Skip to content
What Is an Access Control System?
If you have ever swiped or badged a card to get into an office, used your fingerprint to unlock a server room, or tapped your phone against a reader at reception, you have used an access control system. At its simplest, it is about replacing the old lock-and-key approach with something smarter – a system that knows who should be where, when they should be there, and keeps a record of it.
For most UK businesses these days, access control has become pretty much essential infrastructure. It’s not just about keeping the wrong people out (though obviously that matters). It’s about meeting insurance requirements, satisfying regulators, and frankly, making life easier for facilities teams who no longer have to chase down lost keys or replace locks across entire buildings when someone leaves.
The systems themselves range enormously. A small professional services firm might have a simple standalone setup managing a handful of doors. A multi-site manufacturing operation or data centre campus could be running enterprise platforms controlling thousands of access points across different countries. Getting the right fit depends on what you are protecting, how many people need access, and what other systems you need to talk to.
Types of Access Control Systems Explained
Card-Based Access Control
Card systems are still the workhorses of commercial access control across the UK. The principle is straightforward: present a card to a reader, the system checks whether you are allowed through, and either unlocks the door or doesn’t.
Proximity Cards (125kHz)
These are the older generation, using low-frequency radio technology. They have been around for decades and you will find them everywhere. The trouble is, the security community has known for years that they are relatively easy to clone. For a standard office where you are mainly trying to keep the general public out, they will do the job. For anything genuinely sensitive, they are a liability waiting to happen.
Smart Cards (13.56MHz)
The more modern option. These use encrypted communications and are much harder to compromise. You will hear names like MIFARE, DESFire, and iCLASS thrown around – these are the different standards. Beyond better security, smart cards can pull double duty for things like cashless vending, print management, or logging into computer systems.
The honest truth about card systems? They work well, but they come with admin overhead. Cards get lost, people leave and forget to hand them back, and there is always someone who lends their card to a colleague “just this once.” A typical proximity card costs £1-3, smart cards run £3-8 each – not huge sums individually, but it adds up when you are replacing dozens per year.
Biometric Access Control
Biometrics sidestep the whole lost-card problem by using something you can’t leave in your other jacket: your own body.
Fingerprint Recognition
The most common biometric approach. Modern readers are quick and reliable, and they actually get better over time as the system learns individual users’ prints. They work particularly well at staff entrances where the same people come through regularly.
Facial Recognition
This technology has come on enormously in recent years. Decent systems now handle glasses, beards, and tricky lighting conditions without issue. There’s an obvious appeal for contactless, hands-free access – something that jumped up everyone’s priority list during COVID. But here is the catch: facial recognition uses biometric data, which GDPR classifies as “special category personal data.” That means explicit consent requirements, Data Protection Impact Assessments, and the kind of compliance paperwork that makes legal teams nervous.
Iris Recognition
If you need the absolute gold standard in accuracy, this is it. False acceptance rates are measured in millions. You will typically see iris systems in data centres, pharmaceutical facilities, and defence installations – environments where the extra cost is justified by genuinely stringent security requirements.
The biometric conversation always comes back to privacy. You need proper GDPR compliance, you need user buy-in, and you need fail-safe alternatives for when the technology doesn’t cooperate. That said, the reduction in credential management hassle can be significant for larger organisations.
Mobile Credentials and Digital Wallets
This is where the market is moving fastest. Instead of carrying a card, your smartphone becomes the credential.
Smartphone Apps
Dedicated access control apps store encrypted credentials and communicate with readers via Bluetooth or NFC. The killer feature here is remote provisioning: you can issue and revoke access instantly, anywhere in the world, without having to post cards or wait for someone to collect them from reception. For organisations with high turnover or distributed sites, this changes the game entirely.
Apple Wallet and Google Wallet Integration
Your access credential sits in your phone’s wallet alongside your payment cards and boarding passes. There are some genuine advantages: the credential still works when your phone battery is critically low (a limitation that caught out early smartphone access solutions), users already know how wallets work, and there is usually no app installation required. You need compatible readers and platforms, but the user experience is seamless.
Mobile isn’t without considerations, mind. Not everyone has a compatible smartphone. Network connectivity matters for provisioning. And there is a change management piece – some people are surprisingly attached to their physical cards.
PIN and Keypad Systems
PINs are simple and cheap, but they have obvious limitations. Codes can be observed, shared, or guessed through trial and error. There is no audit trail showing which specific person came through – just that someone knew the code. These days, PINs are typically used as a second factor alongside cards or biometrics rather than as standalone credentials.
Multi-Factor Authentication
For high-security applications, combining credential types is increasingly standard. The classic formulation is: something you have (card, phone), something you know (PIN, password), and something you are (biometric). The logic is straightforward – a stolen card alone can’t get someone in if they also need your fingerprint or a PIN.
How to Choose the Right Access Control System
Assess Your Security Requirements
Start with the obvious question: what are you actually protecting? The answer determines almost everything else.
Run through a proper risk assessment. What would happen if an unauthorised person got into your server room? Your pharmaceutical storage? Your executive suite? The consequences vary enormously depending on your business, and they should drive your security specification.
Most buildings need different security levels for different areas. The reception area has different requirements than the finance department, which has different requirements than the data hall. Each zone might need different credential types, reader technologies, and verification procedures.
Consider Your User Population
Think about everyone who needs access (it is usually more categories than people initially expect!). Permanent staff, obviously. But also contractors. Visitors. Cleaners who work nights. Maintenance personnel who might turn up at odd hours. Emergency services who need to get in during an incident.
Each group has different requirements. Contractors might need time-limited access. Visitors need simple sign-in processes. Cleaners need access to certain areas but not others. Your system needs to handle all of these gracefully.
And think about scale. A system designed for 50 users has different requirements than one designed for 5,000. Build in headroom for growth rather than specifying to your current numbers exactly.
Integration Requirements
Access control doesn’t exist in isolation. It typically needs to talk to:
Time and attendance systems for automated clocking. CCTV for visual verification of access events. Intruder alarms for automatic setting and unsetting. Building management systems for HVAC and lighting control based on occupancy. HR systems for automated joiner/leaver processing. Visitor management systems for pre-registration and credential issuance.
Specify integration requirements early. Retrofitting integration after installation is invariably more expensive and more challenging than building it in from the start.
The Budget Conversation
Access control costs vary enormously based on scale and specification. Beyond capital costs, factor in ongoing expenses: annual maintenance (typically 10-15% of capital cost), software licensing, and credential replacement. These recurring costs often exceed the initial investment over a system’s lifetime.
Cyber Security Considerations
Here’s something that catches organisations out regularly: modern access control systems are networked IT systems. They need to be treated as part of your cyber security posture, not just your physical security.
Network Security
Deploy access control on segmented networks, separate from your main corporate infrastructure. Encrypt communications between devices. Implement strong authentication for anyone with administrative access. Monitor for unusual network activity just as you would with any other networked system.
System Hardening
Keep firmware and software updated. Disable unnecessary services and ports. Use strong, unique passwords (you would be amazed how many systems still run on factory defaults). Implement role-based access for administration.
Credential Security
Use encrypted credential technologies, not legacy proximity cards. Implement anti-cloning measures where available. Monitor for credential anomalies – like the same card being used at two different sites simultaneously.
Compliance and Standards
GDPR Implications
Access control systems process personal data. Every time someone swipes in, that is a processing event. You need lawful basis for this processing – typically legitimate interests for workplace security, though legal obligation applies where security is mandated by regulation.
Biometric systems add complexity. Biometric data is special category personal data, which means you need explicit consent or another Article 9 condition, a Data Protection Impact Assessment, enhanced security measures, clear retention policies, and robust deletion procedures.
Don’t forget data subject rights. People can request access to their own access control data. They can ask what you hold about them, request corrections, and in some cases, request erasure.
Define sensible retention periods. Most organisations don’t need access logs from three years ago sitting on a server somewhere.
Relevant Standards
BS EN 60839 covers alarm and electronic security systems, including access control. It addresses design, installation, operation, and maintenance.
BS 7273 is relevant where access control interacts with fire systems – door release during evacuation, for instance.
BS 7958 covers CCTV, which matters when access control integrates with video systems.
Different sectors bring additional requirements. Financial services have FCA considerations and PCI DSS where payment data is involved. Healthcare has CQC standards and NHS security requirements. Education has DfE guidance, Ofsted expectations, and safeguarding obligations. Defence work brings JSP 440 and List X requirements.
Installation and Maintenance
What to Expect During Installation
A decent installer will start with a thorough site survey: door types, existing hardware, cabling routes, power availability, network connectivity, integration points. From this comes a system design with door schedules, network architecture, integration specifications, and a commissioning plan.
Installation typically takes several days to several weeks depending on scale. Expect door hardware installation, controller installation and cabling, network configuration, software setup, integration commissioning, and user acceptance testing.
Handover should include administrator training, operator training, documentation (O&M manuals, as-built drawings), and clear support contact details.
Maintenance Best Practices
Regular maintenance keeps systems reliable and secure:
Planned Preventive Maintenance
Reader cleaning and testing, lock mechanism inspection, controller health checks, software updates and patches, backup verification.
Recommended Schedule
Monthly visual inspection and basic function testing. Quarterly comprehensive testing and credential audits. Annually, a full system service including software updates and security review.
Modern systems support remote monitoring – real-time fault alerts, performance analytics, predictive maintenance indicators. Take advantage of these where available.
Frequently Asked Questions
What’s the difference between access control and a door entry system?
Door entry systems handle entry to a building – typically an intercom where visitors request access and occupants release the door remotely. Access control manages movement within a building using credentials that identify specific users and enforce permissions. Many buildings use both: door entry for visitor arrival, access control for internal movement and staff entrances.
How much does a commercial access control system cost?
It varies hugely. A basic small office system (2-4 doors) might cost £3,000-£8,000 installed. Medium business systems (10-20 doors) typically range £15,000-£40,000. Large enterprise systems can exceed £100,000. Add annual maintenance (roughly 10-15% of capital cost), software licensing, and credential replacement for ongoing costs.
Can access control work during a power failure?
Yes, if properly designed. Controllers should have battery backup, and locks should be specified as fail-safe (release on power failure, appropriate for fire exits) or fail-secure (remain locked, appropriate for high-security areas) depending on requirements. Battery backup typically provides 4-24 hours of operation. Critical facilities often include generator backup.
How long do systems typically last?
Hardware typically lasts 10-15 years, though software and cyber security considerations often drive earlier replacement. Card readers and credentials may be upgraded more frequently as technology evolves. Plan for software updates throughout the lifecycle and budget for periodic technology refresh.
What happens when an employee leaves?
Credentials should be revoked immediately in the system – integration with HR systems can automate this. Physical cards should be collected and deactivated. Mobile credentials can be revoked remotely and instantly. Prompt leaver processes are essential for security and often required for compliance.
Next Steps
Selecting the right access control system takes careful thought about your specific requirements, user population, and operational context. Get it right and you will have a system that serves you well for years. Get it wrong and you will be retrofitting, upgrading, or replacing sooner than you would like.
Evolution provides comprehensive access control solutions across the UK, Europe and USA – from initial security risk assessment through system design, installation, and ongoing maintenance. As an employee-owned business with NSI Gold accreditation, we bring personal accountability and technical expertise to every project.
To discuss your access control requirements, request a security risk assessment, arrange a site survey or discuss integration with existing systems, please click the button below.