Introduction
Every building has the same basic problem. You need to decide who gets in, who stays out, and what happens at a door when nobody is standing next to it. An access control system handles that with managed permissions, logged entry events, and rules you can change when people change roles or leave.
Plenty of facilities still run on shared keys and a sign-in sheet at the front desk. We see the same gaps again and again in that setup: keys that were never returned, a former contractor who still has a working fob, tailgating at the side entrance, and no record to pull when something goes missing.
This guide covers the main access control technologies, deployment models, and permission structures. It also covers the choices that tend to cause trouble later, so you can match a system to your risk, your site count, your integrations, and your compliance obligations.
Key Takeaways
- An access control system is credentials, readers, controllers, locks, software, and logs working as one system. A weak link anywhere shows up at the door.
- Keypads, cards, mobile credentials, and biometrics each trade security against cost and convenience. Most sites use more than one.
- Cloud, on-premises, hybrid, and standalone deployments suit different IT setups. The right answer depends on who will run the system after go-live.
- The system only stays secure if someone owns it: least-privilege permissions, visitor handling, log review, and a plan for growth.
What Is Access Control?
An access control system is the mix of hardware, software, and procedures that decides who may enter a space, when, and what gets recorded. The sequence is simple:
- A person presents a credential: a card, code, phone, or fingerprint.
- A reader captures that credential.
- A controller checks it against authorization rules.
- The lock or barrier grants or denies entry.
- The system logs the result.
Three terms get mixed up a lot. Identification is claiming who you are. Authentication is proving it. Authorization is what you are allowed to do once you have proved it. A valid badge authenticates the holder. It should not open every door.
Where is access control used?
Access control covers far more than the front entrance. Common applications include:
- Corporate offices and commercial buildings
- Hospitals, clinics, and senior care facilities
- K-12 schools and college campuses
- Manufacturing plants and warehouses
- Banks, credit unions, and financial back offices
- Data centers and government facilities
One system might control a single door, a group of interior rooms, a parking gate, or entry points across many buildings.
Why is access control important?
Poorly managed access creates predictable problems. Keys never get collected. Credentials stay active after someone leaves. Two departments grant the same role different rights. And without logs, there is nothing to review after an incident.
Federal guidance treats access logs as a working security tool, not paperwork. NIST SP 800-53 control PE-6 calls for organizations to monitor physical access, review physical access logs, and coordinate the results with their incident response capability. The Interagency Security Committee's facility access control best practice, published through CISA, also advises facilities to keep a log of random security screening events in case of an audit or complaint.
In practice, the log only helps if someone reads it. A common mistake we see is a system that records every event while nobody has been assigned to review exceptions like after-hours use, repeated denials, or doors held open.
Types of Access Control Systems
"Type" can mean the credential technology, the deployment architecture, the permission model, or the physical configuration at the opening. Most real installations combine several of these.
Authentication and Credential Types
Card and fob-based access uses proximity cards, RFID credentials, or smart cards read at the door and checked against the permission database. It is the most familiar option for offices, campuses, and multi-door sites. Administrators can turn off a lost card right away and assign role- or schedule-based permissions. The weakness is older credentials. Legacy 125 kHz proximity cards can be cloned, so if your site still runs them, plan a migration path to encrypted smart credentials before you add doors.
Keypad and PIN-based access requires a code at the door. It suits low-risk doors, equipment rooms, or short-term access where issuing a badge isn't practical. Codes get shared, watched over a shoulder, and reused, so use unique, time-limited codes rather than one number for everyone.
Biometric access compares a fingerprint, face, or iris scan to an enrolled template. It fits sensitive areas like server rooms or pharmacies because access is tied to the person, not something they can hand off. The trade-offs are enrollment time, readers that struggle in some environments (gloves, dust, bright sun), and privacy law. Illinois (BIPA), Texas (CUBI), and Washington (RCW 19.375) each have biometric notice and consent requirements, so get the policy reviewed before you enroll anyone.
Mobile and wireless access turns a smartphone into a credential over Bluetooth or NFC. A 2021 Secure Technology Alliance white paper notes that mobile credentials can be cancelled, replaced, suspended, or restored remotely, which cuts down on physical badge administration. The trade-off is dependence on the phone. A dead battery is a locked-out employee, so keep a backup credential policy.
Visitor and temporary access systems cover the people who aren't in the permanent badge database: contractors, vendors, and guests. These systems support pre-registration, ID checks, host notification, badge printing, and credentials that expire on their own. Tie them to calendars and video surveillance and the visitor trail becomes something you can audit, not a paper log at the front desk.
Deployment and Architecture Types
Standalone and on-premises systems keep the hardware and software at the facility. They suit sites with network isolation requirements or poor connectivity. The cost is site-by-site administration, and it gets harder to hold every building to the same policy.
Cloud-based and enterprise access control centralizes administration, reporting, and updates on a hosted platform. The Security Industry Association notes that cloud access control is generally paid per door, per month, rather than as a one-time software purchase. In exchange, the provider takes on the server and much of the software upkeep.
This model fits distributed organizations and campuses without IT staff at every site. It depends on reliable internet, and you need a clear written agreement on who is responsible for cybersecurity.
Hybrid deployments pair local controllers with cloud management. Because credentials are cached at the controller, doors keep working through a network outage, and administrators still get centralized visibility once the connection comes back. Hybrid appeals to organizations upgrading in phases or keeping existing door hardware.
Physical Security Configurations
Video-integrated access control links entry events to camera footage, intercoms, and alarm workflows. If a badge is used at 2 a.m., an operator can pull the matching clip instead of scrubbing through hours of video. You see this at loading docks, restricted labs, and high-value storage. Settle retention periods and camera placement at design time. Retention set by the NVR default rather than by policy is one of the most common problems we find.
Mantraps, turnstiles, and multi-door systems physically control movement to stop tailgating. They are common in data centers, labs, and secure government spaces. They add construction cost, slow throughput, and are limited on egress routes by life-safety codes.
The 2010 ADA Standards (section 404.2.1) state that revolving doors, revolving gates, and turnstiles cannot be part of an accessible route, so an accessible gate or door is needed alongside them. Bring the architect and the authority having jurisdiction into that review early.
Access Control Models
Role-based access control (RBAC) assigns permissions by job function, department, or clearance level instead of person by person. It is the practical default for least-privilege access and faster onboarding.
Rule-based and attribute-based access control add conditions such as time, location, employment status, or risk level. A contractor might get access only during a project window. An employee might be limited to certain buildings and shifts.
Discretionary and mandatory access control sit at opposite ends. Discretionary models let an owner or administrator grant permissions as needed. Mandatory models enforce fixed, centrally set classifications, common in high-security and government settings. Most organizations blend models.
How to Choose the Right Type of Access Control System
Match the system to your risk, your users, and how the building actually runs. Newer or more complex is not automatically better.
Define Protection Needs and Users
Start with what needs the most protection. A general office entrance doesn't need the same control as a server room, medication storage, or a records room. Rank sensitivity before you pick technology. In Mastering Modern Security, IPS's Rob Jackson describes a biological-pathogen facility where input from operations and compliance showed that one area needed card plus two-factor access for a very short list of people, while the rest of the building did not.
Then document your users:
- Employee count and turnover rate
- Shift patterns and shared workspaces
- Visitor and vendor volume
- Temporary workers and emergency responder access
These drive credential choice, how fast you need to provision people, and how the visitor workflow should work.
Plan for Scale, Architecture, and Integrations
One building has different needs than a multi-site portfolio. Count doors, sites, and administrators today, and estimate where you'll be in three to five years.
Weigh cloud, on-premises, hybrid, or standalone against network reliability, cybersecurity requirements, and whether doors must keep working in an outage. A useful rule of thumb: if you have no IT staff at most sites, start by looking at cloud or hybrid. If your security team has strict network isolation rules, on-premises may be the only option IT will approve, so involve them early.
Confirm the system works with what you already run: video, intrusion, fire and life-safety, elevators, HR directories, and emergency notification. Also ask about the reader-to-controller wiring. OSDP (Open Supervised Device Protocol) supports encrypted, two-way communication and device supervision. Legacy Wiegand is one-way and unencrypted. If you're reusing old readers, find out which one you have.
Factor in Compliance and Total Cost
Healthcare facilities answer to HIPAA's physical safeguards. Financial institutions follow FFIEC examination guidance. Federal systems follow NIST SP 800-53. Check the specific requirements for your industry and state before you finalize biometric or data retention policies.
Look past the hardware price. Include cabling, software licenses, credential issuance, training, repairs, upgrades, and support over the life of the system. Parts wear out at different rates: as a rough guide, a central server or database lasts 4 to 6 years, control panels and power supplies 7 to 10, and card readers 10 to 12. Budget those replacements from day one rather than as emergencies. Existing wiring and door hardware can often be reused, but only if a survey confirms they are in good shape. Skipping the door-hardware survey is one of the most expensive mistakes we see, because frames, strikes, and exit devices that don't match the design turn into change orders mid-install.
Multi-site or complex environments usually benefit from a professional assessment rather than assembling hardware piece by piece. IP Systems (IPS) provides access control assessment, design, installation, integration, and ongoing support for commercial and public-sector facilities. We have done this work since 1998, for organizations in education, healthcare, government, manufacturing, and other industries.
What to Check Before Finalizing a Type of Access Control System
Before you sign off on a design, go through this checklist:
- Right-size the technology. Don't put a biometric reader on a supply closet when a card reader will do.
- Decide who owns the credential database. Enrollment, role changes, expiration, suspension, and deactivation on the day someone leaves all need a named owner and a written process. When nobody owns it after go-live, permissions drift within months. A small security committee helps here: HR owns who is authorized and badge removal at termination, IT owns directory links such as Active Directory, and a quarterly user access audit catches accounts and badges nobody uses.
- Check each egress door's locking hardware. Decide fail-safe or fail-secure per door, document it, and confirm it with the fire marshal or AHJ. Getting this wrong at an egress door is a life-safety problem, not a configuration detail.
- Review the trade-offs honestly. Consider privacy, accessibility, emergency egress, offline operation, data ownership, and compatibility with existing doors.
- Get a documented support plan. It should cover testing, administrator training, firmware and software updates, incident response, and future expansion.
- Validate performance before acceptance. Use site surveys, a pilot on a few doors, and a written acceptance test before final approval. Make sure you receive as-built drawings, door schedules, and admin credentials at handover.
Questions to Ask Any Integrator
- Which of our existing readers, panels, and cabling can be reused, and how did you confirm that?
- How will you handle work in an occupied building, and which doors will be out of service during cutover?
- Is the rollout phased or a single cutover, and what is the fallback if a phase slips?
- What is included in acceptance testing and training, and who on our team signs off?
- Who patches controller firmware after go-live, and how often?
Existing infrastructure can be reused when it still meets your needs. IPS designs upgrades that way where it makes sense, which can reduce both cost and disruption.
Conclusion
Access control decisions come in three layers: how people prove identity, where the system runs, and how permissions are granted.
- Keypads, cards, mobile credentials, and biometrics for authentication
- Cloud, on-premises, or hybrid architectures for deployment
- RBAC, rule-based, and mandatory models for who gets access
No single type fits every site. Match the mix to your risk, your users, your site count, your integrations, your compliance needs, and your long-term budget.
Before you finalize a design, think about the full lifecycle (design, installation, credential administration, and maintenance) and not just the hardware on the door. If you want a second set of eyes on your plan, Schedule an Access Control Assessment with IPS.
Frequently Asked Questions
What are examples of access control systems?
Common examples include card or fob readers, keypads, biometric readers, mobile credentials, visitor management platforms, cloud-based systems, video-integrated systems, and mantraps or turnstiles.
What is the most common type of access control system?
Card- and fob-based systems are still the most widely used because they are familiar, scale well, and are easy to administer. Mobile and biometric options are growing where convenience or stronger identity assurance matters more.
What is the difference between physical and logical access control?
Physical access control governs entry to buildings, rooms, and sites. Logical access control governs access to networks, applications, and data. Many organizations now manage both under one identity strategy.
What are the four access control models?
The four core models are discretionary (DAC), mandatory (MAC), role-based (RBAC), and rule- or attribute-based access control. Each assigns permissions differently, from owner discretion to fixed, centrally governed classifications.
How do I choose the right access control system?
Evaluate your protected assets, user and visitor patterns, site count, deployment architecture, required integrations, compliance obligations, and total cost of ownership together. Deciding on any one factor alone usually leads to rework.
Can access control systems integrate with video surveillance and alarm systems?
Yes. Most current systems can link access events with cameras, intrusion detection, alarms, and intercoms. Confirm compatibility, cybersecurity requirements, and privacy settings before deployment.
