Access Control Systems

Access control covers the systems and hardware that authorise — or deny — physical entry to a building, zone or specific door. The simplest implementation is a standalone RFID reader at one door (a card or fob unlocks the strike, a controller logs the event). The most complex is a multi-site networked system spanning thousands of doors, with centralised credential management, role-based access by user/group/time, integration with HR systems for automatic onboarding and offboarding, biometric authentication at high-security zones, and full event audit logging. The right specification depends on door count, credential type, and how the system needs to integrate with broader CCTV, alarm, intercom and building management systems. Most commercial installs benefit from networked access control even at small scale — the credential management and audit trail justify the modest premium over standalone keypads.

Security Cameras Australia stocks access control hardware and supports integration with the major access platforms (Inner Range, Gallagher, ICT, S2, HID, Honeywell). We work with installers, IT, and security consultants on system specification.

For door-entry systems with audio/video answering see video intercoms. For broader business CCTV with access integration see security cameras for business.

How access control works

Four components in any access control system:

Credential — what the user presents at the door. Card, fob, PIN, mobile credential, biometric (face, fingerprint), or combination (PIN + card).
Reader — at the door, reads the credential and forwards it to the controller. Sub-types: RFID (proximity), keypad (PIN), Bluetooth/NFC (mobile credential), biometric reader.
Controller — the brains. Receives the credential from the reader, checks it against the permissions database, decides allow or deny, signals the door release.
Door hardware — maglock or electric strike, request-to-exit (REX) button or PIR, door position sensor.

In standalone systems, the controller is in the reader itself with the credentials stored locally. In networked systems, a central controller (on-premise or cloud) manages credentials and decisions, with edge controllers at each door.

Standalone vs networked — the architecture choice

Standalone access control

Single-door or small-site. Reader-controller combined, credentials stored locally, no network connection required. Adding/removing users is done at each reader. Simple, low cost, no IT integration. Suits: single-tenancy small commercial (sub-10 staff), home access control, gates and sheds, basic-tier residential strata.

Networked access control

Multi-door or multi-site. Central management of credentials, role-based access (engineering staff can access labs, marketing can't), time-based access (contractors active only during business hours), and full audit logging. Sub-tiers:

On-premise networked — central server in the building, no cloud dependency, full local control. Suits commercial sites with IT resources to run the server.
Cloud-managed — central server in the cloud (provider-hosted), accessed via web/mobile, no on-premise server required. Suits sites without local IT, multi-site organisations, and modern SaaS-pattern access control.

Credential types — what to specify

RFID card or fob

The traditional standard. Cheap per credential, simple issue and revoke, well-established. Lower security (cloneable cards exist) but adequate for most commercial use. Most cards now MIFARE DESFire or equivalent for cloning resistance.

PIN keypad

No physical credential. Lower hardware cost, simple to issue (just give the PIN), simple to revoke (change the PIN). Shared PINs are a security weakness (any user can give the PIN away); per-user PINs work for small sites.

Mobile credential (Bluetooth/NFC)

Phone-as-credential. Modern, no cards to lose or issue, supports remote provisioning and instant revocation. Higher security than RFID. Increasingly the commercial standard. Works on iOS and Android via the access platform's app.

Biometric (face, fingerprint)

Highest security at the door — credential is something the user is, can't be lost or shared. Significant privacy compliance load — biometric data storage, consent, retention all need governance under Australian Privacy Principles. Specify for high-security zones, not whole-site.

Multi-factor

Combination — PIN + card, or card + biometric. Used at high-security zones where single-factor isn't adequate.

Specifying access control for your site

Door count and zones

Single door: standalone or networked entry-tier. Multiple doors in one building: networked. Multi-building or multi-site: networked with cloud or central on-premise management. Define the zones (public, staff, controlled, secure) and the access groups (who can enter which zones at which times).

Existing infrastructure

New build: cleanest install with structured cabling to each door. Retrofit: confirm existing door hardware (maglock or strike already installed) and cable runs. Often retrofit needs new cable runs to readers and controllers; some legacy installs can repurpose existing.

Integration paths

CCTV — door events linked to camera footage. Standard with current commercial NVRs.
Intercom — door release via intercom call or access credential. See video intercoms.
Alarm — arm/disarm via access credential, after-hours intrusion detection at access doors.
HR system — automatic provisioning of credentials when staff onboard, automatic deactivation when offboarded. Avoids stale credentials.
Visitor management — temporary credentials for visitors with auto-expiry.
Building management — door events trigger HVAC, lighting, lift access.

Compliance and audit

Audit log of every access attempt (success and failure) is standard in networked access control. Retention period: typically 12 months for most commercial, longer for regulated industries. Role-based access to the audit log itself. For sites with regulatory access compliance (financial services, healthcare, government), specify against the framework requirements.

Privacy and compliance considerations

Workplace surveillance — access logs are workplace surveillance. Staff notification through workplace agreement.
Biometric data — significant Privacy Act compliance load. Consent capture, secure storage, retention, deletion process. Consult before deploying biometric.
Mobile credentials — typically rely on the provider's app and account. Confirm the provider's data handling and Australian hosting where required.
Visitor data — temporary credential issuance involves recording visitor information. Privacy notice at issue.
NDAA considerations apply to some access control hardware procurement (federal contracts, some state contracts). See NDAA-compliant range.

Why buy from Security Cameras Australia

Multi-brand authorised dealer — Hikvision, HID, ZKTeco, and integration with major access platforms (Inner Range, Gallagher, ICT, Honeywell).
Specification support · we work with you on system design including credential strategy, integration paths, and compliance considerations.
Installer and integrator referrals · access control installs almost always benefit from professional install and ongoing support relationship.
Tender support · documentation for procurement-restricted contexts.
Price-match · free shipping · 30-day returns.

Shop access control

Browse below, or see video intercoms for door-entry systems, business CCTV for integrated CCTV, or the NDAA-compliant range for procurement-restricted contexts.

Frequently Asked Questions about Access Control Systems

Standalone or networked access control — which do I need?

Single door, small site (sub-10 staff): standalone is often enough — cheaper, no IT integration, manageable per-reader credential maintenance. Multiple doors, multi-site, or where you need role-based access, time-based access, audit logging, and centralised credential management: networked. Most commercial sites with more than one access door benefit from networked even at small scale — the credential management and audit trail justify the modest premium.

RFID, PIN, mobile credential, or biometric — what should I use?

RFID is the traditional commercial standard — cheap per credential, simple, established. PIN works for small sites with per-user codes; weak when codes are shared. Mobile credential (phone-as-credential) is increasingly the commercial standard — modern, instant provisioning and revocation, higher security than RFID, no cards to lose. Biometric (face, fingerprint) for high-security zones only — significant Privacy Act compliance load. Multi-factor (card + PIN, or card + biometric) for high-security single doors.

Will access control integrate with our existing CCTV and alarm?

Usually yes — most commercial-tier access platforms (Inner Range Integriti, Gallagher, ICT Protege, Honeywell, S2 Netbox) integrate with major CCTV (Hikvision Pro/Ultra, Axis, Hanwha) and alarm systems (Bosch, Inception, Inner Range) via ONVIF, OPC, REST APIs, or proprietary integrations. Common integrations: door events linked to camera footage, after-hours alarm armed via access credential, verified-event alarm triggers. Specify the integration paths during access control specification.

Can we use mobile credentials on staff phones?

Yes — modern access platforms (HID Mobile Access, Salto KS, Kisi, ZKTeco BioAccess, others) deliver credentials to staff phones via the platform's app, working over Bluetooth or NFC at the reader. Provisioning and revocation are instant — no card issue/return on staff onboarding/offboarding. Higher security than RFID, modern user experience, increasingly the standard. Confirm the staff phone fleet supports the credential format (most current iOS and Android do).

Do we need access control if we have CCTV and alarm?

CCTV records who entered (after the fact). Alarm detects unauthorised entry (after entry). Access control prevents unauthorised entry in the first place by authenticating each entry attempt. The three serve different functions and work together — access control is the preventive layer; CCTV is the evidence layer; alarm is the breach-detection layer. For commercial sites where prevention matters (data security, valuable inventory, staff safety after hours), access control is the foundational layer.