A small business usually arrives at access control the same way: someone leaves, nobody knows how many keys exist, and rekeying every cylinder in the building suddenly looks expensive. Electronic access control solves that specific problem well. It also brings a set of decisions that are easier to make before you buy than after.
What follows is general information. Anything touching egress doors, fire rated openings, or life safety systems needs a licensed design professional and the approval of your local authority having jurisdiction.
System Anatomy
Five things, on every door.
- Credential. What the person presents: a card, a fob, a mobile credential, a PIN, a biometric.
- Reader. The device that reads it and passes data to the controller. It decides nothing.
- Controller. The device that holds the access rules, makes the grant or deny decision, and logs it. This is the actual system.
- Door hardware. The electric strike, electrified lockset, or magnetic lock that physically releases, plus a position switch and a request to exit device.
- Power. A supervised supply, usually with battery backup, and increasingly a fire alarm interface.
Failures in small systems cluster in the last two. The credential and reader are the visible part; the door hardware and power supply are where the money and the reliability live.
Cloud Managed or On Premise
Cloud managed controllers put the management interface on a vendor’s servers and the decision logic in a panel on your wall. You gain remote administration, automatic updates, and no server to maintain; you accept a subscription, a dependency on the vendor’s continued existence, and questions about who holds your door and person data. On premise systems reverse every one of those. The most important question for either is what happens at a door when the connection to management is lost, and the answer should be that the local controller keeps enforcing the last known rules and buffers events. If it does not, that is a design flaw rather than a preference.
Logical Access Concepts That Map Onto Doors
The vocabulary of information security transfers directly. NIST’s guide to attribute based access control defines a logical access control methodology in which authorization to perform a set of operations is determined by evaluating attributes of the subject, the object, the requested operation, and in some cases environment conditions against policy rules. Replace object with door and operation with entry and you have described a modern access control policy: this role, at this door, during these hours, under these conditions.
The practical discipline that follows is least privilege. Grant the smallest set of doors and times that lets someone do their job, use groups rather than per person exceptions, and review the list on a schedule. A system nobody prunes drifts toward everyone having access to everything, which returns you to the key problem you were escaping.
Credentials Are the Weakest Link Worth Fixing
Legacy 125 kHz proximity cards, still extremely common, present a static identifier to the reader with no cryptographic authentication of the credential. The reader confirms that a number was presented, not that the card is genuine. That design predates the threat model most buildings now face.
The contrast is visible in federal practice. FIPS 201-3, the Personal Identity Verification standard, is built on identity proofing, interoperable credentials, cryptographic protections, and public key infrastructure, and it exists specifically to authenticate people seeking access to federally controlled facilities and information systems. The companion guidance in NIST SP 800-116 Revision 1 on using PIV credentials in facility access adds the idea a small business can borrow directly: select the authentication mechanism by risk rather than applying one level everywhere.
You are not going to deploy PIV. You can insist on credentials that authenticate cryptographically rather than announcing a number, and you can reserve the strongest mechanisms for the few doors that justify them.
Where the Budget Actually Goes
First time buyers price readers and credentials and then meet the rest of the invoice. Cable pulls through finished walls and ceilings, door preparation and frame work, power supplies and battery backup, fire alarm interface where required, and commissioning and testing routinely exceed the hardware. Doors that need new frames or new leaves to accept electrified hardware are the classic budget event.
Phase by Risk, Not by Floor Plan
Start with the doors where a failure hurts most: the main entry, the server or comms room, cash handling, controlled inventory, and any door with high turnover behind it. Get one door fully right, including the release path, the power supply, and the record of who was admitted, before scaling. A system installed everywhere and commissioned nowhere is worse than the keys it replaced, because it produces the appearance of control without the substance.
