Enterprise Access Control System Design Guide: Zone Definition to Integration Architecture

Executive Summary

Access control is the foundational layer of physical security. Every other security system — CCTV, intrusion alarm, visitor management — depends on access control to define who belongs in each area, when they belong there, and what happens when those parameters are violated. Yet many organisations deploy access control as an afterthought: a card reader on a door, a system that records entries but provides no analytical value, an isolated island that never communicates with the CCTV or HR systems it should be connected to.

This guide provides a comprehensive methodology for designing enterprise access control systems that function as an integrated security intelligence platform, not just a door lock. We cover security zone planning, authentication technology selection, hardware specification, system architecture, integration design with CCTV and HRMS systems, and full compliance guidance for Bangladesh Bank ICT Security Guideline v4.0 and PDPO 2025.

SSAL has designed and deployed enterprise access control systems for Bangladesh's major financial institutions, manufacturing facilities, healthcare organisations, and government departments. This guide reflects the design standards we apply to every project.

Chapter 1: Security Zone Planning

1.1 Zone Hierarchy Principles

Physical security operates on a zone hierarchy: concentric layers of protection, with each inner zone more restricted and more closely monitored than the outer zone surrounding it. Defining zones correctly is the most important step in access control design — it determines what hardware you need, how many readers, what integration is required, and what authentication strength is appropriate at each boundary.

Define zones using four levels:

Zone 0 — Public: Areas accessible to any member of the public without any authentication. Entrance lobbies (before the reception desk), retail floor areas, and public car parks are Zone 0. No access control reader is required to enter Zone 0, but CCTV coverage is essential.

Zone 1 — Semi-Public / Reception-Controlled: Areas where visitors are escorted or registered but do not require credentials. Reception areas behind the public lobby, waiting rooms, general office corridors. Entry is typically controlled by a receptionist or a visitor management system issuing a visitor badge. Basic card reader access control is appropriate at Zone 0–1 boundaries.

Zone 2 — Restricted: Areas accessible only to authorised employees with defined roles. General office floors, meeting rooms, break rooms, IT equipment rooms. A single-factor credential (card swipe or fingerprint) is appropriate at Zone 1–2 boundaries. All access events are logged; access rights are role-based and time-restricted.

Zone 3 — High Security: Areas containing highest-value assets — cash vaults, server rooms, executive suites, data centres, evidence rooms. Two-factor or multi-factor authentication (MFA) is required at Zone 2–3 boundaries. Access is logged and monitored; anomalous access patterns trigger alerts. Dual-person integrity (two authorised people required simultaneously) may be required for the most sensitive areas such as bank vaults.

1.2 Zone Map Methodology

Produce a security zone map for every floor and building in scope. On a scaled floor plan:

1. Mark all external perimeter boundaries (Zone 0–1 transitions)
2. Mark all internal restricted boundaries (Zone 1–2 transitions)
3. Mark all high-security boundaries (Zone 2–3 transitions)
4. Mark every door, turnstile, gate, or access point on each zone boundary
5. Assign a unique identifier to every access point (door number)
6. Specify the required authentication level at each access point

The resulting zone map is the primary design document. Every subsequent design decision — reader selection, door controller specification, cable routing, integration requirement — derives from the zone map. Never begin hardware specification before the zone map is approved by the client's security manager.

1.3 Time-Based Access Rules

Access rights in an enterprise system are not simply "allowed" or "denied." They are conditional on time, day, and context. Design your time zone rules as part of zone planning:

Define standard access schedules for each employee category: general staff (Monday–Saturday, 8:00–20:00), management (24/7), cleaning staff (Monday–Saturday, 18:00–22:00), maintenance contractors (specific days with advance scheduling). Out-of-hours access attempts by general staff should generate an alert to the security monitoring station, even if the access is technically permitted.

Chapter 2: Authentication Technology Selection

2.1 Proximity Cards

Proximity (prox) cards use passive RFID (Radio Frequency Identification) at 125 kHz frequency (EM4100 or HID standard). The card contains a fixed, unencrypted ID number. When presented to a reader, the reader detects the card ID and compares it against its authorised database.

Proximity cards are the lowest-cost credential technology, with card costs of BDT 50–150 each and reader costs of BDT 3,000–8,000. Their critical weakness is cloneability: the unencrypted 125 kHz signal can be read and duplicated by commercially available handheld cloners available for BDT 2,000–5,000. A 125 kHz prox card system provides convenience rather than genuine security and is not appropriate for restricted or high-security zones. Deploy proximity cards only for Zone 0–1 boundaries where the credential controls convenience, not security.

2.2 Smart Cards (13.56 MHz RFID)

Smart cards (MIFARE, DESFire, iCLASS SE) operate at 13.56 MHz with encrypted communication between card and reader. DESFire EV3 and SEOS credentials encrypt all data transmitted, making clone attacks impractical with current technology. Smart cards are the appropriate technology for Zone 1–2 and Zone 2–3 boundaries in commercial environments.

Smart card costs are BDT 200–600 per card depending on technology (MIFARE Classic < DESFire EV2/EV3 < iCLASS SEOS). Readers cost BDT 8,000–25,000 each. Invest in high-security encrypted credentials — the cost premium over 125 kHz cards is minor relative to the security improvement.

2.3 Biometric Authentication

Biometric authentication verifies identity from a physical characteristic — fingerprint, iris pattern, palm vein, or face — rather than from a token (card). Biometrics are intrinsically linked to the individual; they cannot be lent, lost, or stolen in the way a card can. However, biometric data is classified as sensitive personal data under PDPO 2025 and requires heightened data governance (see Chapter 6).

Fingerprint is the most widely deployed biometric in Bangladesh, driven by familiarity (the NID card system uses fingerprints), low hardware cost (BDT 15,000–45,000 per reader), and high accuracy (false acceptance rate below 0.001% on leading devices). Fingerprint readers can struggle with wet, worn, or damaged fingers — a significant concern for manufacturing environments where workers' hands are frequently exposed to chemicals, heat, or abrasion. Consider multi-biometric devices that offer both fingerprint and facial recognition as fallback.

Facial recognition is increasingly deployed for high-throughput access points — office entrance turnstiles, building lobbies — where the contactless, hands-free nature eliminates queuing caused by fingerprint readers. Face readers capable of 1:N matching (identifying a face against a database of enrolled faces without requiring the user to present a card first) cost BDT 45,000–1,20,000 per reader. PDPO 2025 compliance requirements for facial recognition are more complex than for fingerprint (see Chapter 6).

Iris recognition provides higher accuracy than fingerprint (false acceptance rate below 0.0001%) and is not affected by dirty or damaged hands. Iris readers are more expensive (BDT 80,000–2,00,000 per reader) and are appropriate for highest-security zones — bank vaults, server rooms, pharmaceutical cold stores — where the accuracy requirement justifies the premium.

2.4 Mobile Credentials

Mobile credentials use Bluetooth Low Energy (BLE) or Near Field Communication (NFC) on a smartphone as the access credential. The credential is provisioned by an app directly to the phone, eliminating card issuance and replacement costs. Lost credential management is instant — an IT administrator deactivates the compromised credential remotely within minutes, compared to the 2-hour delay typical for card deactivation while a replacement is printed.

BLE credentials support "tap," "twist-and-go" (no need to take the phone out of pocket), and hands-free long-range (automatically unlock a door as the authorised user approaches) operation modes. Mobile credentials are the future standard for corporate access control. Deployment requires employees with compatible smartphones, a mobile device management (MDM) policy, and Bluetooth-capable readers. Costs per reader are BDT 12,000–35,000 for BLE-capable models.

2.5 Multi-Factor Authentication (MFA)

For Zone 2–3 boundaries (high-security areas), require 2 or more authentication factors from the categories: something you have (card), something you know (PIN), and something you are (biometric). Common MFA combinations:

• Card + PIN (most common, lowest cost)
• Card + fingerprint (medium cost, high security)
• Card + face (high throughput, contactless)
• Card + PIN + fingerprint (triple factor for highest security — vaults, evidence rooms)

MFA readers that support multiple authentication modes simultaneously cost BDT 20,000–60,000 per reader. Every Bangladesh Bank-regulated facility is expected to deploy MFA at vault and sensitive area access points under BB ICT Security Guideline v4.0.

Chapter 3: Hardware Selection

3.1 Door Controllers

The access control panel (door controller) is the intelligence of the system. It stores access rules locally, evaluates credentials, controls door hardware outputs, and communicates events to the access control server. Controllers are categorised by their connectivity:

Standalone controllers store access rules and make grant/deny decisions independently. They require no network connection for day-to-day operation. Standalone controllers are appropriate for small single-site deployments (up to 500 cardholders, up to 4 doors) or for remote locations with unreliable network connectivity where a standalone controller provides resilience.

Networked controllers connect to an access control server over TCP/IP. Rules are managed centrally; events are logged centrally; real-time monitoring is available from any networked workstation. Networked controllers are the standard for enterprise deployments. Leading enterprise controllers (Gallagher Controller 7000, ZKTeco inBio series, HID EDGE EVO) support 2–4 doors per controller and up to 65,535 cardholders locally.

IP-based controllers connect via standard Cat6 Ethernet and can receive PoE power from a PoE switch, eliminating the need for a local 12V power supply at the controller. PoE-powered IP controllers simplify installation significantly and are SSAL's preferred hardware architecture for new enterprise deployments.

3.2 Door Hardware

Electric strikes replace the door strike plate (the part the latch bolt engages when the door closes) with an electrically controlled version. Fail-secure electric strikes remain locked when power is removed; fail-safe electric strikes unlock when power is removed. Fail-secure is appropriate for security doors; fail-safe is required for fire exit doors (doors must be openable during fire evacuation even if the access control system loses power).

Electromagnetic locks (maglocks) mount to the door frame and hold the door closed with magnetic force — typically 280 kg or 600 lb holding force for commercial doors. Maglocks are always fail-safe (they release on power loss), making them appropriate for fire exit doors when paired with REX (Request to Exit) sensors. Maglocks cannot be retrofitted to all door types and require door closers to ensure the door closes fully against the magnet after each entry.

Door closers ensure that access-controlled doors close and latch fully after every use. An access-controlled door left wedged open defeats the entire access control investment. Specify door closers on every access-controlled door and include them in the maintenance programme.

3.3 Request to Exit (REX) Devices

REX (Request to Exit) devices allow egress from the secured side of a door without requiring credential presentation. REX devices include motion detectors (detect person approaching the door from inside and signal the controller to release), push-to-exit buttons, and touch bars. For fire exit routes, motion-detecting REX devices are required to allow hands-free emergency egress.

Chapter 4: System Architecture

4.1 On-Premise Server Architecture

An on-premise access control server hosts the access control management software, the cardholder database (typically tens of thousands of people for an enterprise), the event log database (millions of events per year), and the VMS integration middleware. The server communicates with all networked door controllers across the building LAN and provides operator workstations (monitoring, reporting, cardholder management) and remote access for security managers.

Specify an access control server with N+1 redundancy for enterprise deployments: a primary server and a hot standby that takes over automatically if the primary fails. Controllers operate standalone (using their locally cached access rules) during server failover, ensuring door operation continues uninterrupted.

4.2 Cloud-Based Access Control

Cloud-based access control platforms (Gallagher Gallagher Cloud, Openpath, Brivo) host the management software and cardholder database in the vendor's cloud. Controllers connect to the cloud over the internet rather than to an on-premise server. Cloud-based systems eliminate server hardware procurement, server room space, and IT administration for the access control server itself.

For Bangladesh enterprises, cloud-based access control introduces considerations around data sovereignty: cardholder data (including biometric templates, if used) is stored on servers outside Bangladesh. Evaluate whether this is compatible with your PDPO 2025 obligations and your organisation's data governance policy before committing to a cloud platform. Where local data residency is required, on-premise architecture remains the appropriate choice.

4.3 Panel Capacity Planning

Calculate the number of door controllers required: divide total door count by reader ports per controller (typically 2 or 4). Add 20% spare capacity for future expansion. For a 100-door building using 4-door controllers: 100 ÷ 4 = 25 controllers + 5 spare slots = 30 controllers ordered (25 deployed, 5 held as spares or designated for expansion).

Calculate network switch port requirements: each controller requires 1 Ethernet port. Co-locate controller-serving switches with power distribution (UPS) to ensure controllers remain powered during mains outage. Controllers require 12–24 V DC power; PoE is available on IP controllers but confirm power budget against switch PoE capacity.

Chapter 5: Integration Design

5.1 CCTV Integration

The most operationally valuable integration in a security system is access control to CCTV: when a door event occurs (valid access, denied access, door forced open), the VMS automatically retrieves and presents the camera footage from the associated camera at that door, at that moment.

This integration transforms investigation speed. Instead of an operator manually navigating to the right camera and scrubbing through footage to find the time of interest, the VMS presents the footage instantly when the operator clicks on the access event. Investigation time drops from 10–15 minutes to under 30 seconds for routine queries.

Configure camera-to-door mapping in both the access control system and the VMS. When a door forced-open alarm activates, the integration should: (a) trigger continuous recording on the associated camera, (b) pop up the camera feed on the monitoring workstation, and (c) log the event in both the access control and VMS event logs with cross-reference timestamps.

Supported integration platforms include Milestone XProtect with Gallagher and ZKTeco integrations, Genetec Security Center with native access control, and Hikvision HikCentral with its own access control module.

5.2 Alarm System Integration

Access control integrates with intrusion alarm systems to enable automated lockdown responses. Define lockdown triggers — for example, activation of a panic alarm, triggering of a perimeter intrusion zone, or manual lockdown command from the security console — and configure the access control system to respond by:

• Locking all non-emergency egress doors to Zone 2 and Zone 3
• Granting automatic egress through designated emergency exit routes
• Alerting all security workstations with a lockdown notification
• Logging the lockdown event with time stamp for audit purposes

Lockdown capabilities are required by Bangladesh Bank ICT Security Guideline v4.0 for banking facilities and are a standard feature specification for government and military facilities.

5.3 HR System and Time & Attendance Integration

Access control cardholder data must remain synchronised with the HR system to avoid the security gap of departed employees retaining active credentials. Implement a real-time or daily automated synchronisation between the HR system (Oracle HCM, SAP HCM, local payroll systems common in Bangladesh manufacturing sector) and the access control platform.

When an employee record is marked as terminated in HR, the access control system automatically deactivates their credential within the configured sync interval — ideally within minutes for sensitive environments. This eliminates the manual de-provisioning step that is routinely forgotten in manual processes, leaving departed employees with active building access for days or weeks after termination.

Time and attendance (T&A) reporting uses access control door swipe data to calculate working hours, replacing manual attendance registers. T&A reporting is a significant efficiency benefit for RMG factories (which must comply with BGMEA attendance reporting requirements), manufacturing facilities, and large commercial offices. The access control T&A module generates reports compatible with payroll systems and produces the audit trails required for BGMEA, RSC, and Accord compliance inspections.

Chapter 6: Bangladesh Compliance Design

6.1 Bangladesh Bank ICT Security Guideline v4.0

Bangladesh Bank's ICT Security Guideline version 4.0 specifies physical security requirements for all scheduled banks and financial institutions. Key access control requirements include:

• Multi-factor authentication for access to server rooms, network equipment rooms, and vault areas
• Access control event logging with a minimum retention period of 1 year
• CCTV integration at all access-controlled entry points
• Dual-person integrity for cash vault access (two authorised people required to unlock)
• Regular access rights review (minimum quarterly) to identify and remove unnecessary privileges
• Immediate credential deactivation upon employee termination

SSAL's banking sector access control designs incorporate all BB ICT Guideline v4.0 requirements by default, with compliance documentation provided at handover demonstrating how each requirement is addressed by the installed system.

6.2 PDPO 2025 for Biometric Access Control

PDPO 2025 imposes specific obligations on organisations processing biometric data in Bangladesh:

Consent requirement: Employees must provide explicit, informed consent for biometric data collection. The consent notice must explain what data is collected, how it is stored, how long it is retained, and who has access to it. Providing an alternative non-biometric access method (card + PIN) for employees who decline biometric enrolment is considered best practice.

Template storage, not image storage: Store the mathematical template derived from the biometric scan, not the original fingerprint image or face photograph. Templates are one-way: they cannot be reverse-processed to recreate the original biometric. This principle minimises data risk if a breach occurs.

Data retention limits: Delete biometric templates when the employee leaves the organisation. Implement automated deletion linked to the HR system termination workflow.

Data breach notification: Under PDPO 2025, organisations must notify the Bangladesh ICT Division and affected individuals within 72 hours of discovering a biometric data breach. Ensure your access control system has audit logging sufficient to determine the scope of any breach.

Chapter 7: Installation and Cabling

7.1 RS-485 Wiring

RS-485 is a legacy serial communication protocol used by older access control panels to connect readers to controllers. RS-485 panels use 2-wire (or 4-wire) shielded twisted pair cable (typically 22 AWG or 24 AWG). Maximum RS-485 cable run is 1,200 metres, but keep individual runs below 300 metres for reliable operation.

RS-485 is still deployed in many existing systems and in cost-sensitive applications. Its limitation compared to OSDP (see 7.2) is one-way communication (reader sends data to controller only) and no encryption, making it vulnerable to interception and relay attacks.

7.2 OSDP (Open Supervised Device Protocol)

OSDP is the modern standard for reader-to-controller communication. OSDP provides bidirectional communication (reader and controller exchange data), encrypted communication (AES-128), and tamper detection (the controller detects if the cable is cut or the reader is removed). OSDP readers can receive configuration updates from the controller, enabling centralised management of reader settings.

All new SSAL enterprise access control installations use OSDP readers and OSDP-capable controllers. The incremental hardware cost is minimal; the security and management benefits are substantial. Specify OSDP compliance in your reader and controller RFQ.

7.3 PoE for IP Controllers

IP-based controllers receive both data and power over a single Cat6 cable from a PoE switch. This eliminates the separate 12V power supply wiring required by RS-485 controllers and simplifies installation significantly. Ensure your PoE switch PoE budget accommodates both camera PoE (from Chapter 4 of the CCTV guide) and access control device PoE on shared infrastructure.

Dedicate separate PoE switches to access control and CCTV, connected on the same VLAN-segmented network infrastructure but with separate physical switches. This ensures that a PoE budget overload from cameras does not compromise door controller power.

Chapter 8: Commissioning, Testing and Training

8.1 Access Control Commissioning Protocol

For each access-controlled door:

1. Verify controller power and network connectivity
2. Enrol test credential and verify grant/deny logic for all configured time zones
3. Test door hardware: electric strike or maglock operation, door closer function, REX device operation
4. Test held-open alarm: hold door open beyond the configured alarm time and verify alert is generated
5. Test forced-door alarm: forcibly open door without valid credential and verify alert
6. Test anti-passback (if configured): attempt to re-enter a zone using the same credential before exit and verify denial
7. Verify integration with CCTV: generate an access event and confirm VMS retrieves associated camera footage
8. Document all results in the commissioning record

8.2 System Administration Training

Provide comprehensive training for the following roles:

Security Manager (4 hours): Cardholder enrolment and management, access right assignment, time zone configuration, report generation (access logs, exception reports), alarm response and lockdown procedures, system health monitoring.

IT Administrator (2 hours): Server health monitoring, database backup procedures, firmware update process, network troubleshooting, credential backup and recovery.

HR Coordinator (1 hour): Employee on-boarding credential issuance process, employee off-boarding deactivation procedure, visitor credential management, lost card process.

Conclusion

Enterprise access control, designed and implemented correctly, functions as the central nervous system of your physical security operation. It knows who is in which zone at every moment, generates the evidence trail for every security event, integrates with CCTV to provide instant video context for every access decision, and connects with HR to maintain a current, accurate picture of who belongs in your building.

Bangladesh's regulatory environment — particularly Bangladesh Bank ICT Security Guideline v4.0 for financial institutions and PDPO 2025 for all biometric data processing — makes professional, documented access control design a compliance necessity, not just an operational benefit. A properly designed and documented system demonstrates regulatory due diligence in inspections, audits, and incident investigations.

SSAL designs and delivers enterprise access control systems using ZKTeco, Gallagher, HID, and Honeywell platforms, with integration expertise spanning Milestone, Genetec, and Hikvision VMS platforms and Oracle, SAP, and local HRMS systems used across Bangladesh's corporate sector.

About SSAL

Smart Safety & Automations Ltd. (SSAL) is Bangladesh's leading enterprise security solutions provider, delivering access control systems from single-door offices to 1,000-door campus deployments. Our certified access control engineers design systems that comply with Bangladesh Bank ICT Security Guideline v4.0 and PDPO 2025, and we provide comprehensive commissioning, operator training, and AMC support for every installation.

Start your access control design consultation today.

• Website: www.smartsafety.com.bd
• CTA: [Get Free Consultation] [Talk to Our Expert] [Request a Quote]