What Are Access Control Systems? How Do They Work and How Are They Chosen?
Access control systems are electronic security solutions that provide secure access for authorized individuals to designated areas in buildings and facilities. We examine card access, RFID, mobile access, biometric authentication, turnstiles, barriers, and central management technologies; along with their operating principles, advantages, standards, and criteria for selecting the right system.
Access control systems are electronic security solutions used to authorize, monitor, and manage individuals' access to specific areas in buildings and facilities. Card access, mobile access, PIN codes, turnstile systems, and various authentication technologies are among the core components of this infrastructure.
Unlike traditional key and lock systems, electronic access control systems allow for centralized management of access permissions and time-based authorization for specific doors.
For example, in a factory, production personnel can only access sections defined for them, while the technical service team can be authorized to enter electrical rooms or maintenance areas during specific hours.
However, a reliable access control system is not merely comprised of devices that open a door. Proper authentication, secure communication, authorization management, door security, emergency evacuation, and system continuity must be evaluated together.
What is an Access Control System?
An access control system, referred to in English as an Access Control System, is an electronic security infrastructure that manages access to physical areas within a defined set of rules.
It fundamentally answers three questions:
Who? Which user or defined access credential is requesting entry?
Where and when? Does the user have authorization to access the relevant door, zone, or facility?
What action occurred? Was the access request granted or denied, and what was the status of the door?
These functions can be performed according to the features supported by the control panel and software used.
There is an important technical distinction: permission granted by the system does not always prove that the person physically passed through the door. Door contacts, turnstile sensors, or other appropriate detection components may be required to verify actual door movement or passage.
How Do Access Control Systems Work?
The fundamental operating principle of an electronic access control system is the verification of identity information and the management of physical access according to authorization.
1. Reading Identity Information
The user presents an RFID card to the card reader, enters a PIN, or uses a mobile access method.
The reader obtains the necessary identity information according to the technology it supports.
2. Authorization Control
The information provided by the reader is evaluated by the access control panel or the relevant system component.
The system checks whether the user has access rights to the entry point at the specified day and time.
3. Controlling the Door or Turnstile
If authorization is successful, the control panel sends the appropriate command to the electric lock, door mechanism, turnstile, or barrier.
4. Event Logging
In supported systems, access requests can be logged with information on the user, date, time, and access point.
These records can be used for investigating security incidents and auditing access permissions.
What Components Make Up an Access Control System?
In professional access control projects, multiple hardware and software components work together.
Card Readers and Authentication Terminals
These are devices that provide the user's card, PIN, or other access information.
How the reader reads identity information and transmits it to the control panel is important for security.
Access Control Panel
It is the system's primary decision and control unit.
It can perform functions such as authorization, entry-exit management, door control, and event logging.
In high-security applications, positioning the control unit on the secure side can help reduce the risk of an outdoor reader directly taking over lock control.
Electric and Electromechanical Locks
These perform physical locking or unlocking operations in response to commands from the control panel.
Electric strikes, electromagnetic locks, and motorized locking mechanisms have different application requirements.
Door Contacts and Exit Hardware
Monitoring the open or closed status of a door can be used to detect events such as forced entry and prolonged open states.
Exit buttons and other hardware should be selected according to the door's intended use and emergency evacuation requirements.
Central Management Software
This enables the management of users, doors, authorization groups, time schedules, and event logs.
In large facilities, managing different buildings and access points from a common platform can provide operational advantages.
What Are the Types of Access Control Systems?
Card-Based Access Control Systems
Card-based access systems are one of the most common electronic access control methods.
The card assigned to the user is detected by the reader, and access authorization is verified.
Cards using RFID technology can be preferred for staff entrances, offices, production areas, warehouses, and controlled doors.
However, not all RFID cards have the same level of security.
Older systems based solely on reading a fixed card number should be distinguished from modern card systems that provide mutual authentication and cryptographic protection.
A card being contactless does not automatically mean it is secure against copying.
PIN-Based Access Systems
In PIN-based systems, the user requests access by entering a predetermined password.
This method may not require carrying a card.
However, risks such as password sharing, the use of easily guessable PINs, and the visibility of the PIN from the keypad should be evaluated.
In some applications, card and PIN can be used together to provide additional authentication.
Mobile Access Control Systems
Mobile access systems allow smartphones to be used as digital access credentials.
Authentication can be performed via Bluetooth, NFC, or other technologies supported by the manufacturer.
On supported platforms, user permissions can be defined or revoked remotely.
However, whether mobile access works without an internet connection, how access is revoked if the phone is lost, and the security of digital keys should also be examined.
For more information on the operating principles of mobile access, GüvenlikOnline's article titled Mobile Access System can be reviewed.
Biometric Access Control Systems
Biometric access systems can perform authentication using fingerprints, facial features, or other biometric characteristics.
These technologies can be considered for certain high-security areas.
However, biometric authentication and personnel time and attendance tracking are not the same purpose.
In Turkey, the processing of biometric personal data is subject to special obligations under Law No. 6698 on the Protection of Personal Data (KVKK).
Specifically, the use of biometric data for employee time and attendance tracking should be evaluated in line with the Personal Data Protection Board's principle decision No. 2026/921.
Legal details regarding this matter are discussed in later sections of the article.
Turnstile Access Control Systems
Turnstiles are systems that physically regulate pedestrian traffic.
There are different mechanical solutions such as tripod, speed gate, glass-wing, and full-height turnstiles.
The type of turnstile to be used should be determined based on:
Daily user count,
Passage capacity during peak hours,
Security level,
Accessibility for disabled individuals,
Emergency requirements.
The mere fact that a turnstile has a card reader does not guarantee secure and uninterrupted passage management.
Vehicle Access Control and Barrier Systems
For vehicle access control, RFID tags, long-range readers, license plate recognition systems, and automatic barriers can be used.
In applications using License Plate Recognition (ANPR), camera placement, license plate image quality, vehicle speed, and environmental conditions are important.
The recognition of a vehicle's license plate does not mean that the driver's identity is also verified.
In high-security applications, different authentication methods may need to be evaluated together.
Comparison of Access Control Technologies
| Technology | Key Advantage | Technical Limitation |
|---|---|---|
| RFID card | User management and widespread application support | Card sharing, copying risk in older technologies |
| PIN password | Access without carrying a card | Password sharing and observation risk |
| Mobile access | Digital key, remote authorization management | Device and platform compatibility |
| Fingerprint | Biometric authentication | Sensor conditions, KVKK requirements |
| Face recognition | Contactless authentication | Detection conditions, biometric data, and regulations |
| Turnstile | Physical pedestrian traffic management | Capacity, accessibility, and evacuation |
| ANPR and barrier | Automatic management of vehicle passages | License plate readability and vehicle-user distinction |
This table compares the general characteristics of technologies. The security performance of each solution depends on product features, installation conditions, and system design.
What is the Difference Between OSDP and Wiegand?
One of the most important technical aspects in access control systems is the communication between the reader and the control panel.
Wiegand Communication
Wiegand is an older generation data communication method used in many access control systems from the past to the present.
Common Wiegand interfaces rely on unidirectional communication and do not include modern encrypted communication features in their standard structures.
This situation should be considered, especially in applications requiring high security.
What is OSDP?
OSDP (Open Supervised Device Protocol) is an open protocol developed by the Security Industry Association that supports communication between readers and control panels.
OSDP offers more advanced communication and system monitoring capabilities in modern access control projects.
Among OSDP's advantages are:
Bidirectional communication.
Ability to monitor reader status.
Secure communication in compatible devices.
Multi-device management.
Support for advanced authentication applications.
Why is OSDP Secure Channel Important?
OSDP Secure Channel provides authenticated and encrypted communication between the reader and the control panel in supported systems.
However, there is a critical point here:
A device supporting OSDP does not automatically mean that encrypted communication is enabled.
During installation, the secure channel must be configured, key management performed, and its operational status verified.
The OSDP Verified program, run by SIA, evaluates products' compliance with relevant protocols and profiles through independent tests.
However, OSDP Verified registration also does not mean that different devices will automatically work seamlessly in every combination. Final system compatibility must be checked separately.
Which Standards Are Important in Access Control Systems?
In the design of electronic access control systems, international standards help evaluate system components and implementation processes.
IEC 60839-11-1:2013
This standard covers the basic functions, performance requirements, and test methods for electronic access control systems and their components.
It provides a technical reference for evaluating functions such as authentication, authorization, access control, and event logging.
IEC 60839-11-2:2014
This is an application guideline related to the planning, installation, commissioning, operation, maintenance, and documentation of electronic access control systems.
IEC 60839-11-5:2020
This relates to the communication protocol between OSDP-based access control devices.
While these standards form the technical basis for system selection, applicable TSE equivalents and relevant national legislation in Turkey should also be evaluated.
How Are Access Control Systems Integrated with Fire Alarms?
One of the most important engineering considerations in access control systems is meeting both security and emergency evacuation needs simultaneously.
Keeping a door locked against unauthorized entry should not prevent individuals from safely exiting in an emergency.
In Turkey, the Regulation on Fire Protection of Buildings contains requirements regarding escape routes and emergency control functions.
Article 82 of the Regulation also addresses control functions related to doors and turnstiles kept locked for security purposes in fire scenarios.
What to Check in Fire Integration
That relevant doors and turnstiles exhibit the required behavior when a fire alarm occurs.
Preservation of safe evacuation conditions during power outages.
Availability of necessary manual emergency exit mechanisms.
Ensuring accessible escape routes are not obstructed.
Verification of fire scenarios through commissioning tests.
Concepts such as fail-safe and fail-secure are related to the behavior of the lock technology used during power loss.
However, a product remaining locked from the outside when power is cut, and safe exit being possible from the inside, are different features.
Therefore, the lock, door, and evacuation mechanism should be evaluated as a whole.
Access control systems must be designed in accordance with fire safety and emergency evacuation requirements.
What is the Difference Between Access Control Systems and Time and Attendance Systems (PDKS)?
Access control and Personnel Time and Attendance Systems (PDKS) can be used together in some projects.
However, the primary purpose of the two systems is different.
An access control system manages a user's authorization to access a specific area.
PDKS is used to track employee attendance and working hours information according to relevant rules.
For example, a record of a person passing through a door may not, by itself, be definitive proof of when they started or completed their work.
In PDKS calculations, working rules such as shifts, leave, breaks, and similar should be evaluated separately.
Current KVKK Regulation on the Use of Biometric PDKS
The Personal Data Protection Board's principle decision No. 2026/921, dated April 29, 2026, has introduced significant limitations regarding the processing of biometric data for employee time and attendance tracking.
The Board has made evaluations foreseeing the use of cards, PINs, and other less intrusive alternatives instead of biometric methods for time and attendance tracking.
In the additional statement dated August 27, 2026, it was stated that biometric data processing activities other than time and attendance tracking should be evaluated separately.
Therefore:
The use of biometric data for personnel attendance tracking,
Biometric access control for the physical security of critical areas
should not be considered the same legal purpose.
If biometric data is to be processed for physical access purposes, the legal basis, necessity, proportionality, alternative methods, and data security should be examined specifically for the concrete application.
Where Are Access Control Systems Used?
Factories and Industrial Facilities
Different access permissions can be created for production areas, warehouses, laboratories, maintenance rooms, and critical technical spaces.
Offices and Plazas
Electronic access control can be implemented for staff entrances, meeting areas, executive floors, and specific departments.
Residential Complexes and Residences
Access management can be provided for building entrances, common areas, parking lots, and social facilities.
Hospitals and Healthcare Institutions
Can be used in technical rooms, drug storage facilities, laboratories, and areas with restricted access.
Educational Institutions
Can be considered for staff entrances, administrative units, laboratories, and areas requiring special access.
Data Centers
Multi-level authorization can be applied in server rooms, cabinet areas, and critical infrastructure rooms.
Parking Lots and Logistics Facilities
Vehicle barriers, license plate recognition systems, and personnel access control can be managed within a common security infrastructure.
Can Access Control Systems Be Integrated with CCTV, Alarm, and Intercom?
In systems with appropriate hardware and software infrastructure, different security technologies can work together.
For example:
An alarm can be generated in case of forced door entry.
Camera footage related to an access control event can be accessed.
Visitor identity can be evaluated via video intercom.
Authorized personnel can perform remote door unlocking.
Vehicle passage events can be linked with relevant barrier and camera recordings.
However, the support of different brands' devices within the same software does not guarantee that all their special functions will work together.
Therefore, necessary API, SDK, communication protocol, and manufacturer compatibility information for integration must be verified during the project phase.
GüvenlikOnline's article titled Hikvision Quick Pass Unifies Pedestrian and Vehicle Access on a Single Platform provides a current application example for unified access management.
What to Consider When Choosing an Access Control System?
Professional system selection should not be based solely on the card reader or turnstile model.
Number of Access Points
The number of doors, turnstiles, and barriers to be controlled must be determined.
Future growth potential should also be considered.
User Capacity
The system's supported user count, authorization groups, and event logging capacity should be evaluated.
Passage Speed
Especially in busy staff entrances, reader response time, turnstile capacity, and management of passage flow are important.
Offline Operation
It should be examined whether control panels can operate with existing authorization information when server or network connection is lost.
Communication Security
Reader-control panel communication, data security, and encrypted communication capabilities must be verified.
Authorization Management
Appropriate management tools should be available for temporary users, visitors, different shifts, and employees whose access has been revoked.
Integration Capability
Necessary integrations with CCTV, alarm, intercom, PDKS, and building management systems should be evaluated.
Maintenance and Technical Support
Spare parts, software updates, warranty, periodic maintenance, and manufacturer technical support processes should be examined.
Technical Checklist for Access Control System Installation
Has a security risk analysis of the facility been conducted?
Have the door, turnstile, and barrier points been determined?
Have user and authorization groups been defined?
Is the authentication technology suitable for its intended use?
Are the control panel's capacity and expansion options sufficient?
Has the security of reader communication been verified?
If OSDP Secure Channel is used, has its configuration been checked?
Have offline operation and power outage scenarios been tested?
Have door contacts, forced entry, and prolonged open alarms been verified?
Has fire alarm and evacuation integration been tested?
Have camera, intercom, or PDKS integrations been verified?
Have KVKK and biometric data processing requirements been examined?
Have software access and security updates been planned?
Has installation, commissioning, and maintenance documentation been prepared?
This checklist is for technical evaluation purposes. It does not replace project-specific legal review or compliance testing.
Frequently Asked Questions
What does an access control system do?
It manages authorized individuals' access to specific areas, helps restrict unauthorized access, and logs access events in supported systems.
Are card access systems and access control systems the same?
A card access system is one of the access control technologies. Access control systems can include mobile access, PIN, appropriate biometric authentication, and other access methods in addition to cards.
Does an access control system work without internet?
In some systems, the access control panel can operate with local authorization information without an internet or server connection. However, not all products support the same features.
Is OSDP or Wiegand more secure?
A properly configured OSDP Secure Channel can provide significant security advantages over older, unencrypted Wiegand communication. However, it must be verified that encrypted communication is actually enabled.
Can an access control system be connected to a fire alarm?
Yes. In appropriate systems, fire alarm and door/turnstile control can be integrated. However, the integration's compliance with safe evacuation requirements must be verified during the design and commissioning phases.
Can personnel time and attendance be tracked with fingerprints?
In Turkey, this practice is subject to significant legal limitations under the KVKK's principle decision No. 2026/921. Less intrusive methods such as cards, PINs, and similar should be primarily considered.
How many doors can access control systems be applied to?
Systems of different scales can be installed, from a single door to numerous buildings and access points. The number of doors depends on the capacity of the control panel, software, licenses, and communication infrastructure.
Conclusion: The Right Access Control System Must Be Secure and Manageable
Access control systems are among the fundamental components of modern electronic security infrastructures.
Card access, mobile access, turnstile systems, and central management software can help meet security and operational management needs in various facilities.
However, a successful access control project does not consist solely of installing electronic readers and door locks.
Selecting the right system requires a combined evaluation of risk analysis, user authorization, secure communication, door hardware, fire evacuation, personal data protection, and system continuity.
The purpose of a professional access control system is not merely to open doors, but to ensure that the right person accesses the right area at the right time, securely and audibly.
For different device options and technical specifications, GüvenlikOnline's Access Control Systems Hardware Catalog can be reviewed.