Skip to content
Access Control Systems
Access Control System Integration
Most organisations do not have a single access control system. They have four of them, acquired at different times by different people, none of which talk to each other, and a spreadsheet somebody maintains to work out who has a card for which building.
That is the problem worth solving. Evolution designs and delivers access control across multi-site estates so that one identity, one policy and one audit trail applies everywhere, and so that removing someone’s access takes one action rather than four.
Our Access Control System Design and Integration
Access control design against a documented operational requirement, graded to BS EN 60839-11-1 where appropriate
Multi-site consolidation: replacing fragmented systems with a single managed platform
Credential strategy and migration across physical and mobile, including move from legacy proximity to encrypted smart credentials and phased mobile credential rollout
OSDP reader-to-controller deployment to BS EN IEC 60839-11-5:2020, currently at SIA OSDP v2.2.2, replacing legacy Wiegand
Integration with video surveillance, intruder detection, visitor management, lift control and building management
HR and directory integration so joiners, movers and leavers propagate automatically
Anti-passback, mantrap, airlock and interlock configuration for controlled environments
Muster and roll-call reporting for fire evacuation
Audit trail configuration for regulated environments
Planned maintenance, 24/7 support, and system health monitoring
Access Control Credential Security and Migration
A large proportion of access control estates still run on credential technology that has been publicly broken for well over a decade. MIFARE Classic, using the Crypto-1 cipher, was academically dismantled in 2008. Cloning a card from that generation requires equipment costing less than a decent lunch.
The reader-to-controller link is the second gap. Legacy Wiegand transmits unencrypted and unsupervised: a device spliced into the cable can capture credentials or inject them. OSDP replaces it with AES-128 secure channel encryption and supervised communication, and is published internationally as IEC 60839-11-5:2020.
Where we find either, we say so, and we plan a migration that does not require closing the building. Encrypted credential platforms such as MIFARE DESFire EV3 and HID iCLASS Seos, mobile credentials, and OSDP reader replacement can generally be phased zone by zone, with old and new running in parallel through the transition.
Mobile Access Credentials and Credential Strategy
Credential strategy is no longer a choice between one card technology and another. Most estates we work on now run encrypted smart cards and mobile credentials in parallel, with the balance shifting over time.
Mobile brings real operational advantages: instant issue and revocation, no card stock, no reprint queue at reception, and a credential that people report missing within minutes. It also brings decisions that need making before deployment rather than after: enrolment identity verification, offline revocation behaviour, and what happens when a device is flat.
The strategic question in 2026 is portability. In February 2026 the Connectivity Standards Alliance released Aliro 1.0, an open credential standard developed with founder members including Apple, Google, Samsung, HID, ASSA ABLOY, Allegion and dormakaba. It is designed to make mobile credentials interoperable between vendors rather than locked to one manufacturer’s cloud. If you are specifying a reader estate with a ten-year life this year, that materially affects what you should buy.
We plan credential strategy across both physical and mobile, and we will tell you where Aliro support is real and where it is roadmap.
Why Access Control Is Now a Cybersecurity Issue
Physical access control sits inside the cyber conversation rather than alongside it. Controllers are network devices with firmware, credentials and remote access paths. The management platform holds personal data on every employee, contractor and visitor. Integration with HR systems creates a data flow that needs to be governed rather than simply configured.
Regulators, insurers and enterprise procurement teams increasingly treat the security estate as part of the organisation’s overall cyber posture. Where you are asked to evidence that, the questions are practical: is the system segmented from the corporate network, are default credentials removed, is firmware maintained on a schedule, is remote access documented and time-limited, and is there a decommissioning process for devices leaving service.
We design and document to answer those questions before they are asked.
Access Control for Multi-Site and Multi-Country Estates
Running access control across borders adds problems that single-site design never surfaces. Different data protection regimes. Different fire and egress requirements. Local certification expectations. Language on readers and interfaces. Support coverage in the right time zone.
Evolution operates from offices across the UK, Ireland, the Netherlands, Norway, Italy and the United States, delivering to a consistent standard with local presence. For a multinational estate, that means one specification, one integration approach and one escalation route, with engineers who are in the country.
Access Control Systems and Technology We Work With
For access control, Evolution holds Platinum partner status with LenelS2 by Honeywell, Gallagher as a Certified Channel Partner, Genetec as a Certified Elite Partner, AMAG Technology, and Johnson Controls, where we hold Software House Enterprise Integrator status for C•CURE 9000.
We also work with Suprema for biometric readers, Mercury for open controller platforms, HID for credential technology, and Brivo and Genea where a cloud-hosted access control platform is the better answer.
That range matters because it means the platform recommendation is not predetermined. An estate that needs enterprise on-premises architecture and one that needs cloud-native management are different problems, and we can specify either.
Enterprise Access Control Migration in Practice
Global enterprise, 20,000 cardholders, three continents, zero disruption
A global enterprise needed to upgrade its LenelS2 OnGuard access control platform and move it from ageing on-premises servers to Microsoft Azure at the same time. The estate spanned Americas, APAC and EMEA: an enterprise master server, three regional servers, three regional COM servers, more than 500 intelligent system controllers, 20,000 cardholders, personnel import scripts, badge expiration and access level integrations, and Milestone XProtect video integrations across every regional server.
Two changes at once is the hard version of this project. Upgrading the application and migrating the platform separately would have meant two outage windows and two rollback plans. Doing both together meant designing the upgrade pathway and the cloud migration as one piece of work, including network architecture, WAN routing and firewall design for the new hosting environment.
Evolution’s Professional Services team took a phased approach: non-production testing, migration validation, then production cutover. All 20,000 users experienced zero disruption and the 500-plus controllers remained operational throughout.
The client’s operations team noted that the migration removed a standing dependency on ageing on-premises servers and SQL clusters, and with it the constant exposure to hardware failure.
FAQs About Access Control
Connecting the access control platform to the other systems that hold or need its data, so that they operate as one. In practice that usually means video surveillance, intruder detection, visitor management, HR and directory services, lift control and building management. The measure of a good integration is that an action taken once takes effect everywhere it should.
BS EN 60839-11-1:2013 sets system and component requirements and defines grades of protection. BS EN 60839-11-2:2015 provides application guidelines covering planning, installation, commissioning and maintenance. BS EN IEC 60839-11-5:2020 specifies OSDP for reader-to-controller communication, and BS EN IEC 60839-11-33:2021 defines ONVIF-based interfaces for interoperability between access control systems. For data centre environments, BS EN 50600-2-5 covers physical security specifically.
Open Supervised Device Protocol is the modern replacement for Wiegand as the communication method between readers and controllers. It supports AES-128 encryption, bidirectional messaging and supervision, so a tampered or disconnected reader is detected. Wiegand offers none of this. For any new installation, OSDP should be the default.
If they are 125 kHz proximity or MIFARE Classic, plan to. Both can be cloned with inexpensive equipment. Migration to an encrypted platform can normally be phased, running old and new credentials in parallel while readers are replaced zone by zone.
For most organisations, moving to a position where mobile is supported is now sensible, even if physical cards continue alongside. The more consequential decision is which reader estate you commit to, because readers outlive credential fashions. With the Aliro open standard released in 2026, credential portability between vendors is becoming a realistic expectation rather than a hope.
Yes, and it is usually one of the highest-value integrations available. Automating joiners, movers and leavers removes the single most common access control failure: people who left the organisation retaining working credentials.
Yes. We survey the estate, document what is there, and give you an honest assessment of what should be kept, upgraded or replaced, before any commercial conversation.