A critical element in securing your business is controlling access to your business space. While cyber security tends to be front of mind for many businesses, controlling who enters your business and when is your first line of defense against intruders, thieves and even potential employee misconduct. Choosing wisely protects your staff, your stuff and your data.

What is an Access Control System?

Access control systems control entry to your business space and can also establish levels of access for areas of the office and particular devices. The system authenticates the identity of the user and cross references against a database to attain the access authorization level. This system gathers and stores data that then enables a business owner to monitor movement of employees and visitors in the office, which could lead to identification of perpetrators if there is a security breach and enables proactive assessment of security risks to make adjustments as needed.

Access control can be as basic as a sign-in sheet at the front desk monitored by a receptionist. However, this is not a solid security practice compared to today's advanced systems. These  include technology that identifies the individual seeking to gain access to your office or a restricted area, and allows access only to the areas aligned with their permissions.

There are several types of authentication:

  • Key fob/access card - a physical card that can be swiped or scanned for entry.

  • Biometrics - facial recognition or fingerprints that identify the person seeking access.

  • Password or pin code - approved users can enter into a keypad.

  • Mobile apps with barcode - approved users download the app to their phones and then generate a barcode to enter the office in the same way they'd use a key card.

There are many benefits to these forms of authentication. For each, the system administrator can immediately turn off an employee's access credentials upon his or her leaving the company. Additionally, for companies previously using a security guard or receptionist to approve access, technology supported systems speed up access for employees who previously may have had to wait their turn in line. And, if there's an emergency, access control systems can enable quick lockdown if needed. You can also set up the system to adjust resources such as lighting and air conditioning or heat in areas of the office not in use, which is good for the environment as well as your bottom line.

"The whole smart building concept is quickly gaining momentum," Robbie Danko, marketing manager for integrator LVC Companies in Minneapolis, was quoted as saying in a recent SDM Magazine article. "In many cases it is access control that is driving how a building is used in terms of getting information. In that way, access will evolve more quickly than it has in the past. People are used to living in a smart home and they work in a dumb building. As tenants change, their demands are changing, and those expectations are going to change."

Types of Access Control

There are two approaches to connecting the various components within a system, including door readers, locks, cameras and the administrative system or dashboard, which is generally a computer:

  • Traditional systems use control panels physically connected to system equipment. This is seen as the more secure option of the two types of systems, but it can be limited or costly in that there are caps on the number of access points that can be attached to a control panel. If one panel doesn't support the number of access points you require, you either have to reduce access points or invest in additional control panels.

  • IP systems are network-based, connecting door readers using the Ethernet or wireless connections. This removes limits on the number of access points in the system but there is concern about the potential for the system to be hacked.

There are three types of access control systems:

  • Discretionary Access Control (DAC): This is the least stringent form as it provides one level of access for all with approved credentials.

  • Mandatory Access Control (MAC): This is the strictest and most work-intensive form of access control as it requires the system administrator to assign an access level to each individual added to the system.

  • Role Based Access Control (RBAC): This is the most common form. With this approach, roles or job titles are added to the system with a level of access assigned to each based on the access needs someone in that role will have. Then when a new person is added to the system, they are added with a given role or job title and the level of access is automatically assigned. This is also called rules-based access.

There are also several options for hosting your system:

  • Locally hosted via an on-site server generally using a PC for system administration.

  • A cloud-based system that stores access permissions in the cloud and the administrator can access the system dashboard from anywhere via a web browser. The admin should experience uniformity of functionality across devices, i.e. access, information and experience should be the same whether on PC, tablet, mobile, or other device.  

  • A mobile or smartphone based system offers administrative and user functions via an app.

  • An IoT based system is an "integrated network of intelligent computing devices connected through internet to communicate with each other without any human interference," according to KISI, a provider of IoT facility security systems.

Editor's Note: Looking for Access Control Systems for your company? If you would like information to help you choose the one that's right for you, use the questionnaire below to have our partner, BuyerZone, provide you with information for free:

Securing Your Space

While smart office technology is growing in popularity, and access control systems can be a key piece of this technology, security will likely be your priority in making access control system decisions. There are many ways to improve your security:

  • Work with a security consultant to assess your security needs and identify the right system and protocol to address them.

  • Use two or more types of authentication, i.e. key cards and biometrics.

  • Opt for the anti passback feature. Anti passback limits the ability for someone to share his or her access card or mobile app with another user and helps protect against duplication of an access card. This requires a system that monitors both entries and exits from the controlled space. Once an entrance is recorded, those user credentials cannot be used to enter again until an exit is recorded.

  • Conduct yearly reviews that include analyzing system reports and checking system equipment for evidence of tampering. Adjust your technology and protocol based on any breaches or gaps you find.

  • Limit access to the system's control panels by keeping them in a secure location.

  • Consider using proprietary technology as it tends to be more secure than open source technology.

  • Train your employees on the security protocol and technology. Help them understand the role they play in protecting the office space, assets, themselves, and colleagues.

How to Select Your System

To assess the best system for your business, you'll need to understand your needs. Consider these questions:

  • How many access points are there into your business?

  • Are there areas of your office or specific devices that only certain employees are allowed to access?

  • How many people will you give credentials to? How complicated are their levels of access?

  • Who will manage your access control, i.e., someone in-house such as receptionist or security guard or will you outsource to a managed service provider?

  • Will your system integrate with other security technology, e.g. cameras, alarms, smoke detectors; with smart office technology; with time and attendance systems, etc.?

  • What type of reporting do you need? Do you need data integrated with video? Do you need this information stored indefinitely?

Answering the above will help you clearly share system criteria with sales reps and compare offerings across several vendors. You'll also want to understand the level of customer service offered by each vendor.

When getting estimates, be sure each is clear on what is included. Many factors impact pricing, such as:

  • Number of access points

  • Type of system

  • Type(s) of authentication

  • Type of hosting

  • Additional features (such as anti passback and integration with other equipment and systems)

  • Self-install or professional

  • In-house or outsourced monitoring

As access control is just one aspect of office security, you may want to consider vendors that can meet all of your security needs, including video surveillance, fire alarms, and monitored alarm systems. Learn more in our Office Security Guide 2019. ​

Editor's Note: Looking for Access Control Systems for your company? If you would like information to help you choose the one that's right for you, use the questionnaire below to have our partner, BuyerZone, provide you with information for free:


Editor's Note: Looking for Access Control Systems for your company? If you would like information to help you choose the one that's right for you, use the questionnaire below to have our partner, BuyerZone, provide you with information for free:

Editorial Disclosure: Inc. writes about products and services in this and other articles. These articles are editorially independent - that means editors and reporters research and write on these products free of any influence of any marketing or sales departments. In other words, no one is telling our reporters or editors what to write or to include any particular positive or negative information about these products or services in the article. The article's content is entirely at the discretion of the reporter and editor. You will notice, however, that sometimes we include links to these products and services in the articles. When readers click on these links, and buy these products or services, Inc may be compensated. This e-commerce based advertising model - like every other ad on our article pages - has no impact on our editorial coverage. Reporters and editors don't add those links, nor will they manage them. This advertising model, like others you see on Inc, supports the independent journalism you find on this site.