Access Control Security: Beyond Just a Locked Door

A locked door answers one question: who has a key. Real access control answers a much more useful set of questions -- who's allowed in, when, through which entrance, and how confident are you that the answer is actually being enforced.

What access control security actually includes

• Credential verification -- badges, key fobs, PIN codes, or a person physically checking ID, depending on the property.
• Visitor management, tracking who's on-site who isn't staff or a resident, and why.
• Time- and area-restricted access, so a valid credential doesn't automatically mean access everywhere, at any hour.
• Delivery and vendor verification, one of the most common ways an unauthorized person ends up inside a building legitimately-looking.
• A real audit trail, so if something happens, there's an actual record of who was where and when.

Why "we have badges" isn't the same as access control

A badge system that isn't paired with someone (or something) actually verifying it's being used correctly is just an expensive lock. Tailgating -- someone following an authorized person through a door without their own credential -- defeats almost any card-access system unless it's paired with staffed verification or physical barriers designed to prevent it.

Technology vs. staffed verification

Card readers, keypads, and visitor-management software all help, but they don't replace judgment -- a system can't tell the difference between a legitimate contractor and someone who found a way to make a badge work. Staffed access control adds the judgment layer that pure technology can't: noticing when something about a person or situation doesn't add up, even with valid-looking credentials.

Getting it right for a multi-tenant or mixed-use property

Access control gets more complex the more different groups need different levels of access -- tenants, visitors, vendors, delivery staff, each with a different appropriate level. A plan that treats everyone the same either over-restricts legitimate people or under-restricts everyone else.

What to ask a provider

1. How do they handle tailgating specifically, not just credential issuance?
2. What does the audit trail actually look like, and who has access to review it?
3. How is vendor and delivery access verified day to day?

The Security Industry Association tracks access control technology standards, and ASIS International covers the broader physical security practices around it.