Legal Considerations in Access Control

Legal Considerations in Access Control Implementation

When implementing an access control system, there are important legal considerations that need to be taken into account. Adequate security of information and information systems is a fundamental responsibility for us. Access control plays a vital role in determining the activities allowed for legitimate users and mediating any attempts to access system resources.

In order to ensure the integrity of access control configurations, it is crucial to prevent unauthorized principles from gaining access to sensitive permissions.

This is where legal frameworks such as the General Data Protection Regulation (GDPR), Sarbanes-Oxley Act (SOX), Health Insurance Portability and Accountability Act (HIPAA), Gramm-Leach-Bliley Act (GLBA), Family Educational Rights and Privacy Act (FERPA), California Consumer Privacy Act (CCPA), and New York SHIELD Act come into play. These frameworks provide guidelines and requirements for the implementation of access control.

By adhering to these legal considerations, we can safeguard the privacy and security of data, ensure compliance with relevant regulations, and mitigate the risk of data breaches. In the following sections, we will explore specific compliance requirements related to GDPR, SOX, HIPAA, and the importance of access control in meeting these obligations.

For organizations operating in India, implementing access control requires compliance with a rapidly evolving legal landscape. The primary framework governing data security and access management is the Digital Personal Data Protection (DPDP) Act, 2023, supported by rules from the Indian Computer Emergency Response Team (CERT-In)

Core Door Components & Specifications

Locking Mechanism (Magnetic Lock / EM Lock): Use a minimum of 600 lbs (272 kg) holding force for internal doors, and 1200 lbs (544 kg) for perimeter doors. They must be wired as Fail-Safe (drops lock instantly when power cuts).

Egress Switch / Request to Exit (REX) Sensor: A PIR (Passive Infrared) motion sensor mounted on the secure inside frame. It automatically unlocks the door when someone approaches from the inside to exit.

Emergency Door Release (Break-Glass type (Green)): A physical manual override switch placed on the exit side of the door. Breaking the glass must physically cut power to the EM lock, bypassing all software or controller failures. Mount exactly adjacent to the door frame at 1.2 meters for easy reach during a fire evacuation.

Door Status Monitor (Magnetic Contact): A sensor that detects whether the door is physically open or closed. This is the hardware component that triggers the "Door Held Open Too Long" or "Forced Entry" alerts in your SOP.

Readers & Biometrics: Mount at 1.2 meters (4 feet) from the finished floor level. This complies with accessibility guidelines for differently-abled employees.

Access Management Software: While the physical locks and readers handle the hardware execution, the Access Management Software acts as the central brain of the entire door infrastructure. Without it, the hardware cannot enforce permissions, log events, or remain legally compliant.

1. Core Software Modules for Door Control

·        Credential Mapping Engine: Links an individual’s identity (Employee ID, Visitor Pass) to specific door controllers. It dictates who can open Door A but not Door B.

·        Time Zone & Access Level Manager: Restricts access by time. For example, standard employees can open doors from 9:00 AM to 6:00 PM, while the server room door requires 24/7 restriction.

·        Real-Time Event Viewer: Captures and displays active door states (e.g., "Door 01: Access Granted to User X" or "Door 04: Forced Entry Alert").

2. Software Configurations Required by Indian Law

Anti-Passback (APB) Engine (Prevention of Tailgating)

·        How it works: The software tracks the "In/Out" status of a credential. If a card is swiped at an entry reader, the software will block that same card from being used to enter again until it logs an exit swipe at the corresponding exit reader.

·        Legal Value: Prevents employees from passing their badge backward to let an unauthorized person into the facility, ensuring audit logs remain accurate for liability tracking.

Automated Data Lifecycle Management (DPDP Act Compliance)

·        Consent Flagging: The software user database must feature a mandatory checkbox or field indicating that biometric consent was explicitly captured.

·        Auto-Purge Rules: The system must be configured to automatically delete inactive user profiles (e.g., terminated employees or expired visitor profiles) from the local memory of the edge door controllers after a set period.

NTP Time Sync & Forensic Auditing (CERT-In Mandate)

·        Server-to-Controller Sync: The software must continuously broadcast the synchronized NIC/NPL network time down to every connected door controller panel.

·        Log Locking: Access logs stored within the software database must be configured as Read-Only / Append-Only. No administrator or security guard should have the software permissions to alter, edit, or delete a door access log event.

3. Hardware-Software Communication Security

·        Encrypted Protocols: The software must communicate with edge door controllers using encrypted protocols (like TLS 1.3 for network communication and OSDP - Open Supervised Device Protocol for the wiring between the reader and the door panel).

·        Legacy Risk: Avoid older Wiegand wiring configurations in your software setup, as Wiegand transmits card data in clear text, making it vulnerable to physical wire-tapping.

General Data Protection Regulation (GDPR) Compliance

The General Data Protection Regulation (GDPR) is a privacy regulation that safeguards the personal data of European Union (EU) citizens. As organizations collect and store personal data, it is crucial to prioritize customer awareness, consent, and data security to comply with the GDPR’s requirements.

When implementing an Identity and Access Management (IAM) solution for GDPR compliance, access management, access governance, authentication, and identity management should be key components. By incorporating these elements, organizations can effectively track access to personal data, manage access rights based on organizational changes and customer preferences, and empower consumers to exercise their rights to restrict data collection.

Key Considerations for GDPR Compliance:

1.   Customer Awareness: Organizations must inform individuals about the purpose and consequences of personal data collection, ensuring they are aware of their rights under the GDPR.

2.   Consent Management: Obtaining explicit and informed consent from individuals before collecting and processing their personal data is crucial for GDPR compliance.

3.   Data Security: Implementing robust security measures to protect personal data from unauthorized access, loss, or disclosure is essential.

4.   Access Management: Organizations should implement a comprehensive access management system to ensure that only authorized individuals can access personal data.

5.   Access Governance: Regularly reviewing and updating access rights based on organizational changes and customer preferences helps maintain compliance and prevent data breaches.

6.   Authentication: Implementing strong authentication mechanisms, such as multi-factor authentication, enhances security and strengthens GDPR compliance.

7.   Identity Management: Effective management of user identities and roles helps control access to personal data and maintain compliance with the GDPR.

By adhering to GDPR compliance requirements, organizations can demonstrate their commitment to data privacy and protection, fostering trust among their customers and avoiding potential legal consequences.

Sarbanes-Oxley Act (SOX) Compliance

The Sarbanes-Oxley Act (SOX) is a crucial legislation that aims to prevent corporate fraud and ensure the integrity of financial reporting for publicly-traded organizations, especially within the financial services sector. SOX compliance is of utmost importance to maintain data security and protect against financial malpractice.

For organizations to meet SOX compliance requirements, implementing robust IAM (Identity and Access Management) solutions is essential. These solutions enable centralized administration of access management and provide granular access controls, ensuring that only authorized personnel can access sensitive financial data.

Key Components for SOX Compliance:

1.   Centralized Administration: IAM solutions offer centralized administration, allowing organizations to efficiently manage user access rights and permissions.

2.   Separation of Duties (SoD) Policies: Implementing SoD policies ensures that no individual has complete control over financial reporting, minimizing the risk of fraudulent activities.

3.   Regular Auditing: Regular auditing helps to identify any potential access control gaps or vulnerabilities and ensures continuous compliance with SOX requirements.

4.   Logging and Tracking Tools: IAM solutions provide logging and tracking capabilities, allowing organizations to monitor user activity and track any unauthorized or suspicious access attempts.

5.   Granular Access Controls: IAM solutions enable organizations to define and enforce granular access controls, ensuring that users have appropriate access levels based on their roles and responsibilities.

By implementing IAM solutions for SOX compliance, organizations can significantly reduce the risk of data breaches and protect the integrity and security of their financial reporting processes.

Health Insurance Portability and Accountability Act (HIPAA) Compliance

HIPAA, the Health Insurance Portability and Accountability Act, plays a crucial role in protecting the privacy and security of protected health information (PHI) collected and stored by healthcare organizations. As healthcare data security becomes increasingly important, it is essential for organizations to implement robust IAM solutions that ensure HIPAA compliance.

An IAM solution designed for HIPAA compliance should prioritize credential protection, offering secure authentication methods to prevent unauthorized access. Additionally, the solution should provide multiple ways to onboard healthcare business partners, facilitating seamless collaboration while maintaining the integrity of PHI.

Centralized access governance is another critical component of HIPAA compliance. This ensures that access to protected health information is granted only to authorized healthcare providers, minimizing the risk of data breaches. Access logging and automated reporting mechanisms further enhance healthcare data security, allowing organizations to track and monitor access to patient records and generate comprehensive audit reports for HIPAA compliance purposes.

The DPDP Act, 2023 Compliance

·        Data Fiduciary Obligations: Organizations (Data Fiduciaries) must implement reasonable security safeguards to prevent personal data breaches, making strict logical and physical access controls a statutory mandate.

·        Purpose Limitation: Access to personal data must be strictly limited to the specific purpose for which the individual (Data Principal) gave consent.

·        Notice and Consent Management: Access control systems must integrate with consent management modules to dynamically revoke or grant employee access based on the user's current consent status.

·        Significant Data Fiduciaries (SDFs): If classified as an SDF by the government, your organization must appoint an independent Data Auditor to review your access logs and security frameworks regularly

CERT-In Cyber Security Directions

·        Mandatory Logs: Under the CERT-In directives, companies must securely maintain ICT system logs for a rolling period of 180 days.

·        Local Time Synchronization: All access control logs, server timelines, and identity management systems must connect to a standard time source using National Informatics Centre (NIC) or National Physical Laboratory (NPL) time servers to ensure legally defensible forensics.

·        Incident Reporting: Any unauthorized access that leads to a cyber incident or data breach must be reported to CERT-In within 6 hours of identification

Sector-Specific Regulations

·        Banking and Finance (RBI): The Reserve Bank of India mandates strict multi-factor authentication (MFA), role-based access control (RBAC) for core banking systems, and continuous privilege access management (PAM) monitoring.

·        Healthcare (DISHA / ABDM): Under the Ayushman Bharat Digital Mission, access to electronic health records requires patient consent, explicit digital signatures, and granular view-only permissions for medical practitioners.

Core Legal & Technical Principles

·        Principle of Least Privilege (PoLP): Users and devices must be given the minimum level of access required to perform their duties, preventing privilege creep and reducing the impact of a breach.

·        Identity and Access Management (IAM): Automating provisioning and deprovisioning is legally critical. Lingering access for former employees is one of the most common grounds for liability in negligence claims following a data breach.

·        Audit and Accountability: Legal defensibility requires undeniable proof of due diligence. Systems must log all access attempts, approvals, and denials, and keep this data secured against tampering

Legal Liabilities for Non-Compliance

·        Statutory Penalties: The DPDP Act penalises the failure to observe reasonable security safeguards to prevent data breaches with fines up to ₹250 Crore.

·        Criminal Liability: Section 66C (Identity Theft) and Section 66D (Cheating by Personation) of the Information Technology Act apply directly to individuals using stolen or unauthorized access credentials

Life Safety & Hardware Fail-Safe Integrity

·        Wire Fail-Safe Locks: Ensure all electromagnetic locks on emergency exit routes are wired as Fail-Safe (loss of power automatically cuts lock magnetism to open the door).

·        Integrate Fire Alarm Override: Connect the central Fire Alarm Control Panel (FACP) directly to the PACS power supplies via a physical relay. Triggering a fire alarm must cut power to all access-controlled exit doors instantly, independent of software status.

·        Install Break-Glass Units: Place green, emergency break-glass manual overrides next to every secured exit door along the evacuation route to bypass software crashes.

Emergency Response and Access Control

Emergency Response and Access Control 

When it comes to ensuring safety and effectively managing critical incidents, emergency response and access control are two crucial factors. Secure Entry Solutions understand the importance of integrated solutions that provide a seamless balance between the needs of visitors and staff, while maintaining secure zones and customizing security features to meet specific requirements.

With over 90,000 organizations already choosing Keri Systems for their security needs, our solutions offer comprehensive automation of day-to-day operations, multi-site management, and proactive emergency response capabilities.

By implementing our access control systems, organizations can enhance security and prevent disasters by effectively restricting access to sensitive equipment, tightly controlling access to high-value assets, and protecting sensitive data through integration with CCTV and anti-passback systems.

Our software package enables easy management of perimeter access control, threat-level activation, CCTV integration, and auditing. With our multi-site management capabilities, organizations can effortlessly manage security across multiple locations and compile access reports for investigative purposes.

At SSA INTEGRATE, we prioritize rapid emergency response and situational awareness. Our advanced notification systems provide crucial information and situational awareness to emergency responders, enabling them to take immediate action in critical situations. With the ability to grant specific access levels to different zones or buildings, organizations can effectively manage occupancy limits and protect sensitive information and equipment.

Our cloud-based security solution (Bravo Based), offers a powerful lockdown feature that can be initiated remotely, ensuring peace of mind and enhanced security. During a lockdown, first responders are still granted access permissions to enable them to respond effectively. Once the all-clear is given, only authorized administrators have the ability to clear the lockdown.

With comprehensive integrations across security, administrative, and identity solution ecosystems, Brivo makes it easier for organizations to manage their security needs efficiently and with confidence.

Secure Entry Solutions are committed to providing top-notch emergency response and access control solutions that prioritize safety and protect against critical incidents. Partner with us to ensure the utmost security for your organization.

Enhancing Security and Preventing Disasters

Keri Systems has developed robust access control systems specifically designed for emergency responders. Our access control systems offer a wide range of features that enhance security and prevent disasters. With these systems, organizations can efficiently manage access to sensitive equipment, tightly control entry to high-value areas, and protect sensitive data.

Restricting Access to Sensitive Equipment

• Our access control systems allow organizations to restrict access to sensitive equipment, such as fire-fighting gear, ensuring that only authorized personnel can access it.

Tightly Controlling Access to High-Value Areas

• With our systems, organizations can establish strict access control measures for high-value areas, minimizing the risk of unauthorized entry and theft of valuable equipment or weaponry.

Protecting Sensitive Data through Integration

• Our access control systems integrate with CCTV and anti-passback systems to provide enhanced data protection. This integration ensures that only authorized individuals can access sensitive data, reducing the risk of data breaches.

In addition to these features, Keri Systems provides a comprehensive software package that enables efficient management of access control. With our software, organizations can easily manage perimeter access control, activate threat-level protocols, integrate with CCTV systems, and generate audit reports.

Furthermore, our access control systems offer multi-site management capabilities, allowing organizations to effectively manage security across multiple sites. This feature streamlines security operations and provides a centralized platform for compiling access reports, facilitating investigative processes.

By choosing Keri Systems’ access control systems, organizations can enhance their security measures, prevent disasters, and protect sensitive equipment and data.

Rapid Emergency Response and Situational Awareness

Keri Systems understands the critical importance of rapid emergency response and situational awareness in ensuring the safety and security of organizations. Our advanced notification systems are designed to provide real-time updates and alerts to fire fighters and police officers, enabling them to respond swiftly and effectively to emergencies.

Advance Notifications

With our advanced notification systems, organizations can receive immediate alerts about critical incidents, such as unauthorized access attempts, fire alarms, or security breaches. These advance notifications allow emergency responders to have timely information, enabling them to make informed decisions and take appropriate actions.

Dual Verification

In emergency situations, every second counts. Our dual verification feature ensures an added layer of security by requiring users to authenticate their identity through multiple verification methods. This prevents unauthorized individuals from gaining access to restricted areas and enhances the overall security of the organization.

Access Levels

Organizations often have areas with varying levels of security clearance. With our access control systems, specific access levels can be assigned to different zones, areas, or buildings, ensuring that only authorized personnel can enter certain areas. This not only helps manage occupancy limits but also protects sensitive information and equipment from unauthorized access.

Multi-Site Capabilities

For organizations with multiple locations, our systems offer seamless multi-site management capabilities. This allows for centralized control, monitoring, and reporting across all sites, ensuring consistent security protocols and efficient emergency response coordination.

Occupancy Counting

Managing occupancy limits is crucial for maintaining a safe and secure environment, especially during emergencies. Our systems enable organizations to accurately monitor and track the number of people in specific areas in real-time. This information can be used to ensure compliance with occupancy regulations and aid emergency responders in making informed decisions based on accurate occupancy counts.

With the ability to integrate with other security systems and solutions, Keri Systems offers comprehensive emergency response support for organizations of all sizes. By leveraging our advanced notification systems, dual verification capabilities, access level management, multi-site capabilities, and occupancy counting features, organizations can enhance their emergency preparedness and ensure the safety and security of their premises.

Cloud-Based Security and Peace of Mind

When it comes to ensuring the safety and security of your organization, Brivo, a leading cloud-based security solution, offers a powerful lockdown feature that brings peace of mind to both administrators and first responders. With the ability to initiate a lockdown from anywhere using a laptop, phone app, or a hardwired button in the building, Brivo’s lockdown feature provides a quick and efficient response to potential threats.

During a lockdown, first responders are still granted access permissions, ensuring their ability to swiftly enter the premises and respond effectively. This feature allows them to carry out their critical duties without any unnecessary obstacles. Once the all-clear is given, authorized administrators have the ability to clear the lockdown, restoring normal operations securely and efficiently.

Brivo goes beyond just offering a lockdown feature. Their comprehensive integrations across security, administrative, and identity solution ecosystems provide organizations with a seamless experience in managing their security needs. The cloud-based nature of Brivo’s platform enables easy access and real-time updates, making it simpler than ever to monitor and control access to your facilities.

By leveraging Brivo’s cloud-based security and innovative integrations, organizations can benefit from enhanced security measures, streamlined access control, and increased flexibility. With Brivo, you can have the peace of mind knowing that your security system is reliable and up-to-date, allowing you to focus on what matters most – your business and the safety of your employees and assets.

Access Control Commissioning Checklist

Access Control Commissioning Checklist 

All customers are not knowledgeable to understand Access control system. When we are getting order it’s our responsibility to commissioned in proper way. In India maximum system integrator do not follow their own check list and as a result after few month call logging is started. Some call forward to OEM and System Integrator with customer’s blame on products are not good. But no one drilldown about commissioning report. Ultimately system integrator don’t know commissioning also a part of BOQ, yes they put importance only installation. I hope this checklist helps end users, integrators and consultants verify that access control installation and commissioning is complete. Take print edit as per your projects and fill all point. After that attached this with handover documents.

It covers the following sections:

• Door Hardware Checks
• Reader Checks
• Controller Checks
• Fire Alarm Loop Confirmation
• Backup Power Compliance
• RTE and 'Free Egress' Confirmation
• Door Timing Checks
• Turnstiles or Gate/Door Operator Checks
• Credential Enrolment
• Credential Issuance
• Database Migration
• Management Software User Creation
• Access Levels and Schedules
• Access Event Notifications
• Door Held Open / Forced Open Troubleshooting
• Anti-Passback Troubleshooting
• Mapping and Custom Reporting Creation
• Viewing Clients Installation 
• Integration with VMS and Other Systems
• Workstation Setup
• Network Setup
• Cable Verification

We recommend each person using this customize the list for their own needs / situations. There is no 'one size fits all' checklist but this list is meant to serve as a starting point to make it easier and quicker to build your own.

Door Locks and Hardware

This section covers commissioning of doors and opening locks, strikes, or other electro-mechanical hardware, including mounting and physical considerations.

Physical Operation, For every controlled opening:

• Check all lock / hardware fasteners or mounts are secure and without play, slack, or gaps exceeding tolerances on installation instructions.
• Ensure operation of lock is free of binding, grinding, or interference for door or frame features or other components.
• Close and open door, or operate several cycles, the opening to ensure that no binding or warping is affecting operation. 
• If Exit Devices are used, confirm appropriate 'Push to Exit' signage is displayed.
• If Door Closers or Operators are used, confirm electronic access devices do not interfere with operation.
• Confirm secure installation and function of Door Position Switches/ Contacts/ DPS.
• Weatherproof and lightly apply grease per specification to mechanical hardware like hinges
• Ensure any cabling or system wiring is hidden, tucked behind raceway or frames, and is not being pinched or cut by features like hinges.
• Confirm that accessibility clearances are satisfied and any additional access control devices comply with codes.
• If standalone, battery powered locks are used, confirm remaining battery life is strong and document commission date of batteries for future reference.

Door Controller Install Checks

• Confirm that all terminated wiring at controller is secured and terminated without short for each device.
• If kept in a metal enclosure, ensure panel tamper contacts and panel locks are used.  Gather panel keys for central, secure management.
• If controllers are located at the door, confirm they are installed on the secure/locked side of the opening and located behind a tamper-resistant or semi-obscured location, such as above tiles at the door.
• For wireless locks, confirm that all hubs or repeaters are clearly labeled as companions to the separate system readers or controllers.

Free Egress and Fire Alarm Loop Check

• Confirm that upon fire alarm activation, all door maglocks release and are not powered.
• Confirm that upon fire alarm activation, all emergency exit doors and openings can be freely opened and are not locked for any reason.
• Confirm that during normal operating conditions, all 'Request To Exit' devices are located in code compliant arrangements and function properly.
• Check that any delayed egress openings have specifically been approved by the AHJ, and delays do not exceed 15 seconds, unless specifically excepted by AHJ.
• Confirm that all Pushbutton style RTE switches are properly labeled and displayed per local code requirements, and directly interrupt power to locks and not controller, unless specifically excepted by AHJ.

Credential Reader Checks

• Confirm that reader device is securely anchored without gaps to the wall, frame, post, or bollard.  Seal or install trim guards where needed.
• Confirm 'normal operation' status lights are displayed per intended behavior. (On/Off/Red/Green/Blue, etc.)
• Confirm audible beep or siren registers when credential is read.
• Check that reader tamper device is connected and configured.
• If contactless type reader, present test card to confirm read range meets spec.  
• If biometric type reader, confirm unit positioning will not be interfered with by environmental features (ie: sun movement, HVAC downdrafts, etc)
• Confirm that accessibility clearances are satisfied and any additional access control devices comply with codes.

Credential Enrolment

• Confirm that the only credentials to be immediately carried/used by cardholders are activated, and no batched activation of unissued/ stored credentials is done.
• Check that each user issued a credential is accurately classified and identified in the access control software.  Include Picture ID images if possible.
• If credentials are being renewed or exchanged, confirm physical possession, disposal, and deactivation of old credential in system.
• If biometric credentials are enrolled, confirm multiple digits or templates are enrolled.
• If multi-factor credentials are issued, confirm that all factors are recorded, active, and valid in the system.

Access Management Software Servers

This section covers commissioning of Management Software servers and appliances, including both hardware/network setup as well as OS and software. Some of these items may not be used depending on OS and access platform. For example, appliances typically do not require OS updates. OEM to OEM process are slight different.

Access Management Software Configuration

• Configure Unlock, Extended unlock, Door Hold Open, and Relock event periods, as appropriate.
• Configure user access schedules (e.g., 24/7, 8am-5pm, off-hours, holidays, etc.)
• Configure user access levels (e.g., Managers, Workers, Visitors, Temporaries, etc.)
• Confirm Polling Interval, or settings update push duration as prompt and as close to real-time to be accurate as recorded in system.
• Configure any Maps or floorplans used to display and manage system control points.
• Confirm successful integration and configuration of features like 'Video Verification', or integration with video surveillance, intrusion, fire alarm, and intercom systems.
• Configure alarm or event notifications (email, text, etc.)
• Download and retain copies of all door/controller configurations
• Confirm any imported databases are clean and without problems if populating access management system.
• For 'Anti-Passback' rules, ensure that users will not unwittingly or inadvertently cause alarms if they use atypical or uncontrolled openings.

Hardware/Security

• Document MAC address(es) (often more than one if using multiple network cards), or if hosted/cloud access is used, document hostnames of all remote servers.
• Assign and document IP address(es) of every networked device, endpoint, or server.
• Apply latest OS updates (unless not recommended by manufacturer);
• Create secure admin password
• Create additional users as specified
• Test UPS operation and runtime (if supplied);

Network/Security Settings

• Document Controller and other ethernet-based devices MAC address;
• Assign and document Controller and other ethernet-based device IP address
• Update firmware to latest version (or manufacturer recommended/tested if different)
• Change Controller admin password from default
• Create multiple users if required (by specification or manufacturer recommendation)
• Set NTP server and verify time and date;
• Disable unused services/close unused ports (FTP, telnet, SSH, etc.);

General Server Settings

• Confirm any requisite services or policies are free to operate and will restore automatically after reboot events.
• Change access management admin password from default
• Create operator/user logins
• If LDAP or Active Directory is used, confirm valid implementation and provisioning of service.
• Confirm and document any external database connections or dependencies by the access software.

Workstations

This list involves client workstations, including hardware, OS, and access client setup and commissioning. Some of these steps may be omitted if appliances are used. OEM to OEM process are slight different.

• Document MAC address(es) of each workstation
• Assign and document IP address(es)
• Apply latest OS updates (unless not recommended by manufacturer)
• Create secure admin password
• Create additional users as specified
• If dongles or hardware keys are required for client access, document location of key on workstation (e.g., Port Location, Key Serial Number)

Network

This section outlines commissioning of network hardware, including switches, routers, firewalls, etc. Some of these devices may not be used in all systems, or managed by the installing integrator.

• Document MAC address(es) of each device
• Assign IP address and document
• Update switch/firewall/router firmware to latest version
• Change admin password from default
• Configure VLAN(s) as required; 
• Configure QoS as required;
• Disable unused switch ports as specified
• Configure SNMP monitoring if required;
• Configure MAC filtering if required
• Download and retain configuration for each switch
• Test UPS operation and runtime for each endpoint, if supplied

Cabling

This section covers commissioning of the access control cabling system, including labeling, supports, aesthetic concerns, and testing. OEM to OEM process are slight different.

• Label all cables, patch panels, wall outlets, etc., as specified
• Ensure cables are secured to supports (J-hooks, ceiling truss, etc.)
• Conceal cables where possible/required
• Leave properly coiled and dressed service loops at Controller or Switch location and head end as required;
• Test all terminations and document results as specified
• Document cable test results as specified (if certification is required)

 If need any expert comment on your projects we can help you free of cost over voice or text.