Access control systems help counter unauthorised access to a company’s facilities, which is a vital security installation as it’s one of the most dangerous incidents that a business can face. It is the prelude to virtually every conceivable kind of crime, from assault to data breaches and from equipment theft to industrial espionage. Unsurprisingly, this makes physical access control installations one of management’s major priorities when opening new UK facilities or overhauling existing ones – and the maintenance of these systems one of their top long-term priorities.
As historical context, the Home Office’s 2015 Commercial Victimisation Survey estimated approximately 33,000 on-premises incidents—including burglary, vandalism, and vehicle or property theft—across the information and communications sector. The figure relates to that survey year and should not be read as a current incident estimate. The following year, the Home Office found that almost 1 in 5 companies in the administration & support industry has experienced on-premises crime. Physical breach incidents are harmful not only to the physical well-being of employees, but also to a company’s financial well-being, reputation, and business opportunities. The financial effect of a security incident varies widely according to its type, duration, records affected, recovery work and business interruption. Businesses should assess those exposures using current evidence relevant to their sector and size rather than relying on a single historic cost-per-record or average-loss figure.
This is why access control system installation is a major priority for virtually every UK company. Access control is one of the primary means of ensuring the safety of your employees and of your business’s critical assets, whether physical or electronic. Advanced access control features, while helpful for many businesses, are particularly important for London companies that handle private data, such as financial information, personal records, or customer data. Not only do these companies need to restrict access to their facilities, but they also need to control and log employee access to various areas of their facilities and to the electronic data that they store.
Personnel authentication is the most visible of these functions. Its aim is to verify who a person is, or what credentials he or she holds – in other words, to ask them to present their identity, and to verify their identity through some mechanism. This can be done by verifying access codes, tokens (such as the familiar magnetic stripe card) or biometric data, such as fingerprints or iris patterns. Identification based on the first two types of data does not rely on verifying a person’s identity per se; rather, it verifies that a person holds some particular information or physical object that is issued in a controlled manner, only to people belonging to specific groups (employees vs. visitors, IT personnel vs. administrative personnel, etc.). Biometric data, however, is essentially unique to each person and allows unique identification of an individual.
Authorisation is granted based on a specific set of rules and is implemented through various types of access control components, such as door locks or turnstiles. The rules can vary, from group-based, generic access (such as granting access to the main facilities to anyone who presents an employee badge – and is, presumably, an employee) to specific, identity-based access (such as allowing access to highly-sensitive equipment only to certain employees using fingerprint-based authentication).
Access control is relevant only insofar as it is continuously monitored. At a minimum, it should be possible to know whether someone is present on-premises or not, but more advanced features, such as tracking, are sometimes required. Often, access control systems are integrated with general surveillance systems, allowing the consequences of every access attempt to be tracked. And, generally, besides this continuous monitoring, some form of record keeping is also required. This is useful not only in case incidents need to be officially reported – it is also a useful source for internal evaluation and optimisation, and can also be integrated with HR and staff databases to provide time and attendance data.
Planning and Installation of Access Control Systems
This wealth of features and potential implementation mechanisms makes planning and designing an access control system a very complex task. It needs to balance a company’s current security requirements, future development, and the costs associated with implementing them. Furthermore, access control system installation is a very painstaking task, which requires specialised knowledge, advanced skills and a rigorous procedure.
Access control system installation and planning have to take into account a great deal of industry- and country-specific standards and regulations. In the UK, relevant standards can include BS EN 60839-11-1 for electronic access control systems, BS EN 60839-11-2 for application guidance, BS 7273-4 where fire-protection interfaces are involved, and BS 7671 for applicable electrical installation work. The exact standards depend on the system and agreed project scope. However, UK companies that use access control systems also need to follow a diverse set of legal requirements, such as those concerning access for disabled persons, outlined in the Equality Act 2010.
Some manufacturers, such as Paxton, one of the leading manufacturers of access control systems, choose to impose additional requirements upon their partners. They disseminate and enforce these requirements through training and certification services, which focus on both general regulations, such as international standards, and manufacturer-specific knowledge and skills. Therefore, when offering such a certification, these companies vouch not only for their partners’ knowledge of their portfolio, but also for their compliance with international and regional standards.
The demands of most commercial companies will not exceed Grade 3 (medium to high-risk areas), which require online systems using two-factor authentication or single-factor biometric authentication and real-time monitoring. Typical examples of Grade 3 areas are server rooms and data centres. Grade 4 (high-risk) areas are the most costly to secure and are reserved for areas with highly specific activities, such as advanced research activity or airport cargo screening.
Correct grading is the cornerstone of a solid and cost-efficient design; underestimating access control requirements leaves your business unable to deal with certain risks, whereas overestimating them results in a needlessly expensive system that is costly to maintain and hampers day-to-day activity. Many businesses need little more than Grade 1-level protection, and companies which need Grade 2-, 3- or even Grade 4-level protection only require it for a few areas in their offices.
However, while correct grading is a necessary characteristic of a solid design, it is not the only quality that defines an access control system as adequate or inadequate. Design and planning activities also need to consider requirements such as integration with existing systems (such as staff databases or surveillance systems that are already deployed), the logistics of issuing, deploying and revoking access tokens, and long-term business development needs, such as scaling with the size of the company’s staff or upgrading access control panels.
Correct grading is the cornerstone of a solid and cost-efficient design; underestimating access control requirements leaves your business unable to deal with certain risks, whereas overestimating them results in a needlessly expensive system that is costly to maintain and hampers day-to-day activity. Many businesses need little more than Grade 1-level protection, and companies which need Grade 2-, 3- or even Grade 4-level protection only require it for a few areas in their offices.
However, while correct grading is a necessary characteristic of a solid design, it is not the only quality that defines an access control system as adequate or inadequate. Design and planning activities also need to consider requirements such as integration with existing systems (such as staff databases or surveillance systems that are already deployed), the logistics of issuing, deploying and revoking access tokens, and long-term business development needs, such as scaling with the size of the company’s staff or upgrading access control mechanisms.
A less obvious, but equally important class of safety requirements refer to safety in case of emergency. Access control systems are inherently designed to restrict entry or egress, but egress needs to be free under certain circumstances, such as fires. According to the NSI, the design and installation of access control systems “must not conflict with fire regulations and must not restrict exit in such a way as to endanger people in an emergency”.
In addition to these four primary requirement classes, modern access control systems can perform a variety of other functions, such as integration with a staff personnel database, real-time alerts using various delivery mechanisms (email, text, etc.)
Implementing proper security begins in the design stage, when equipment is selected based on the security requirements drafted after surveillance and grading. However, the final stage – its physical deployment – is also critical. Proper deployment is critical to every physical access component carrying out its purpose. For example, CCTV surveillance systems can be hampered by improper lighting, thus jeopardising audit trails by rendering CCTV images unusable for identification.
The integrity of an access control system is just as important as its security features. Indeed, if an access control mechanism, such as a magnetic door lock or a turnstile can be bypassed, it no longer offers any meaningful access restriction. The integrity of a system is ensured through measures taken both at installation and design time. At design time, it is ensured by selecting mechanisms with the correct protection parameters – such as the proper type of internal or external doors (made from adequate material and with adequate holding force) and by provisioning certain installation requirements, such as protective conduits for cables deployed outside controlled areas. However, in order for equipment to function at its rated reliability parameters, it needs to be properly installed, using adequate materials and tools and following the installation procedure prescribed by the manufacturer.
Requirements related to reliability – the equipment’s ability to function correctly at all times – are also strictly regulated. Access control systems can use uninterruptible power supplies (UPS) and redundant power and data paths in order to ensure that it continues to function properly even in case of power failures or incidents such as earthquakes and fires.
The fourth, and final concern of access control systems installation procedures is safety. The most visible aspect is operational safety – much of which, however, is inherently dealt with by integrity and reliability requirements. Operational safety requirements include routing cables so that they do not present a tripping or electrocution hazard and ensuring adequate shielding for electrical equipment such as electromagnetic door locks and PIN entry panels.
Conclusions
Given the importance of access control for modern businesses, it is no surprise that access control system installation is such a complex topic. As we have seen, it is meant to implement a highly complex design, while respecting a great deal of requirements imposed by governments, standard bodies, and sometimes even equipment manufacturers.
At the same time, identifying the correct security requirements is a challenging process in and of itself. While there is a place for advanced features such as two-factor authentication and facial recognition, many businesses need little more than eliminating the need for front door keys, which can be implemented using a simple PIN-entry panel or a card swipe door controller.
If you’re looking to upgrade your security, ACCL is your ideal partner. We are Paxton-certified partners, which means we adhere to the highest industry standards. Even more, we have been in this business for more than 28 years and our verified client feedback describes the quality and care delivered on completed projects.
In need of access control installation services? Let’s talk and schedule your FREE, no-obligations consultation.
Services relating to this post: Access Control Installation, CCTV installation, Security barriers, IP Security
Related topics: Hands-free access control Standards
Written by
Wayne founded ACCL in 1997 and has led more than 28 years of project delivery, helping organisations design, install and modernise the network infrastructure behind reliable connectivity, office moves and refurbishments. His experience spans copper cabling, fibre backbones, data centre infrastructure, Wi-Fi, CCTV and access control. About ACCL
