Access control for a small business: what to fit and what to skip

Access control for a small business gets sold on the wrong benefit. The pitch is usually security; the real return is administration — knowing who has access, changing it in seconds, and never again wondering whether the person who left last month still has a key.

Where access control for a small business beats keys

• Staff turnover. Revoking a credential takes seconds and costs nothing. Recovering a key you cannot prove was not copied costs a rekey.
• Time-limited access. Cleaners at night, a contractor for a fortnight, a delivery window on Tuesdays.
• Knowing what happened. A log that says which credential opened the back door at 03:40 is worth more than any lock.
• Zones. Everyone through the front, only two people into the stockroom or the server cupboard.

Where it is not worth it

A single-door shop with three staff and no turnover is usually better served by good mechanical hardware and a restricted keyway. The administration benefit is the whole benefit, and with three people there is no administration to speak of.

The two words that decide the specification

Fail-safe hardware unlocks when power is lost. Fail-secure stays locked. Which one a given door needs is determined by egress and by fire strategy, not by preference, and getting it backwards on the wrong door is the mistake that matters most in this whole area.

Whatever is fitted, the inside of an occupied building must still allow exit in a single motion with no key, code or special knowledge — the same rule that governs panic bars and exit devices. Electric hardware does not create an exception to it; it just adds a way to get it wrong.

A sane starting specification

1. Electronic entry on the main door and any zone door that genuinely needs restricting. Not every door.
2. A mechanical override on at least one opening, with the key held accountably.
3. Individual credentials, never shared ones — a shared fob makes the log worthless.
4. A written record of who holds what, reviewed whenever somebody leaves.
5. A power-failure plan you have actually tested, rather than assumed.

Credentials, ranked by how they actually fail

Whatever the marketing says, the credential is a trade-off between convenience and control, and each type fails in its own way.

• Fobs and cards — simple, cheap, and universally understood. They get lent. Older low-frequency types can also be cloned with equipment that costs very little, so ask what technology is being quoted rather than accepting "fob access" as a specification.
• Keypad codes — nothing to carry and nothing to lose, which is also the problem: a code shared once is shared permanently, and the worn keys on an old keypad narrow it down for anybody paying attention. Individual codes and periodic rotation are what make them workable.
• Phone-based credentials — the strongest link between a credential and a person, because the phone is already protected by something the holder guards. The dependency is the phone, and a flat battery on a night shift is a support call.

Whichever is chosen, issue one credential per person. The moment two people share a fob, the log becomes a record of a fob rather than a record of anybody, and the log was most of the reason for the system.

What it costs to run, not to buy

The quotation covers hardware and installation. The ongoing cost is administrative and it is the part that gets underestimated: somebody has to add starters, remove leavers, replace lost credentials, review the list, and keep the controller's firmware current. Where nobody owns that job, the system drifts within a year into a state where half the active credentials belong to people who no longer work there — which is precisely the condition it was bought to prevent.

Decide who owns it before it is installed, and put the review on the same schedule as something that already happens, such as payroll or the monthly exit-door walk.

Before any of it

Fix the doors. An electronic strike on a frame that splits under one shoulder is an expensive way to log a break-in. Alignment, closers, strikes and screws first — the same reasoning as deadbolt grades, where the hardware is rarely the part that gives — then the electronics.