Access Control

Often, yes. Existing readers, electronic locks, controllers, power supplies and cabling may still be useful if they are reliable, supported and compatible with the proposed platform.

The important question is not simply how old the equipment is. Credential technology, communication protocols, firmware support, available capacity and the condition of the door hardware all matter. A proper assessment can separate components worth retaining from legacy equipment that would limit security, reliability or future expansion.

It depends on the locking hardware and how each door has been designed. Some locks are fail-safe, meaning they unlock when power is removed, while fail-secure hardware remains secured from the controlled side when power is lost; the required method of egress still has to be maintained.

Controllers and other access control equipment can also be supported by batteries or building emergency power for a defined period. This is why backup power and lock behaviour should be planned door by door rather than applying one configuration throughout the entire property.

Not necessarily. Many modern systems store access rules locally at the controller, allowing the door to continue making decisions even when its connection to the cloud is temporarily unavailable.

What may be interrupted is remote administration, live synchronization, notifications or other cloud-dependent functions until connectivity returns. Offline behaviour varies by platform, so it should be confirmed during system selection rather than assumed simply because a product is described as cloud-based.

An access-controlled door cannot be designed only around keeping people out; safe exit from the building is equally important. The type of locking hardware, door location, use of electromagnetic locks and connection with other life-safety systems can all affect the required configuration.

Ontario’s Building Code and Fire Code contain requirements governing locking and egress, so the correct arrangement depends on the specific opening and occupancy. For this reason, an electric strike, maglock or other lock should not be selected solely because it is convenient to install.

OSDP, or Open Supervised Device Protocol, is a communication standard used between access control readers and controllers. It provides bidirectional communication and device supervision, and OSDP Secure Channel can encrypt communication between compatible devices.

This is a significant improvement over traditional Wiegand communication, which does not provide the same encrypted reader-to-controller link. Wiegand equipment does not automatically need to be removed from every existing system, but protocol security is worth considering when planning new installations or upgrading higher-risk access points.

Not automatically. Fingerprint, facial or other biometric authentication can be useful where the system needs stronger assurance that the credential belongs to the person presenting it, but that benefit has to justify the additional privacy considerations.

Biometric information is sensitive because it is closely connected to the individual and cannot simply be replaced like a lost card or changed like a PIN. Before choosing biometrics, you should consider whether the same objective can be achieved with an encrypted credential, mobile access or multi-factor authentication using less sensitive information. Collection, storage, access and retention of biometric data should also be addressed as part of the system design.

Access control can reduce those risks, but a standard reader and locked door cannot eliminate them by themselves. Features such as anti-passback, card-and-PIN authentication, mobile credentials, turnstiles or other controlled-entry hardware can make credential sharing more difficult.

Tailgating is different because an unauthorized person may simply follow an authorized user through an already-open door. Depending on the risk, that problem may require door monitoring, video, physical entry controls or operational procedures in addition to the access control system.

There is no useful universal retention period for every property. The appropriate period depends on why the records are being collected, how they are used for administration or investigations, and any legal, contractual or organizational requirements that apply to the property.

Keeping data indefinitely simply because storage is available is not a good default. Retention should be intentionally defined, access to logs should be restricted to appropriate administrators, and older records should be handled according to the organization’s privacy and security policies.