Nearly every business or organization needs an access control solution. Facilities need ways to manage and monitor access, whether the best choice is an advanced, automated solution or a basic system that requires credentials to enter secure areas. Moreover, as crime rates increase and operations become more distributed, access control can be more complicated and the stakes higher, with the security of facilities and assets at risk and the safety of employees, patients, or students.
These factors are driving growth around the world. MarketsandMarkets predicts the access control market will grow from $2.5 billion in 2018 to $12.1 billion by 2024, a CAGR of 8.24 percent – and Access Control as a Service is considered one of the biggest growth opportunities.
Start with an Access Control Policy
To capitalize on this opportunity by providing optimal solutions, you need a thorough understanding of each client’s operation and their needs, challenges, and goals. Before you suggest hardware, devices or applications, focus on developing or refining your client’s access control policy. Start with the basics:
- Who: People should only be able to access what they need to do their jobs. Assign access based on roles – an engineer doesn’t need HR records, and an HR manager doesn’t need to use a computer where the engineer designs new products. Likewise, IT support doesn’t need access to everything, so limit your team’s access.
- Where: Designate areas of basic, enhanced and high security and protect them accordingly. Some sites may only have a camera and card readers/door locks limiting access to other facility areas. Other areas may require biometric identification to enter. Also, address whether the client will need remote access to receive alerts from the system.
- When: Employees’ needs for access can change at different times and on different days. Do daytime hourly employees ever need access at night? On weekends? On holidays? Grant access only at the times when it’s needed. Another consideration is how long a person should be in an area – if they appear to be somewhere for too long, does the system need to alert a manager or ask the user to check back in?
When you first ask your client questions about exactly who needs access, where and when, they may not be able to give you all the answers. If you’ve provided the client with other services, you may be able to use records from IT solution logins to help determine the different access employees need to do their jobs. This data may also reveal where access can be tightened up, ending access to areas or tools the employee doesn’t need.
It’s essential to communicate the reason for changes to employees, who may feel untrusted if they suddenly have less access. Explain that limiting access can minimize damages if their credentials are lost or stolen. It may also benefit some employees who have trouble accessing areas or tools they need because access is currently not limited.
Compliance on Every Level
Your client’s access control policy needs to reflect the specific regulations they must comply with, such as HIPAA Technical Safeguards, PCI DSS Data Control and Access Control Policies, or NIST Security Controls. Your client may also be subject to local building codes, for example, a requirement to integrate fire alarms with door lock controls.
Although it’s essential to comply with these regulations, you shouldn’t stop there. Also, make sure you address the business’ unique needs. For example, consider the facility’s location, workforce, and other factors that will help you build the best solution and help develop the most effective access control policy. Finally, do everything you can to ensure your client gets the most return for their investment.
Choosing the Right Solution for Today and Tomorrow
With a thorough understanding of your client’s facility, operation, and access control needs, you can select the best solution – whether it’s allowing employees to use ID cards, RFID or NFC fobs, or biometric identification. You also need to choose the best software to manage the system, monitor users, respond to alerts and perform reporting and audits.
As you build the solution, it’s wise to look for ways to make it scalable, so your client can continue to benefit from the investment as their operation grows and technology changes. However, don’t put your client in a position where the only option in the future will be to rip and replace. Instead, encourage your client to take a forward-looking perspective, sharing their plans for future expansion and innovation – and how they’ll need to control access to them. 
