An access control system checks a credential — card, PIN, fingerprint, or phone — against rules, then unlocks the door if approved and logs the event either way.
A card tapped at a reader is approved or denied in well under a second. Whether you manage one building or a campus, understanding the parts and flow makes problems easier to diagnose and purchases easier to justify.
What Counts As An Access Control System?
An access control system is hardware, software, and rules that grant or deny entry to a physical space or digital resource. The General Services Administration’s definition spans information access and entry to physical facilities, including federal buildings, military establishments, and border crossings.
IEC 60839-11-1:2013 sets minimum functionality, performance requirements, and test methods for electronic access control systems used in and around buildings and protected areas. The Department of Homeland Security publishes an Access Control Technologies Handbook for planning and design. Digital access control follows the same logic: a login presents a credential, a system checks it against policy, and access is granted or refused.
How Does The Credential-To-Unlock Flow Work?
Every system runs the same five-step loop: credential presented, reader captures it, controller checks it against permissions and schedules, lock releases on approval, event gets logged. The reader never makes the call — it only captures the credential and forwards data to the controller.
The controller compares the credential to a local or synced database, then checks access level, time schedule, holiday calendar, and door status. Common credential types include card or fob, PIN, fingerprint, and mobile device credentials.
Granted entries, denied attempts, forced-door events, and held-door events are recorded with timestamps plus door and credential IDs, making incidents reviewable.
What Does Each Part Of The System Do?
| Component | Job In The Flow | Failure Symptom |
|---|---|---|
| Credential | Carries the identity being presented (card, fob, PIN, fingerprint, phone) | Works at one door, not another |
| Reader | Captures the credential and forwards data to the controller | No beep, no light on tap |
| Controller | Compares credential to database plus schedules and door rules | All doors deny at once |
| Lock or strike | Physically releases the door on approval | Approved but door stays shut |
| Door sensor | Reports held-open and forced-open conditions | Alarms with no event logged |
| Audit log | Records granted, denied, forced, and held events with timestamps | Gaps in the history |
| Management software | Assigns access levels, schedules, and holidays | Changes never reach the door |
What Breaks Them, And What Prevents It?
Most failures trace back to installation and documentation. System behavior depends on correct wiring, cable type and gauge, cable lengths, and interconnections. Installer-provided as-built documentation, wiring and interconnection details, and user manuals are genuine maintenance assets, as UK guidance notes. Without them, every service call starts from zero.
Compatibility is the second trap. Reader-to-controller communications commonly run over RS-485 or Ethernet, and credential data travels using Wiegand or OSDP protocol. Mixing devices that don’t speak the same protocol stalls integration projects.
What Applies To Government And Regulated Sites?
Standards differ by agency and update often. The Department of Education’s Information Technology (IT) Access Control (AC) Standard, dated March 14, 2025, applies to all information and systems supporting Department operations and assets — including systems managed by another agency, a contractor, or another source — and supersedes prior governance documentation establishing the same standards.
For federal IT, the GSA documents procedures in CIO-IT Security-01-07, Revision 8. SAP Access Control 12.0 SP29 is an example of commercial product-line naming. Confirm which standard version is currently in force before drawing up a specification, since the federal IT access control standard has been revised repeatedly.
Which Type Fits Your Building?
Match the credential and controller to the traffic. A single-door office and a multi-building campus need very different hardware.
- PIN or keypad: lowest cost, no credentials to issue, but codes travel fast and can’t be individually revoked without a change.
- Card or fob: easy to issue and revoke, works well for offices and gyms.
- Fingerprint: nothing to carry, useful where sharing credentials is a real risk.
- Mobile device: convenient, but check reader and protocol compatibility before you buy.
Physical access control covers buildings and protected areas; the same core flow works for both, with differences in scale, credential type, and audit-log rigor. For a head start on hardware, this roundup of tested access control systems covers common options and their trade-offs.
For threat model and credential security detail, NIST IR 7316 remains one of the clearest technical references on electronic authentication and its physical counterpart. The National Protective Security Authority’s guidance on automatic access control systems for pedestrians also covers installation and maintenance expectations.
FAQs
Does The Reader Decide Whether To Unlock A Door?
No. A reader only captures the credential and passes data to the controller. All access decisions — schedule checks, holiday rules, access-level comparisons — happen at the controller, which triggers the lock. Assuming the reader makes the call is a common diagnostic mistake.
Do The Same Rules Apply To Digital And Physical Access?
The logic is identical: a credential is presented, checked against policy, and granted or denied. Physical systems cover buildings and protected areas; digital systems cover information and services. The GSA’s definition covers both in one framework, which is why access control standards usually address them together.
What Documentation Should You Keep After Installation?
Keep as-built drawings, wiring and interconnection details, cable type and gauge records, and user manuals. System behavior depends on those details during service and maintenance. Without them, every fault-finding visit starts from scratch, and small faults turn into long downtime.
References & Sources
- U.S. Department of Homeland Security. “Access Control Technologies Handbook” Supports federal planning and design guidance for physical access control, including the PACS reference under AEL 14SW-01-PACS.
- NIST. “NIST IR 7316: Assessment of Access Control Systems” Supports the technical underpinnings of credential checking and access decisions.
- National Protective Security Authority (UK). “Automatic Access Control Systems for Pedestrian Systems” Supports guidance on installation documentation, wiring, and maintenance.
