through a short outage, for as long as its size and the load allow. If the battery runs out, a fail-secure strike stays locked from outside and a fail-safe lock, including every magnetic lock, opens. People inside must be able to get out either way.
When should you upgrade from traditional locks to electronic access control?
When keys stop being accountable: a key has gone missing and you rekeyed or should have, you cannot say how many copies exist, people need different doors or hours, or you need a record of who opened a door. A small space with a few long-standing key holders and no turnover can stay on keys.
Does access control still work if the internet goes down?
With most hardwired systems, yes: the controller keeps its own copy of the user list and the rules, so the doors keep deciding, and the events reach the software when the connection returns. Some cloud-only and Wi-Fi locks depend more on the connection, so ask how the system you are offered behaves.
How much does it cost to replace keys with access control?
It depends on the number of doors, what each door and frame are made of, the cable path to each door, the credential type, and whether the software carries a subscription. That is why the first step is counting the doors and writing a door schedule. A price follows from that schedule.
Start with the doors
The useful first step is a list: every door, who uses it and when, and what is on it now. Contact Seneca Security to set up a site visit, and we will walk the doors with you and write the door schedule.
Sources and standards
- NIST Computer Security Resource Center, glossary: access controlDefinition used in NIST SP 800-53 Rev. 5 and CNSSI 4009: the process of granting or denying specific requests to obtain and use information and to enter specific physical facilities.
- NIST, Role Based Access Control project; ANSI/INCITS 359-2004, revised 2012Permissions are assigned to roles and people are assigned to roles, instead of access lists kept for each person.
- NIST SP 800-116 Rev. 1 (June 2018)Guidelines for the use of PIV credentials in facility access: an identifier read without a cryptographic challenge can be copied; challenge and response with keys kept on the card resists cloning.
- Garcia, de Koning Gans, Muijrers, van Rossum, Verdult, Wichers Schreur and Jacobs, ESORICS 2008Dismantling MIFARE Classic: research showing the proprietary cipher of an early, widely deployed 13.56 MHz card family can be broken.
- NFPA 101, Life Safety Code, chapter 7 (means of egress)Locks on egress doors may not require a key, a tool, or special knowledge or effort to open from the egress side.
- New York Labor Law section 201-aFingerprinting of employees as a condition of employment, with its exceptions.
Have a project in mind?
Tell us which doors you want off keys. We walk the doors with you, then send a written door schedule and scope. Same-day quotes when we can. Licensed and insured.