Access control in offices: zones, schedules and visitors

Start with zones

• Public: reception, waiting area.
• General: work area, meeting rooms.
• Restricted: server room, archive, stockroom, accounts, management.

Not every door needs a reader. Control the main entrance and the restricted zones; the rest can stay open.

Profiles and schedules

Instead of granting permissions person by person, define profiles: staff, management, cleaning, maintenance, visitors. Each profile has its doors and its hours. When someone joins, you just assign a profile.

Credentials

• Card or fob: cheap and simple. Cancelled if lost.
• Phone: nothing to hand out, and hard to forget.
• PIN code: nothing physical, but easily shared.
• Biometrics: convenient, but biometric data has special protection; consider whether it's necessary and proportionate.

In sensitive areas, two factors can be combined.

Visitors and suppliers

• Temporary credentials with an expiry date and time.
• Access only to the zones they need.
• Video intercom with door release from reception or a phone.

What gets logged

Every opening, failed attempt and door left open. It helps investigate an incident and spot risky habits, such as an emergency exit being used as an entrance.

Data protection

The access log contains personal data. Staff must be informed, access to the log limited and a retention period set. Using it for time and attendance is a separate purpose, best discussed with your employment and data protection adviser.

Safety and evacuation

Controlled doors must always open from the inside to get out. The system is coordinated with fire detection to release doors in an alarm.

Integration

• Alarm: the first authorised entry disarms; the last one arms.
• Cameras: each event is linked to its footage.
• Lighting and heating: switched on by the first entry.

What to ask

• Does it work without internet and without the server?
• Who can add and remove users, and from where?
• Can it expand to more doors or another site?