To design access control in a company it is not enough to pick readers and controllers. A good design starts with an analysis of passages, risk and organisational processes, and only then moves to hardware. Below we describe a step-by-step process that helps avoid the most common mistakes: oversizing, gaps in the protection of escape routes and scaling problems.
Step 1: inventory of passages and risk assessment
Start with a list of all passages: doors, gates, turnstiles, barriers. For each, define the control direction (entry, exit, both), traffic volume and risk level. Separate areas with different access levels: reception, offices, server room, warehouse, technical rooms. This area map is the foundation of the whole project and determines the number of readers and the permission logic. Already at this stage, account for data protection requirements: the access control event log is personal data, so plan the retention period and log access rules in line with GDPR.
Step 2: choosing the identification technology
The way a user is identified affects both security and cost. Proximity cards are most often considered, although they differ in security level:
- Mifare Classic - popular and cheap, but with known cryptographic vulnerabilities. Not recommended where real security matters.
- DESFire EV2/EV3 - a modern standard with strong encryption, resistant to cloning, recommended for new installations.
For high-risk areas it is worth considering two-factor authentication: card plus PIN or card plus fingerprint. Mobile access is also increasingly used, where a phone with a credential in an app plays the role of the card. Match the readers to the chosen identification standard, because it is that standard that sets the real level of protection, not the mere presence of a reader at the door.
Step 3: system topology and cabling
Design the controller layout to minimise cable length and simplify servicing. The main controller manages passages through modules and readers connected on a bus. Plan cable routes, conductor cross-sections and cabinet locations with headroom for expansion. Leave spare inputs and outputs on the controllers, because adding modules later is cheaper than replacing the panel.
Step 4: power supply and safeguards
For each passage, decide the lock operating mode:
- fail-safe - releases on power loss, required on escape routes.
- fail-secure - locks on power loss, for higher-security rooms.
Provide backup power with battery hold-up and an unconditional connection of escape-route passages to the fire panel. A fire alarm signal must release the doors regardless of the state of the access control system. This is a safety requirement that must never be worked around with software logic.
Step 5: platform selection and scaling
Tie the software choice to the growth plan. For a single facility with a few passages, Protege WX with browser-based management and no server will do. For many sites, hundreds of passages and integration with CCTV and intrusion, choose Protege GX, which scales without replacing the infrastructure. Also design a permission policy: access groups, time schedules and card issuing and revocation procedures, so that administration is repeatable rather than improvised.
Step 6: acceptance testing and documentation
Before handing over the system, run acceptance tests on every passage: check reader operation, release on the exit button, behaviour on power loss and response to the fire signal. Verify that permissions and schedules work as intended. Close the project with as-built documentation: a passage diagram, device addressing, a permission list, emergency procedures. It is this that lets you service the system for years and hand knowledge to future administrators without reconstructing the logic from scratch.
Step 7: operation and permission review
An access control system does not end at commissioning. Plan a periodic review of permissions to expire access for people who have changed roles or left the company. Establish a clear offboarding procedure: an immediate card block on termination and quick revocation of a lost credential. A regular audit of who has access to which areas is the cheapest way to maintain real security, because the most common gap is not technology but outdated permissions forgotten over the years.
Planning access control in a new or modernised facility? Get in touch - we will help you go through the project from passage analysis to platform and device selection.