Access control technologies have multiplied, but the underlying decision is still the same: how a person proves who they are at a door, and what the system records when they do it. Cards, mobile credentials and biometrics each behave differently at the door, in the office and during an audit. This article compares them.
Cards and fobs: still the baseline
A card system is a credential, a reader and a decision. It remains the default for most buildings because it is inexpensive, understood by everyone and easy to administer in bulk. The weaknesses are equally well known: cards are shared, lost, cloned where the technology is older, and left in drawers on the day they are needed. Cards stay appropriate where turnover is low and the risk profile is modest.
The credential technology inside the card matters more than the card itself. Older 125 kHz proximity credentials are easy to copy, and where a system is being replaced, moving to a modern secure credential with mutual authentication is usually worth the small additional cost. Sector-based or encrypted formats also prevent one building's card from becoming a convenient master key in a neighbouring property run by the same landlord.
Mobile credentials
Mobile credentials move the card into a phone, typically through a wallet, an app or a short-range radio interface. They remove the forgotten-card problem and allow a credential to be issued or revoked remotely, which suits multi-tenant buildings with frequent move-ins and fit-outs. The operational questions are battery dependency, handset replacement, offline behaviour at the door, and what a visitor does when their phone dies at the lobby turnstile.
Door hardware and readers must support the credential technology, and not every installed reader does. A phased migration is common: mobile credentials for staff and tenants in an area with new readers, cards retained elsewhere until the hardware is refreshed. Where a building has an older, unsupported platform, the honest answer may be that mobile access arrives with the modernisation, not before it.
Biometrics
Biometrics remove the thing carried and use something inherent. Fingerprint, palm vein and face recognition are all deployed in the UAE in offices, data rooms and industrial sites. They are appropriate where credential sharing is the actual risk, and inappropriate as a general convenience measure. Accuracy varies with the population, the device and the environment, and enrolment remains a supervised process rather than a self-service one.
The privacy position needs to be settled before a specification, not after. Biometric data is personal data of a more sensitive kind than a card number, and storing templates on a local controller is different from storing them in a cloud service. Face recognition in particular should be justified by a specific operational requirement and reviewed against the expectations of the authority governing the property and the owner's own policies.
Visitor management and integration
A visitor management system turns a logbook into a record with a time, a host and an expiry. The useful functions are pre-registration, host approval, temporary credentials that expire automatically, and a history that can be produced during an audit. Without integration to the access control system, the visitor process stays manual at the door, which is where most buildings lose the benefit of buying it.
Integration is where access control earns its place. CCTV can link a door event to recorded video, lift control can restrict floor access, a fire alarm must release doors on evacuation regardless of what the access system believes, and time and attendance can draw on the same credential events with care about how the data is reused. Each interface is a scope item with an owner, and each should be tested at handover.
Treat every integration as a tested scope item. If nobody has been assigned to prove the link between access control and the fire alarm, assume it has not been proven.
Selection criteria that survive handover
Selection should follow the building's operating reality rather than a feature comparison. Door count, tenant turnover, connectivity, visitor volume, after-hours rules, integration requirements and the capability of the team who will administer the system all point to different answers. A system that is elegant in a demonstration but needs a specialist to add one tenant is the wrong system for a facility with a small team.
Cost comparisons are also frequently incomplete. The visible difference between technologies is usually door hardware, but the lifecycle cost sits in credential issuing, administration time, replacement of lost cards and phones, integration work and support. A technology that is cheaper per reader can be more expensive to operate over five years if it needs more administrative effort or a specialist to change a single tenant permission.
- Credential technology and its interoperability with existing readers
- Door count now, and the realistic expansion path over the building's life
- Administration model: on-premise, hosted or a managed service
- Integration requirements: CCTV, lift control, fire alarm, time and attendance
- Offline behaviour at doors and recovery after a network or power failure
- Data-protection position, retention and access to event and audit records
- Support arrangements, spare parts and the availability of trained technicians