Enterprise Access Control Buying Guide: 8 Questions to Ask Before You Invest

Access control is not a product you buy — it is a system you design. The hardware (readers, controllers, door hardware) is only part of the investment. The software, integration with HR systems, maintenance contract, and long-term scalability are equally important components that many buyers overlook until they are already locked into a system that cannot grow with them.

We have encountered organizations in Bangladesh that purchased low-cost standalone access control systems, operated them for 3 years, and then needed to replace the entire system when they needed features that the original system's closed architecture could not support. The cost of a well-specified system from the beginning is almost always less than the cost of a premature replacement.

These 8 questions will help you specify an access control system that serves your organisation for the next 7–10 years — not just the next 12 months.

Question 1: How Many Doors and Users Now — and in 3 Years?

The single most common specification mistake is designing for today's requirements without planning for growth. Access control systems scale in two ways: door count and user count.

Door Count Planning

Count every door that currently requires access control. Then ask:

• Are there any expansions planned (new floors, new buildings, new leased spaces)?
• Are there any doors currently on manual keys that should be access-controlled but were excluded for budget reasons?
• Are there planned security upgrades (adding access control to previously open areas)?

Add 30–40% to your current door count as your target system capacity. A system that is 80% full at installation has little room for growth.

User Count Planning

Count your current employees. Factor in:

• Expected headcount growth over 3 years
• Contractor and temporary worker volumes (these cycle through the system and require capacity for enrollment and deletion management)
• Visitor volumes (if you integrate visitor management with access control)

Most controllers handle 10,000–100,000 users without performance impact. User count is rarely the binding constraint — scalable server-based platforms remove it as a concern entirely.

Controller Scalability

Verify that your access control controller supports software licence expansion. Enterprise panels from Bosch, Honeywell, and Gallagher allow door count expansion through software licences rather than hardware replacement. Standalone systems (common in the Bangladesh mid-market) have fixed hardware limits that cannot be exceeded without controller replacement.

Question 2: What Security Zones Do You Need?

Not all areas of your facility require the same security level. Define your zones before designing your access control:

Define the zones explicitly and specify the authentication method for each zone type. This drives the reader specification at each door.

Anti-passback rules (preventing double-entry without corresponding exit) should be configured at zone boundaries where tailgating is a concern.

Question 3: Do You Need Time-Based Access Rules?

Simple access control grants a credential permanent 24/7 access to specified zones. Most real-world deployments need more sophisticated time rules:

Shift-based access: A production floor worker can access the factory only during their shift (e.g., 6:00 AM – 2:30 PM). Their card is rejected outside these hours without manual override.

Day-of-week restrictions: Cleaning contractors have access Monday to Saturday only, not on Sundays.

Holiday schedules: During public holidays, only authorised staff can access the building; standard employee access is suspended.

Time-limited credentials: A contractor's access automatically expires on their contract end date without manual intervention.

Temporary access escalation: A manager grants a staff member temporary elevated access to a restricted area for one day.

Enterprise access control platforms (Bosch ACS, Honeywell Pro-Watch, Gallagher Command Centre) support all of these. Standalone systems with basic firmware often support only simple schedules. Verify time rule capability before purchasing.

Question 4: Cloud or On-Premise?

This question is covered in depth in our dedicated cloud vs on-premise access control guide. The summary for enterprise buyers:

• On-premise: Recommended for regulated entities (Bangladesh Bank, financial services), large facilities, and organisations with IT teams capable of server management. No internet dependency. Full data control.

• Cloud: Recommended for multi-site retail, hotel chains, and organisations without local IT infrastructure at each site. Requires verified offline mode capability for Bangladesh deployment.

• Hybrid: On-site controllers with cloud management. Recommended for most Bangladesh enterprise deployments of 5+ doors and 2+ sites.

Question 5: What HR and Payroll Integration Is Required?

For organisations using access control for attendance tracking (very common in Bangladesh factory and corporate deployments), the integration between access control and HR/payroll is critical.

Integration Questions to Ask

Does the system support API integration with your HR software? Major HR platforms used in Bangladesh (Oracle HCM, SAP SuccessFactors, locally developed payroll systems) have API standards. Verify your access control vendor provides a documented API or native integration.

How is enrollment managed? When a new employee joins, does the access profile automatically sync from the HR system, or does someone manually enroll them in the access control system? Manual duplication of the HR onboarding process in access control adds administrative cost and creates synchronisation errors.

How is offboarding managed? When an employee leaves, is their access automatically revoked when HR marks them as inactive? The Motijheel financial institution example from our MFA article resulted from a manually managed offboarding process. Automated revocation upon HR status change eliminates this class of risk.

How are attendance reports generated? Time and attendance reporting from access control logs can replace or supplement manual attendance registers for payroll calculation. Verify the report format is compatible with your payroll software.

Question 6: What Happens During Power Failure?

Power failure behaviour is one of the most important and most overlooked specifications in access control systems. This is particularly critical in Bangladesh, where load-shedding affects even urban commercial areas periodically.

Fail-Secure vs. Fail-Safe: The Critical Choice

Fail-secure (Fail-locked): When power fails, the door lock engages automatically — the door stays locked. Appropriate for security-critical doors where preventing unauthorised access is more important than emergency egress.

Fail-safe (Fail-open): When power fails, the lock releases automatically — the door opens. Appropriate for emergency egress routes where people must be able to exit regardless of power status.

Fire Safety and Building Code Note: Bangladesh's building and fire safety regulations require that doors on emergency egress routes (fire exit routes, stairwell access doors, main exit routes) must fail-safe to allow evacuation. Never specify fail-secure locks on egress route doors. This is both a legal requirement and a life safety matter.

Battery Backup Specification

All access control panels and door controllers should connect to UPS power with sufficient battery backup for your load-shedding duration. In areas experiencing 2–3 hour daily load-shedding, specify panels with UPS batteries providing minimum 4 hours of operation (accounting for battery aging).

Magnetic locks (maglocks) consume continuous power. Battery capacity must account for all connected maglocks. A 12V 7Ah battery supports approximately 4 maglocks (250mA each) for 2 hours. Specify accordingly.

Question 7: What Visitor Management Is Required?

Manual paper visitor books have four problems: they are easy to falsify, they provide no real-time visibility of who is on-site, they do not integrate with access control, and they create PDPO 2025 compliance challenges (uncontrolled personal data in a physical book).

Enterprise access control platforms offer visitor management modules that:

• Allow pre-registration by host employees via web portal or email
• Print timed access badges for visitors
• Grant temporary access only to approved zones for the visitor's duration
• Automatically revoke access when the visitor checks out or when the time expires
• Maintain an auditable log of all visitor access events

For large facilities with significant visitor throughput (hospitals, corporate headquarters, hotels), visitor management integration is essential. For smaller facilities, a basic manual check-in with a time-limited access card is adequate.

Question 8: What Is the Total Cost of Ownership (TCO)?

The purchase price of access control hardware is typically 40–60% of the 5-year TCO. Omitting ongoing costs from the budget leads to unpleasant surprises.

Complete TCO Components

Feature Requirements Checklist

Use this checklist when evaluating vendors:

• [ ] Scalable to planned door count + 40% growth
• [ ] Time-based access rules with schedule and holiday management
• [ ] Anti-passback at zone boundaries
• [ ] MIFARE DESFire card support (minimum)
• [ ] Biometric reader integration (fingerprint or face)
• [ ] API integration with HR/payroll system
• [ ] Automated access revocation linked to HR offboarding
• [ ] Visitor management module
• [ ] OSDP protocol for encrypted reader communication
• [ ] Comprehensive event log with tamper-evident audit trail
• [ ] Offline mode (for cloud or hybrid systems)
• [ ] PDPO 2025-compliant biometric template storage and deletion
• [ ] CCTV integration for event verification
• [ ] Multi-site management from single console (if required)

How to Evaluate Vendors in Bangladesh

1. Verify brand authorisation: Confirm the vendor is an authorised dealer and installer for the specific brand they specify (ZKTeco, Bosch, Honeywell, Gallagher). Authorised dealers have access to genuine products, firmware updates, and manufacturer warranty support.

1. Request reference installations: Ask for 3 references of completed projects at comparable scale. Visit one reference site and ask the client about post-installation support quality, system stability, and problem resolution speed.

1. Evaluate AMC terms in detail: Understand exactly what is covered — parts, labour, emergency call-out, firmware updates, preventive maintenance visits. Cheap AMC contracts often exclude parts or emergency call-outs.

1. Assess PDPO 2025 knowledge: Ask the vendor to explain their PDPO 2025 compliance approach for biometric data. A vendor who cannot answer this question competently is not ready to deploy biometric access control under Bangladesh's current legal framework.

1. Test integration claims: If HR/payroll integration is required, request a demonstration of the integration with your specific HR system before signing a contract.

Bangladesh Market Pricing Guidance (2026)

Pricing excludes AMC, software, and HR integration. Bangladesh market pricing, 2026.

Key Takeaways

• Plan for 3-year growth at the specification stage — specifying for today's door count produces a system that needs replacing prematurely
• Define security zones explicitly before specifying authentication methods — not all doors need the same level
• Time-based access rules eliminate the most common insider threat: out-of-hours access by authorised individuals
• Fail-secure vs fail-safe is a life safety decision — fire exit and egress doors must always fail-safe regardless of security zone
• Automated HR offboarding integration eliminates the most common access control failure mode: ex-employees retaining access
• 5-year TCO including AMC, software, and consumables is typically 1.7–2× the hardware purchase price

Ready to Specify Your Enterprise Access Control?

SSAL designs enterprise access control systems for Bangladesh organisations at every scale, from 5-door offices to 200+ door factory complexes. Our free consultation covers all 8 questions in this guide and produces a detailed specification you can use for competitive comparison or engage us to implement directly.

Contact SSAL for a free enterprise access control consultation:

• Phone: +880 1799-986890
• Email: info@smartsafety.com.bd
• Web: www.smartsafety.com.bd
• Office: Youth Tower Level 2, 822/2 Rokeya Sarani, Dhaka-1216

Already have quotations from other vendors? Request a SSAL specification review — our team analyses any existing access control proposal against the 8-question framework and provides honest, independent feedback on completeness, scalability, and value for money.