Replacing an access control system: credentials, readers, and a phased cutover

Reference article · 5 min read

Replacing a physical access control system is rarely just a software purchase. The badge on an employee's lanyard is the visible end of a chain that runs through a reader, a wiring run, a door controller, a power supply, locking hardware, a fire alarm interface, and a head-end server holding every cardholder record. Any link in that chain can be the reason a project runs long, and the lowest proposal is usually the one that assumed the most reuse.

Agencies usually start a replacement for one of three reasons: the head-end software is out of support, the credential technology is known to be easy to copy, or the agency has outgrown a system designed for one building. Naming the one driving your project keeps you from buying far more, or far less, than you need.

Inventory the system before you scope the buy

Most schedule problems trace back to a door nobody documented. Before writing requirements, walk the portfolio and record:

Every controlled opening. Door and lock type, reader model, presence of a door position switch and request-to-exit device, and whether it is a fire rated assembly.
Panels. Controller model, firmware, port count, spare capacity, and whether the enclosure sits in a secure space or a public corridor.
Wiring. Conductor count, gauge, shielding, and run length for each reader and lock. This decides how much of the reuse story is real.
Head-end and integrations. Server version, database, and links to cameras, visitor management, elevators, parking, and any identity system feeding it.
Ownership. Which doors belong to facilities, which to a tenant agency, and which sit in leased space the landlord controls.

Credentials are the decision that outlasts the hardware

Low frequency 125 kHz proximity cards transmit a fixed number with no cryptography. Copying one takes only inexpensive, widely sold equipment, and the card cannot authenticate the reader it is presented to. That is the central reason most replacements happen.

Smart cards. Modern 13.56 MHz credentials use mutual authentication and encrypted data on the card. Security depends on key management, so ask who holds the keys, whether the agency can hold its own key set, and whether credentials can be ordered from more than one source.
Mobile credentials. A phone based credential removes card stock and can be issued and revoked remotely. Plan for staff without agency phones, for visitors, and for locked down field devices.
Multi-technology readers. Readers that accept the old and new credential let both run during transition. Set a firm date to switch legacy formats off, or the transition never ends.
Federal interoperability. Agencies that must accept federal PIV cards, or issue interoperable credentials, should confirm current requirements with the issuing authority, since specifications and product lists change.

Panels, reader wiring, and what can actually be reused

Door controllers are usually proprietary to the head-end, so new software often forces new panels. Readers are more portable, but signaling matters. Wiegand, the long standing reader protocol, is unencrypted and unmonitored, so a reader pulled off the wall can be used to inject a credential number. OSDP over RS-485 with secure channel enabled encrypts reader communication and supervises the connection. Confirm secure channel will be turned on, not merely supported.

Conduit, back boxes, locks, strikes, power supplies, position switches, and request-to-exit devices are often reusable. Existing cable sometimes is, depending on conductor count and distance. Require the vendor to verify reuse door by door on a site survey, not in a spreadsheet.

Life safety comes before access control

Egress requirements come from adopted building and fire codes, enforced by the local authority having jurisdiction. Free egress, fire alarm release of electrified locks, delayed egress conditions, and the integrity of fire rated door assemblies are not matters for vendor interpretation. Code editions and local amendments differ, so confirm requirements with your fire marshal or building official early rather than at inspection.

Cardholder data, badge reissue, and cutover

Migration is a chance to clean up. Most legacy systems hold access levels nobody can explain and records for people who left long ago.

Export cardholder records, photos, access groups, and schedules, then reconcile them against current HR and contractor rosters.
Rationalize access levels before import. Migrating hundreds of overlapping groups carries the old problem forward.
Confirm how long access logs and badge photos must be kept under your records retention schedule, and ask counsel how public records law treats security records in your state.
Plan reissue in waves by building and shift, with badging stations near where people work and a route for remote sites, night staff, and contractors.

Phase the cutover by building or riser rather than all at once. Keep the legacy system monitoring the doors it still controls until the last one moves, hold a rollback path for each phase, and verify every converted door: badge in, badge out, alarm reporting, and fire alarm release where applicable.

Tie the badge to employment status

Access should end the day employment ends. Make the HR system the authoritative source of identity, feed hires and separations into the access system automatically where possible, and require named sponsors and expiration dates for contractors and volunteers. Reconcile the cardholder list against HR on a schedule and treat unmatched records as findings. Deactivation that depends on someone remembering to send an email fails eventually.

In the contract, require a door by door survey before final pricing, a signed reuse determination, data export in a documented open format at any time, named key management responsibilities, and acceptance tied to per door verification rather than one system wide sign off.

HQT works with state and local government agencies on systems engineering and integration for projects of this kind, including requirements definition and cutover planning.

Frequently asked questions

Can we reuse our existing readers and wiring when we replace the access control software?

Some of it, usually. Locks, strikes, power supplies, door position switches, request-to-exit devices, conduit, and back boxes are frequently reusable, and existing cable sometimes is depending on conductor count, shielding, and run length. Door controllers are often proprietary to the head-end, so new software commonly means new panels. Require the vendor to confirm reuse door by door during a site survey before final pricing rather than assuming it in a proposal.

Are 125 kHz proximity cards actually insecure?

Low frequency proximity cards send a fixed number with no encryption and no mutual authentication, so the card cannot verify that the reader is legitimate. Equipment capable of reading and duplicating them is inexpensive and widely sold. Moving to 13.56 MHz smart cards or mobile credentials that use encryption and mutual authentication addresses the weakness, provided key management is handled properly.

Should we move to mobile credentials instead of issuing cards?

Mobile credentials remove card stock and shipping and can be issued or revoked remotely, which helps agencies with many sites. They do not cover everyone, since some staff have no agency phone, some field devices are locked down, and visitors and contractors still need something to present. Most agencies run mobile credentials alongside smart cards rather than replacing cards entirely.

How do we keep buildings secure while the system is being cut over?

Phase the work by building or by riser so only a limited set of doors is in transition at any time, and keep the legacy system monitoring the doors it still controls until the last one moves. Multi-technology readers let old and new credentials work during the overlap, with a firm date to disable legacy formats. Define a rollback path for each phase and test every converted door for badge in, badge out, alarm reporting, and fire alarm release where applicable.

How do we make sure a badge stops working when someone leaves the agency?

Treat the HR system as the authoritative source of identity and feed hires and separations into the access control system automatically where the systems support it. For contractors and volunteers who are not in HR, require a named sponsor and a hard expiration date on the record. Reconcile the full cardholder list against HR on a regular schedule and investigate every record that does not match.