Cloud-managed platforms—done the UK-secure way
Managing multi-site estates and mobile credentials is simpler when the admin plane is in the cloud. But “cloud” doesn’t absolve you of security; it reshapes it. The UK NCSC Cloud Security Principles are a vendor-neutral checklist for due diligence and configuration—identity and strong admin authentication, secure administration paths, customer auditability, data protection, and separation between tenants. If you adopt SaaS for access control, make those principles your board-ready benchmark.
Equally important: keep deterministic decisions at the edge. Door controllers should cache permissions and continue to enforce policy during WAN or server hiccups, then reconcile events later. That behaviour aligns with the BS EN 60839-11-1 baseline for electronic access control systems and avoids the “door won’t open because the internet flickered” problem.
What to do now: baseline platform choices against the NCSC principles; write “edge determinism” into your acceptance criteria; and make sure network segmentation and admin MFA are in the design, not an afterthought.
(For the IP underlay that keeps this reliable, see our primer: IP Security System Installation.)
Mobile credentials become default—policy makes them safe
Smartphones as badges are moving from pilot to default. NFC and BLE readers support tap-to-enter and hands-free journeys that reduce queuing and improve accessibility—especially at busy lobbies and goods flows. The technology is ready; success hinges on BYOD governance and admin hardening. The NCSC’s BYOD guidance sets out what “good” looks like (device lock, up-to-date OS, revocation on loss, secure admin), while the ICO explains your data-protection duties when personal devices are in scope. Use both as your policy North Star and mobile credentials become a convenience, not a liability.
What to do now: standardise on readers that support mobile + OSDP; publish BYOD rules that your helpdesk can actually enforce; and pilot at one lobby plus a high-risk room before scaling.
(For touch-free options and upgrade paths, see our guide to Hands-Free Access Control.)
Biometrics mature—but governance decides where they fit
Face, fingerprint, iris and vein readers are faster, more accurate and better at presentation-attack detection than even a few years ago, as independent NIST FRTE testing keeps showing. But technology isn’t the only bar in the UK—the legal one matters more. The ICO’s biometric recognition guidance is explicit: if you use biometric recognition to identify people, you’re processing special category biometric data and you need a lawful basis, an Article 9 condition, a DPIA, and proportionate alternatives (e.g., card + PIN) where appropriate. Recent enforcement proves regulators expect necessity over less intrusive options.
What to do now: reserve biometrics for high-risk zones (labs, comms, secure areas) where you can justify the step-up in assurance; use cards/mobile elsewhere; and design enrolment, template security and opt-out paths before you buy readers.
AI moves from hype to “useful surrounding context”
AI doesn’t belong in the fire path; it belongs around the door to give operators context and reduce workload. Two practical wins:
- Tailgating detection and event-video correlation: when a door is forced or piggy-backed, the system bookmarks the right camera view and raises a useful alert rather than a raw alarm. This shortens investigations and tightens training.
- Anomaly detection across access logs: flagging out-of-pattern use (time, location, role) for human review instead of trawling spreadsheets.
Treat AI components like any other critical service: instrument them, update them, and keep humans in the loop. For procurement and design, the NCSC’s secure-AI guidance is the right yardstick for lifecycle controls and logging.
What to do now: start with one lobby; measure false positives in your lighting and crowd conditions; and integrate with your VMS so alerts bring up the right video, not another dashboard.
(We outline working patterns here: CCTV–Access Control–Alarm Integration.)
