Access Control System Planning

• Designing an access control system can be a daunting task, especially if the system required is substantially larger than what is already in place.
• But if you approach it methodically, you can reduce error and ensure that you get the exact system needed for your facility.
  • Assess the Situation
  • Observe Your Environment
  • Conduct a Site Survey and Security Audit
  • Get the Details
  • Ensure Code Compliance
  • Validate the Security Requirements
  • Determine Business Requirements
  • Selecting the Right Technologies

Assess the Situation

• What are the short-, mid-, and long-range vision for your access control system?
• Is it based on open standards, like 802.11b/g or 802.3af,for the most affordable infrastructure?
• Is it scalable enough to support possible mergers and acquisitions?
• What type of credential(s) are you using? How many are issued? What type of format are they? Can it support your projected cardholder population? Is it controlled to ensure there are no duplicate IDs?
• What investment have you made already? Is your current system upgradeable?
• What assets do you have, and what value do these assets have in relation to your operation or business? These range from physical assets like computers to patient records, employee records and client data.
• Have the assets changed, requiring higher levels of security? Perhaps the locks and/or key system needs to be changed as well.

Observe Your Environment

Essentially, you’re trying to find out about the culture at your facility. It can range from an open, accommodating environment to one with strict and limiting access controls. There will always be a conflict between convenience and security; the challenge is to create procedures and rules that balance these disparate goals. During your observation:

• Did you observe the employees holding doors open for each other? If so, how are they able to verify their current employment status?
• Did they open the door for persons carrying large packages? If so, did they check their IDs?
• Did visitors sign in at the reception desk? Did they wear ID badges? Were they escorted by staff members?
• Did students have a habit of leaving their dorm rooms unsecure? If so, what sort of liabilities fall on school administration if a theft occurs and they knowingly allowed that practice to continue?

Conduct a Site Survey and Security Audit

Walking through a facility can be invaluable toward developing a comprehensive access control plan. Here are a few things to look for:

• Mechanical Security: If the openings aren’t mechanically secure, any additional funds spent on electronic access control are wasted. Therefore the following must be addressed before moving forward on an advanced access control system:
  • Are the doors, frames, and hinges in good condition? Are they rugged enough for the application and durable enough for the traffic? Are the frames mortar-filled?
  • What key system are in use? Is it a patented, high-security type? How often do you re-core the locks? How many master keys have you issued? Have any ever been lost? How easy is it to reproduce the keys?
  • Do you have reasonable accommodation for the handicapped to ensure compliance with the Americans with Disabilities Act (ADA)?
  • Are cross-corridor fire doors in place? Do they have magnetic door holders tied to the fire system?
• Identify Assets and Value: Many consider assets to be tangible items that can be sold for quick cash. But assets include anything that someone might want to steal or destroy, and vary from one facility to another. The important thing is to put a price tag on the loss of the asset,plus the cost of lost productivity and potential liability that could result.
• Identify the Threat: Consider your surroundings. Have the surroundings changed? Have you noticed any evidence of gang activity? Have you noticed an increase in shuttered businesses? If so, perhaps an increase in perimeter security is in order. Increased lighting? Cameras? Gated access?
• Evaluate the Facility(s): This will help you identify what options you have when selecting products for the system. How old is the building? Does it have architectural or historical significance? How thick are the walls? Was asbestos used as an insulating material? If so, it may be difficult and costly to install conventional, wired access control devices. Perhaps a WiFi solution will be a good alternative.

Get the Details

For each opening requiring access control, you’ll need the following details to ensure you order the right product for the given application:

• Does the door swing in or out? Is it left or right handed?
• What’s the finish of the existing hardware? What’s the lever style? Would you prefer a more modern look?
• How does the customer expect each door to operate? Ensure that an operational narrative is written for each opening that covers the following conditions. This should include:
  • Normal State
  • Authorized/Unauthorized Access
  • Authorized/Unauthorized Egress
  • Monitoring & Signaling
  • Power Failure, Fire Alarm & Mechanical Operation
• Determine where to place access control equipment. This could be Telco and IT closets, server rooms, or administrators’ offices. Make sure your staff will have access for installation, and service and maintenance afterwards. Also, make sure you have enough space on the wall to mount access control panels, interface modules, and power supplies.
• Determine your network coverage. Do you have IP drops where you need them? Do you have sufficient WiFi coverage where you need it should you opt for WiFi locksets?

Ensure Code Compliance

several agencies have issued codes and standards over the years to enhance life safety, improve privacy, and reduce fraud. These need to be factored into your overall access control plan:
» Americans with Disabilities Act (ADA)
» Health Insurance Portability and Accountability Act (HIPAA)
» Sarbanes-Oxley (aka SarbOx or SOX)

Building Codes and Standards: Ensure compliance with following codes and standards:
• Model Building Code (IBC) – Amendments, Occupancy
• Life-Safety (NFPA 101) – Means of Egress
• Fire (NFPA 80) – Retro-fitting, Sprinkler Systems
• Accessibility (ANSI A117.1) – Operators,Credentials
• Electrical (NEC NFPA 70) – Installation,Wiring, Products

Validate the Security Requirements

Different applications have differing security requirement

These considerations need to be factored into your overall access control plan as they have a direct impact on product selection and system configuration:

• Lockdown
  • Is lockdown capability needed in the interior or just the exterior – or at all?
• Real Time
  • Is real-time communications to the access control system a critical requirement?
  • Perhaps for perimeter doors, but what about interior doors?
  • What if you could save money by specifying electronic cylinders with audit trail and time-zone capability, interactive touch-screen locks with voice-guided programming, or WiFi locks with on-board decision-making instead?
• Monitoring Requirements
  • How much monitoring will you need? In most cases, a door position switch will suffice.
  • However, some facilities want to know that the door is both closed AND secured; these aren’t necessarily the same thing.
  • Audit Trail Requirements
  • How important is it to know who and when someone entered a building or room? For code compliance, this feature is almost always mandatory, such as accessing computer rooms, personnel records, and patient records.
• However, some companies use audit trail reports to validate employee activity.
• High-Security and Classified Areas
  • For increased security, there are several options.
  • Is multi-factor authentication a requirement, such as card + PIN or even a biometric verification?
  • Should there be a two-man rule?

Determine Business Requirements

Let’s consider the final details that will allow you to complete your system design:

• Aesthetics
  • Many high-profile building owners use architectural design to make their facilities stand apart. This extends to the interior space as well. So is a black wall reader the right choice? Or would an elegant lock with integrated card reader and designer lever be a better option?
• Infectious Disease Control
  • Some locks and doors are available with an anti-microbial finish designed to inhibit the growth of bacteria.
• Turnover
  • What kind of turnover does your facility experience? Heavy turnover would be difficult to manage with a PDA-programmable offline lock. However, one card systems actually program access privileges onto the card, virtually eliminating the need to tour the doors to reprogram them. Of course, online solutions would address this as well.
• Applications
  • t’s inevitable that a variety of applications will converge into a single system. That’s why it’s important to select an access control system that can grow by providing application support for parking access, visitor badging, integrated video and other needs as required.
• System Management
  • It’s important to determine who, how, and where you will manage your new access control system. For enterprise-class systems, it might mean multiple departments will manage their own people, while a system administrator will maintain and manage the main, centralized system
• Budget
  • You ultimately need to know your budget However, with all the upfront research, your findings might be beyond their initial scope This is how long-term planning comes into play. You can develop a priority list over several phases to ensure you design an access control system that fully meets your requirements

Selecting the Right Technologies

All of these considerations are essential to keep in mind when selecting the right technologies for each opening in your facility.

Use the following guidelines to begin evaluating which technologies might be right for the various openings in your facility:

• Mechanical
  • Security is derived from the management and protection of physical keys
• Keypad
  • Users are managed with credentials or PINs associated with those users
  • Lost or stolen credentials are easily eliminated
• Offline
  • A user managed system with a locally maintained audit trail
  • Aids loss prevention by enabling a record of events
• Wireless
  • Locking hardware is integrated and configurable from the access control system, eliminating the need for additional software or manual programming
  • Real-time door status monitoring and real-time, configurable alarm notification
• Online
  • Real-time management and control through the access control system
  • Advanced security features, including real-time audits and lockdown capability

---

References :

• Access Control System Planning Guide by ASSA ABLOY Americas

---

see also :

• access control standards