What should you ask an access control supplier?
Eight questions, and two of them decide whether you are buying a system or a dependency. Who holds the keys, and what changing supplier would actually involve in practice. Everything else is comparable between offers, and those two frequently are not.
The eight questions
| Question | What it protects against |
|---|---|
| What does the reader verify? | A system that identifies rather than authenticates |
| Who holds the keys? | Being unable to issue cards yourself |
| Who can supply cards? | A single source with your pricing |
| What happens offline? | Doors that fail open or fail shut unexpectedly |
| How fast does revocation reach a door? | A gap after a badge is lost |
| Which phone platforms are supported? | A solution for half your staff |
| What does migration away look like? | A dependency for a decade |
| How long are readers supported? | Hardware that outlives its firmware |
Who holds the keys
The security of a modern access system rests on keys. Whoever holds them decides who can produce a working card.
If the supplier holds them, you buy cards from that supplier for the life of the installation, at prices you will renegotiate from a weak position.
If you hold them, you can source cards elsewhere, and you carry a genuine responsibility to manage them properly.
Both arrangements are defensible. Not knowing which you have is not, and it is a question that never comes up during a sales process unless you raise it.
What leaving costs
Access systems live for a decade or more, which is long enough for a supplier to be acquired, change direction or stop supporting a product line.
So ask what migration looks like in concrete terms: are the readers reusable, are the cards reusable, is the door hardware reusable, and what has to be replaced.
An answer of everything is common and should be priced into the decision rather than discovered in eight years.
Ask also what happens to the enrolment data, since a list of who holds which card is yours and should be exportable.
Reading the answers
A specific technical answer to a technical question is what you want. Vagueness about what the reader verifies is itself the answer.
Enthusiasm about phone credentials with no clarity about platforms means a demonstration rather than a deployment.
Reluctance to discuss migration is the strongest signal in the list, because it is the question with no upside for the supplier.
And a supplier who welcomes these questions is telling you something useful. This is a long relationship, and how the first conversation goes is a reasonable predictor of the ninth year.
Frequently asked questions
Why does it matter who holds the keys?
Because whoever holds them decides who can produce a working card. It determines your sourcing and your negotiating position for a decade.
What should happen at a door when the network fails?
Whatever you decided, documented and tested. Both failing open and failing shut are legitimate choices and neither should be a surprise.
Is a single supplier a problem?
It is a dependency to price rather than an error. Knowing its cost before signing is the point of asking.
How long should readers be supported?
Long enough to match the life of the installation, which is measured in years rather than product cycles. Ask for it in writing.