Credentials and readers form the visible edge of an access control system, but their security depends on the complete chain behind them. This reference explains the main credential types, reader communications, enrollment and revocation, migration risks, and the questions an owner should resolve before selecting a technology.
Return to the complete system-parts reference.
Credential types
- Contactless smart cards and fobs: portable credentials that can use secure applications and diversified keys when the platform is configured correctly.
- Mobile credentials: credentials provisioned to supported phones or wallets, with workflows for device replacement, loss, and offboarding.
- PINs: knowledge factors that may be used alone for limited applications or with a card or mobile credential.
- Biometrics: identity factors that require privacy, consent, enrollment-quality, exception, retention, and environmental planning.
- Temporary credentials: time-limited access for visitors, contractors, vendors, or events.
Security is more than card frequency
Two credentials can operate at the same frequency while providing very different security. Evaluate encryption, mutual authentication, key management, cloning resistance, reader-to-controller communication, issuance controls, audit records, and revocation speed. Legacy proximity formats may remain functional but should not automatically be extended into new work.
Reader-to-controller communication
OSDP is a bidirectional reader protocol that can supervise devices and, when Secure Channel is enabled and keys are managed, protect communications. Wiegand is common in older systems but is typically one-way and lacks comparable supervision and channel protection. Confirm that the reader, controller, firmware, cabling topology, and commissioning process all support the intended secure mode.
Reader selection checklist
- Credential technologies required now and during migration
- Mullion, wall-box, keypad, desktop, long-range, or specialty form factor
- Indoor, outdoor, washdown, vandal-resistant, or hazardous-location conditions
- OSDP capability and secure-channel commissioning
- Accessibility, mounting height, approach path, feedback, and usability
- Mobile Bluetooth or NFC behavior and device compatibility
- Firmware update method, tamper reporting, and lifecycle support
- Color, architecture, signage, and historic-building constraints
Issuance and revocation
Define the credential lifecycle before deployment: proofing identity, approving access, issuing the credential, confirming receipt, modifying permissions, handling forgotten or lost credentials, suspending access, collecting physical cards, and preserving required audit records. Tie expiration dates to the actual role or engagement rather than relying on manual cleanup.
Migration planning
A controlled migration can use multi-technology readers while new credentials are issued in phases. Document which doors accept which formats, prevent accidental downgrade to an insecure legacy technology, protect enrollment keys, and set an end date for the old population. Test mobile and physical credentials at representative perimeter, interior, elevator, and gate readers.
Operational questions
- Who owns credential keys and administrator accounts?
- Can credentials be exported or migrated if the platform changes?
- What fees or subscriptions apply to mobile credentials?
- How are contractors and temporary users separated from employees?
- What happens when a phone is offline, replaced, or shared?
- How are privileged or high-risk areas assigned stronger authentication?
- Which events are retained, for how long, and who may review them?
Commissioning
Test valid, invalid, expired, disabled, duplicate, lost, and after-hours credentials. Confirm reader feedback, door timing, forced and held alarms, anti-passback where used, offline controller behavior, mobile provisioning, and revocation. Record reader model, firmware, protocol, address, secure-channel status, credential format, and test results for every opening.
Continue with door planning, controllers and I/O, and system architecture.
Information only. Credential privacy, cybersecurity, accessibility, and operational requirements must be confirmed for the organization and jurisdiction.
Publisher’s related applied reference: credential security and administration.