Access Control System: Components, Types & How to Choose

Most access control systems are specified with markings on a floor plan. Someone marks the doors that need control, a supplier turns the marks into a parts list, and the parts lists are compared side by side. That is usually where the confusion starts: one list has eight readers for four doors, another has four, and a third puts a different lock on almost every door.

All three can be correct. The difference sits in decisions nobody wrote down: which doors are read in both directions, which doors are escape routes, which rooms need more than a card, and how many people the system will hold in three years. This guide sets out what an access control system is made of, the types you will be offered, and a method for choosing one you can defend when someone asks why.

One point is worth settling early, because it is the most common worry. A new access control system can work alongside the turnstiles, CCTV and attendance terminals you already have. Integration is a routine requirement, not a special project, and it is covered in step 7 below.

What is an access control system?

An access control system decides who can pass through a door, gate or barrier, and at what times. A person presents a credential at a reader, a controller checks it against stored permissions, and if access is allowed the controller releases the lock or opens the barrier and records the event.

That last part matters as much as the first. A lock and key also decide who gets in. What an access control system adds is control you can change centrally, permissions that expire on their own, and a record of every door opened, refused or left open.

A single access event runs in this order:

1. The person presents a credential: a card, a PIN, a fingerprint, a face or a QR code.
2. The reader captures it and sends the data to the controller, usually over a Wiegand or RS485 connection.
3. The controller checks the credential against that person's permissions for that door, at that time, on that day.
4. If access is granted, the controller switches its lock output and the door releases.
5. A door sensor confirms that the door opened and then closed again.
6. The controller logs the event and passes it to the management software.

When access is refused, step 4 does not happen and the refusal is logged in the same way. A system that cannot tell you about refused attempts and doors left open is only doing half its job.

What are the components of an access control system?

An access control system has eight parts: the credential, the reader, the controller, the lock, the exit device, the door status sensor, the power supply and the management software. Each part makes a different decision, and most problems on site trace back to a part that was chosen without that decision in mind.

Component	What it does	What it decides	On the Vantage range
Credential	Identifies the person: card, tag, PIN, fingerprint, face or QR code	How easily access can be shared or copied	Access cards and tags, such as the 125 kHz ISO thin proximity card
Reader	Captures the credential and sends it to the controller	Which credentials a door accepts, and whether it survives outdoors	RFID readers and fingerprint and face readers
Controller	Stores permissions, makes the decision and drives the lock	How many doors, users and events the system can hold	Network door controllers
Lock	Holds the door until it is released	What happens to the door in a power cut or fire alarm	EM locks, bolt locks and strike locks
Exit device	Lets people leave from the inside	Whether people can always get out, including in an emergency	Push button, touchless and break glass exit switches
Door status sensor	Reports whether the door is actually shut	Whether a propped door raises an alarm	EM lock with door status feedback
Power supply	Feeds the controllers, readers and locks	Which doors stay controlled during a power failure	Specified per project
Management software	Adds people, sets permissions, shows events and runs reports	Who can run the system day to day	Access control software

The three parts most often under-specified are the controller, the lock and the power supply.

The controller is sized by doors, readers, users and stored events. The two door controller VV-CD2DP-2WA1 has 4 Wiegand reader inputs, 2 exit button inputs, 2 door sensor inputs and 2 lock outputs, and holds 30,000 users and 60,000 transaction logs. Those inputs are the real specification. A door read in both directions needs two reader inputs, and a door without a sensor input cannot report that it was left open.

The lock is a life safety decision before it is a security decision, because it determines what happens when the power is cut or the fire alarm sounds. Step 4 below covers how to choose it.

The power supply decides what still works in an outage. The VV-CD2DP-2WA1 keeps its stored data for up to 10 years without power, but a controller that remembers its users is not the same as a door that stays controlled. Specify battery backup for every door that must stay locked during an outage, and agree in writing which doors are allowed to release.

What are the types of access control systems?

Access control systems are grouped in four different ways: by control model, by architecture, by credential and by the opening being controlled. Buyers and suppliers often mean different ones when they say "type", so it helps to be clear which question is being answered.

By control model: who sets the permissions

• Discretionary access control (DAC): The owner of each door or area decides who gets in. Common in small offices where one manager runs everything, and hard to audit once a site grows.
• Mandatory access control (MAC): A central authority assigns clearance levels, and people can only enter areas at or below their level. Used in defence, intelligence and some government buildings.
• Role based access control (RBAC): Permissions attach to roles or groups such as finance, IT or cleaning contractor, and people inherit them when they join the group. This is the default in commercial buildings, because one change to a group updates everyone in it.
• Rule based access control: Rules sit on top of the roles, such as time zones, holidays and anti-pass back. The four door controller VV-CD4DP-2WA1, for example, supports up to 8 time zones with flexible verification modes.

In practice, most commercial sites run role based groups with time rules on top. When you compare software, ask to see how groups and time zones are set up, because that screen is where the control model actually lives.

By architecture: where the decision is made

• Standalone: The reader and controller are one unit on one door, and users are enrolled at that door. The standalone access controller VV-RF107S-CAS13 holds 1,000 card and PIN users in an IP67 metal alloy housing, and can also run as a Wiegand reader for a networked controller. It suits a single store room, plant room or gate.
• Networked: Door controllers connect over TCP/IP or RS485 to central software, so one database covers every door. The VV-CD2DP-2WA1 and VV-CD4DP-2WA1 controllers each hold 30,000 users and include an SDK for third party integration. This is the standard building block for offices, campuses and multi-building sites.
• Web or cloud managed: The controller carries its own web server and can report to a server address you define, so the system is run from a browser rather than a dedicated PC. The two door cloud controller VV-CD2DP-2WGA1 also accepts card, password, QR code, barcode, fingerprint, finger vein and face verification. It suits estates managed remotely or spread across several sites.
• Integrated terminal: A biometric terminal with access control built in reads the credential and drives the lock itself. The face, fingerprint and card terminal VV-BS550FR-CABT5 is one example. It suits a single high value door, or a site that wants attendance and door control on one device.

Controller sizing and the choice between on premise and cloud management are covered in more depth in the RFID access control guide.

By credential: what the person presents

• Card or tag: Proves the person holds the card, not who they are. Quick to issue and easy to cancel, but it can be lent.
• PIN: Proves the person knows a code. Rarely used alone, because codes get shared, but useful as a second factor.
• Biometric: Fingerprint, face or palm vein proves identity, because it cannot be handed to someone else. The fingerprint vs face recognition guide explains which suits which workforce.
• QR code or mobile: Issued and withdrawn remotely, which suits visitors and contractors. The QR code reader VV-RF120QR-KCAT5 reads codes from phone screens and printed passes, as well as cards and PINs.
• Two factor: Two credentials at the same door, such as card and PIN or card and fingerprint, kept for the doors that justify it.

Card frequencies, from 125 kHz proximity to 13.56 MHz MIFARE DESFire and long range UHF, are covered in the RFID access control guide.

By opening: what is being controlled

• Doors: Controlled by locks, readers and exit devices, as described above.
• Pedestrian entrances: Turnstiles, flap barriers, swing gates and speed gates take the place of the lock, and the controller releases the gate drive instead. They add something a door cannot: one person per credential, at a known throughput. The turnstile gate buyer's guide covers how to choose between them.
• Vehicle entrances: Boom barriers, bollards and gates, released by a long range UHF tag, a card at the driver's window or an ANPR camera reading the number plate. The long range UHF reader VV-RF900U-LRG2 reads tags at 0 to 20 m.
• Lifts: Floor level control, where a credential only enables the floors that person is allowed to reach. Common in residential towers, hotels and mixed use buildings. Vantage also offers Elevator Controllers for such applications.

How do you choose an access control system?

Choose an access control system door by door, not product by product. Write a door schedule, zone the site by risk, and then let each door's risk, traffic and fire role decide its credential, its lock and its controller.

The eight steps below follow the order in which those decisions depend on each other.

1. Write a door schedule before you speak to suppliers

A door schedule is a list of every controlled opening with the facts a designer needs. For each door, record:

• Opening: name and location, such as "Level 3 server room".
• Door type: single, double leaf, glass, sliding, gate or turnstile lane.
• Direction: entry only, or entry and exit.
• Risk level: general, restricted or critical.
• Fire role: on an escape route or not.
• Traffic: people per hour at the busiest time.
• Exposure: indoor, covered outdoor or full sun.

Give the same schedule to every supplier. Quotations built from one schedule can be compared line by line. Quotations built from a walk round cannot.

2. Zone the site by risk and match the credential to each zone

Most sites fall into four layers: the perimeter, the building entrance, floors or departments, and a short list of critical rooms such as server rooms, cash offices and records stores. Cards or tags cover the first three layers well. Critical rooms justify a second factor: card and PIN on a MIFARE DESFire reader such as the VV-RF501M-EMA1, or card and fingerprint on a biometric access control reader. A second factor does not always need a special reader either: the VV-CD2DP-2WA1 and VV-CD4DP-2WA1 controllers support card, PIN, card plus PIN and dual card access modes.

Christian Dior in the UAE uses a centralised Vantage access control system for its offices alongside swing gates. Financial sites tend to add tighter inner layers, and Vantage delivered access control with temperature detection for Julius Baer in the UAE. The banking and finance security page covers that sector in more detail.

3. Decide which doors are read in both directions

A door read on the way in only needs one reader and an exit button. A door read in both directions needs a reader on each side, and that is what makes anti-passback, live occupancy counts and fire roll call possible.

It doubles the reader count for every such door, which is why it explains most of the difference between two quotations for the same building. Controllers are labelled for it: a two door, two way controller such as the VV-CD2DP-2WA1 has four reader inputs, one for each side of each door. Mark the two way doors on the schedule first, because anti-passback cannot be switched on later if the second reader was never installed.

4. Let the fire strategy choose the lock

Every door on an escape route needs a lock that releases when the power is cut or the fire alarm sounds. Electromagnetic locks do this by design, because the magnet only holds while it is powered, so they are the standard choice on escape doors provided they are wired to release from the fire alarm. The VV-CD2DP-2WA1 and VV-CD4DP-2WA1 controllers have a fire alarm input that releases every door they control in an emergency.

Doors that must stay locked in a power cut, such as stores and plant rooms off the escape route, need a fail secure lock instead. The electronic door lock VV-AX100EL-H2 is power to unlock and fail secure, with mechanical keys for manual override.

The door itself then narrows the choice:

• Standard single door: 600 lbs EM lock, VV-AX600EM-SDH2, surface mounted.
• Single door that must report its own status: 600 lbs EM lock with door status feedback, VV-AX601EM-SDH2.
• Double leaf door: 1200 lbs double door EM lock, VV-AX1200EM-DDH2.
• Frameless glass or narrow frame: EM bolt lock, VV-AX602EM-DBH2, flush mounted with a 15.5 mm stainless steel bolt.
• Inside of every controlled door: an exit device, either a push button exit switch, a touchless infrared exit switch with a 20 cm detection range and IP55 rating, or an emergency break glass release that overrides the electric lock in an emergency.

The RFID access control guide has a fuller lock by door type table, including why holding force and shear strength should not be compared directly.

5. Size the system for the site you will have in three years

Count users, doors and events, then add the growth you expect. A standalone unit such as the VV-RF107S-CAS13 holds 1,000 users on one door, while networked controllers such as the VV-CD4DP-2WA1 hold 30,000 users and 60,000 transaction logs and can be added to the same software as the site grows.

Standalone doors do not share a database. A site that starts with five standalone units and grows to twenty ends up enrolling people door by door, and removing a leaver means visiting every door they could open.

Multi-site work shows where this leads. Vantage delivered access control and CCTV across five pavilions at Expo 2020 Dubai, and a centralised access and time management system for Zara in the UAE. Splash 'n' Party runs entrance gates and access control across multiple locations.

6. Decide where the system is managed, and who runs it

An access control system is run by whoever adds starters, removes leavers and answers the question "who opened that door?". Decide who that is before choosing the software.

Desktop software such as Access Pro covers device and door management, personnel, real time event monitoring, map based monitoring and reporting, with a choice of databases. Controllers with a built in web server can also be managed from a browser, which suits sites without a dedicated security PC.

Ask each supplier to demonstrate three tasks live: adding a new starter to a role, removing a leaver from every door at once, and producing a report of every door one person used last week. Those three tasks take up most of the time an access control system needs once it is running.

7. List every system it must work with

Write down every system that should share information with access control: the fire alarm, CCTV, time attendance, turnstiles or gates, lifts and visitor management. Integration with equipment already installed is a normal requirement, and readers with standard Wiegand 26 or 34 outputs, such as the RFID entry and exit reader VV-RF105-26BE2, work with third party controllers.

The common pairings:

• Fire alarm: releases escape doors and gates automatically, as in step 4.
• CCTV: links each door event to recorded video. The integrated card reader with keypad VV-RF401S-CAA14 can trigger video recording or a snapshot through NVMS software. BAPCO in Bahrain and Riyadh Gallery in Saudi Arabia both run CCTV and access control from Vantage.
• Time attendance: one credential for doors and attendance. The time attendance software guide covers the software side, and Marsa Properties in the UAE runs access control and time attendance together.
• Turnstiles and gates: the same credential opens the door and the gate line. Denholm Yam in Abu Dhabi uses full height dual lane turnstiles with integrated access control, Petroleum Development Oman uses full height turnstiles with access control, and the Council of Ministers Secretariat General in Qatar runs entrance automation with access control. 25hours Hotel Dubai One Central uses flap barrier gates with access control, and Dubai Mall Ice Rink combines flap barriers, swing gates and access control.
• Vehicles: Sharjah Cement Factory pairs ANPR cameras and parking barriers with access control.

8. Check the environment, not only the IP rating

An IP rating covers dust and water. It says nothing about heat, and a sun facing gate post in a Gulf summer is often the harder test, so read the operating temperature on the datasheet alongside the IP rating.

The VV-RF105-26BE2 reader is IP65 and rated from -20°C to +70°C, which suits an exposed position. The waterproof fingerprint access control reader VP-BS2030FP-CABWT5 is IP66 and rated from 0°C to 40°C, so it belongs under a canopy or on a shaded wall rather than on an exposed gate post in summer. On perimeter gates and vehicle lanes, the VV-RF107S-CAS13 is a better fit than an indoor plastic reader: its metal alloy housing is IP67, and the EM and HID card version is rated from -40°C to 60°C.

What should you check before signing off the specification?

Before you approve an access control specification, confirm that every item below is written into it rather than assumed. Most disputes after handover trace back to one of them.

• Every door on the schedule has a lock type, a fire role and a release method.
• Two way doors are identified, with a reader on both sides.
• Critical rooms have a second factor, and the doors that have one are listed.
• Each controller has spare reader, sensor and lock capacity for growth.
• User and event capacity covers three years of expected growth.
• Battery backup is specified for doors that must stay locked in an outage.
• Outdoor readers are rated for the site's heat as well as its dust and water.
• Integration with the fire alarm, CCTV, attendance and gates is listed system by system, with who is responsible for each link.
• Someone on site is named to run the software, and the starter and leaver process is agreed.

Model specifications in this guide are taken from the Vantage datasheets and product pages as of October 2026.

Frequently asked questions

What are the main components of an access control system?

An access control system is made of eight parts: the credential, the reader, the controller, the lock, the exit device, the door status sensor, the power supply and the management software. The controller makes the access decision, and every other part either feeds it information or carries out its decision.

What are the different types of access control systems?

Access control systems are grouped by control model (discretionary, mandatory, role based and rule based), by architecture (standalone, networked, cloud managed and integrated terminals), by credential (card, PIN, biometric and QR code) and by the opening controlled (doors, pedestrian gates, vehicle barriers and lifts). Most commercial buildings use a networked, role based system with cards, plus a biometric reader or a second factor on critical doors.

What is the difference between standalone and networked access control?

A standalone system controls one door from a single unit, with users enrolled at that door. A networked system connects door controllers over TCP/IP or RS485 to central software, so one database covers every door and permissions can be changed for everyone at once. It is a different thing from network access control (NAC) in IT security, which decides which devices can join a computer network.

Which lock is best for an access control system?

For doors on an escape route, an electromagnetic lock is the standard choice because it releases when power is removed, provided it is wired to the fire alarm. Double leaf doors use a 1200 lbs double door EM lock, frameless glass doors use an EM bolt lock, and doors that must stay locked in a power cut use a fail secure electronic lock with a key override.

What access cards work with an access control system?

The card must match the frequency of the readers: 125 kHz proximity cards for standard EM readers, 13.56 MHz MIFARE or DESFire cards for higher security readers, and UHF tags for long range vehicle readers. Vantage supplies access cards and tags including ISO thin proximity cards, clamshell cards, UHF cards, UHF stickers and vehicle tags.

Can a new access control system work with existing turnstiles, CCTV or attendance machines?

Yes. Integration with existing equipment is a routine requirement: readers with standard Wiegand outputs work with third party controllers, and Vantage network controllers include an SDK for third party systems. List each system you need connected in the specification, so that responsibility for every link is clear.

Is biometric access control more secure than card access control?

Biometric access control proves who the person is, while a card only proves who is holding it, so biometrics are stronger wherever identity matters. Most sites use cards for general doors and add fingerprint or face readers, or card and PIN, on the short list of doors where a shared card would be a real risk.

Choosing an access control system

An access control system is judged by its worst door, not its best one. Start from the door schedule, let the fire strategy choose the locks, let the risk of each zone choose the credential, and size the controllers for the site you expect in three years rather than the one you have today. If two quotations still look different after that, ask each supplier to mark up your door schedule and explain every change. The one that changes nothing has probably not read it.