Buying Guide · Commercial Access Control
Access Control System Buying Guide.
For business owners, facility managers, property managers, and procurement teams evaluating a commercial access control system — what it is, what it does for the business, how to plan one, and what to buy. Written from the supplier side of hundreds of commercial deployments.
01 / What Is an Access Control System
A managed entry system that replaces keys with credentials.
A commercial access control system is the set of hardware and software that controls who can enter which doors, when, and under what conditions — replacing physical keys with electronic credentials (cards, fobs, phones, biometrics) that can be issued, revoked, and audited centrally. A door access control system specifically refers to the per-door hardware portion: the reader at the door, the electric lock, the request-to-exit device, and the controller that ties them together.
At minimum, every business access control system includes five layers:
- Credentials — what the user presents (key card, key fob, mobile credential, PIN, fingerprint).
- Readers — the device that reads the credential at the door.
- Controllers — the decision-maker that compares the credential against permissions and energises the lock.
- Electric locking hardware — maglocks, electric strikes, or electrified mortise locks.
- Management software / platform — where credentials, schedules, alarms, and reports live (on-premise server or cloud).
For the deep technical walkthrough on each layer, see the installer-spec access control hardware spec guide. This guide covers the layer above that — the buying decision itself.
Most commercial buyers reach this guide because the existing key system has stopped working at scale — keys get copied, terminated employees keep access, the audit trail is “ask the office manager who saw what,” and adding or removing access means a locksmith visit. A modern key card entry system or key fob system for business solves all of that in software.
02 / Business Outcomes
What an access control system actually delivers.
A commercial access control system is sold on technical features but bought for operational outcomes. The ones that consistently move the procurement decision:
Eliminated lost-key risk
Lost or duplicated keys cost commercial buildings tens of thousands of dollars in re-keying every year. A credential can be revoked from a dashboard in seconds — the cost of a lost key card is a replacement card, not a locksmith mobilisation.
Full audit trail per door, per user
Every entry, every denied access, every door-held-open event is logged with user, door, and timestamp. Critical for incident investigations, HR disputes, regulatory audits, and insurance claims.
Time-of-day and role-based access
Cleaners get the back door 6–10 pm only. Contractors get the loading bay only during their project window. Office staff get the main entrance 7 am–7 pm with overrides for senior roles. None of that is possible with physical keys.
Centralised multi-site management
For multi-location businesses — retail chains, property portfolios, professional services with satellite offices — a single platform manages credentials across every site. Onboard once, access everywhere; offboard once, access revoked everywhere.
Insurance & regulatory posture
Increasingly, commercial property insurers, cyber-insurance carriers, and sector regulators (healthcare, finance, cannabis production, federal contractors) require electronic access control as a baseline condition. Hardened access control reduces premiums and clears compliance checklists.
Integration with surveillance & alarm
A credentialed entry can be cross-referenced against the camera at that door, and an after-hours entry can arm or disarm the intrusion panel automatically. Access control becomes the operational hub for the broader security stack.
03 / Commercial Use Cases
Who actually buys these systems.
Different businesses approach access control with different operational pressures. The use cases that drive most procurement decisions in the Ottawa and Eastern Ontario commercial market:
- Office buildings & professional services — front entrance, server room, executive suite, file storage. Time-of-day rules, role-based zones, after-hours audit. The default office access control system.
- Warehouses & logistics — main personnel entrance, dispatch office, secure stock cage, loading bay overhead doors. Driver and contractor credentials with strict expiry. Often paired with PTZ surveillance.
- Multi-tenant commercial property — building entrance plus per-tenant suite doors, managed from a single platform with per-tenant credential pools. Tenant onboarding/offboarding through a property-management workflow.
- Healthcare clinics & medical offices — controlled access to medication storage, records, after-hours clinical areas. Audit trail aligned with provincial health-records compliance.
- Schools, colleges, faith-based facilities — controlled lockdown capability, weekend and event scheduling, visitor processing. Lockdown-on-event is a defining feature for K-12 and post-secondary.
- Multi-site retail & franchise operations — same credential set across multiple locations, store-manager-only after-hours access, integration with alarm arm/disarm to reduce false-alarm fees.
- Manufacturing & industrial — production-floor access by role and certification, mechanical-room and chemical-storage segregation, contractor and inspector credentials with hard expiry.
- Government, municipal, defence contractors — NDAA-compliant hardware, federal procurement requirements, full audit retention and credential lifecycle controls. See the NDAA Section 889 checklist.
If you don’t see your use case here, it almost certainly maps to one of the above with a small variation. The architecture decisions in section 04 cover what changes.
04 / System Architectures
On-premise, cloud-hosted, or hybrid.
Three architectures cover virtually every commercial deployment. The architecture decision is the largest single driver of long-term cost, vendor lock-in, and operational fit.
- On-premise networked — controllers report to a server running on your network (Kantech EntraPass, Lenel OnGuard, Mercury-based platforms). Highest upfront cost, no recurring subscription, integrates deeply with on-prem video and intrusion. Default for government, defence, healthcare, and operations that require data sovereignty.
- Cloud-hosted — controllers report to a SaaS platform (Brivo, Openpath, ProDataKey, Kantech Connect). Lower upfront cost, predictable subscription, no server to maintain, multi-site is native. Default for SMB, multi-site retail, multi-tenant property management, and operations that want IT-light deployment.
- Hybrid — local controller decisions with cloud-hosted management. Decisions continue when the internet drops, but credential changes, reports, and multi-site management happen in the cloud. Increasingly the default for new commercial installs.
For the side-by-side architecture decision framework — when to pick which, by business pattern — see the controller architecture guide. For a reference design tying access control into a complete 8-door + 16-camera commercial system, see the small commercial reference architecture.
05 / Components & Sub-Systems
What goes into the order.
A complete commercial access control bill of materials usually spans six categories. The right answer in each is driven by the use case and the architecture from sections 03–04.
─────────────── ────────────────────────── ─────────────────────────────
Credentials DESFire EV2 / EV3 / Mobile Security tier, user count
Readers OSDP multi-tech mullion Door type, protocol, future-proof
Controllers 1 / 2 / 4 / 8 / 16-door Door count, platform, scaling
Electric locks Maglock or strike Door type, code, fail-safe vs secure
Power supply UL-listed AC w/ battery Door count, total current, runtime
Platform On-prem or cloud Architecture decision (sec. 04)
Component-level deep dives, sized to the buying decision:
- Credential selection — prox vs DESFire vs iCLASS vs mobile, clone resistance, platform compatibility, and migration patterns. See the credential selection guide.
- Reader and door hardware — Wiegand vs OSDP, mullion vs wall vs keypad, fail-safe vs fail-secure, compatibility traps. See the access control hardware spec guide.
- Controller architecture — standalone vs networked vs cloud-hosted, by business pattern. See the controller architecture guide.
- Power and battery backup — per-device current draw, sizing math, distribution, runtime requirements. See the power supply sizing guide.
- NDAA & federal compliance posture — Section 889 covered entities, brand reference, per-SKU screening. See the NDAA compliance checklist.
For the full procurement catalog by category, see the access control catalog.
06 / Procurement & Planning Process
From scope to install — the six-step path.
Most commercial access control buys go off the rails at one of two points: under-scoped door count, or under-specified head-end platform. A repeatable six-step process avoids both.
- 1. Scope inventory — door-by-door list (interior / exterior / vestibule / mechanical / loading), user count (now + 3-year projection), use-case categories (employees / contractors / visitors / cleaners), and environmental conditions per door (indoor / outdoor / cold / wet / hazardous).
- 2. Security tier & compliance — choose the credential tier (DESFire EV2 baseline, EV3 or mobile for higher tier). Confirm whether NDAA Section 889, sector-specific compliance, or insurance terms apply. Lock the tier before vendor evaluation.
- 3. Architecture selection — on-premise networked, cloud-hosted, or hybrid (section 04). Decision drives platform shortlist and recurring-cost profile.
- 4. Site walk & spec verification — physical site walk by the integrator with the buyer or facility lead. Verifies door types, existing power, network availability, conduit routes, and anything missed in scope. Generates the verified bill of materials and the labour estimate.
- 5. RFQ and vendor evaluation — request firm pricing on the verified BoM, lead time, warranty, service-level terms, and lifecycle support. Compare on TCO (hardware + license + service + migration), not headline hardware cost.
- 6. Phased rollout planning — for any deployment over 8 doors, plan a phased install (typically by floor, by building, or by zone). Run the new system in parallel with existing keys for the first 2 weeks before decommissioning. Document the migration plan for audit.
Steps 4 and 5 are where most procurement teams ask for outside help. We work through both as part of a procurement review — see the CTAs at the bottom of this guide. For budgeting in step 5, the access control system cost guide breaks down per-door pricing, upfront versus recurring spend, and sample budgets; if a fob-based system is your direction, the key fob system for business guide covers that model end to end, and the key card entry system guide covers the card form factor.
07 / Buying Considerations
What to evaluate before you sign.
Beyond price, the criteria that consistently separate a good commercial access control buy from a regrettable one:
- Total cost of ownership over 5 years — hardware + per-user license + cloud subscription + service contract + credential replacement. Cloud platforms with low upfront cost can exceed on-premise TCO at 24–36 months for large user counts.
- Scalability path — can the controller and platform add 50% more doors and 100% more users without a forklift upgrade? Is there a documented migration path to higher security tiers (DESFire EV3, mobile credentials, biometrics)?
- Vendor lifecycle & stability — Kantech, Lenel, Brivo, Openpath, ProDataKey, HID-based Mercury platforms all have stable parent companies, multi-year roadmaps, and broad installer ecosystems. Avoid orphan platforms with single-distributor support.
- NDAA / federal procurement posture — if your business sells to government, defence, or any federally-funded entity, NDAA Section 889 compliance must be locked at the credential, reader, and controller level. Not optional, not retrofittable cheaply.
- Integration with surveillance and intrusion — if you already run a VMS (Milestone, Genetec, Hanwha Wave, DW Spectrum) or an intrusion panel (DSC, Bosch, Honeywell), confirm bidirectional integration with the access platform shortlist. Cross-system event correlation is what makes the security stack useful, not just installed.
- Local field support availability — for Ottawa and Eastern Ontario buyers, response time on a failed controller or stuck door is the difference between an inconvenience and a Monday-morning shutdown. Confirm local certified support, not 1-800 phone-only.
- Warranty, service-level terms, and parts availability — hardware warranty (3–5 years typical), platform uptime SLA for cloud, advance replacement terms, and the realistic lead time on the most common failed components (power supplies, readers, controllers).
A buyer who can articulate answers to all seven of these before signing typically gets a system that’s still serving them five years later — and that’s the only outcome that matters.
Procurement Review
Sourcing an access control system for your business?
Send the door count, the architecture preference (on-prem / cloud / hybrid), the compliance posture, and any existing head-end you need to integrate with. We come back with a verified bill of materials, project pricing, and a phased rollout plan before you commit.