VMware ESXi and vSphere Cluster Management

Introduction to Physical Access Control Systems (PACS)

Learn how physical access control systems use credentials, readers, controllers, locks, software, and audit trails to manage entry to secured locations.

A Physical Access Control System (PACS) electronically manages entry to physical locations. It determines whether a person may enter a building, room, site, warehouse, server room, or another restricted area.

PACS commonly uses an electronic credential, such as a card, PIN, mobile credential, or fingerprint. A reader captures the credential, a controller evaluates the access rules, and electrically controlled locking hardware either releases or continues securing the door.

Organizations use PACS to restrict entry, assign different permissions to different people, record access activity, and change authorization without replacing mechanical locks. PACS are found in businesses, sensitive facilities, warehouses, residential properties, laboratories, schools, and data centers.

What Is a PACS?

A PACS is a coordinated combination of hardware and software that controls physical access points. An access point is a controlled entry location, usually a door, where a person requests entry.

The system performs two related tasks:

Authentication: It examines evidence presented by the user, such as a card, PIN, or fingerprint, to identify or verify the credential holder.
Authorization: It checks whether that person or credential is permitted to use a particular door at that time.

If the request is authorized, the controller commands the lock to release for a configured period. If the request is unauthorized, the door remains secured. Both successful and unsuccessful attempts can be recorded in an audit trail.

PACS Versus Logical Access Control

Physical access control protects spaces and entry points. Logical access control protects digital resources, including operating-system accounts, applications, databases, networks, and computer systems.

Category	PACS	LACS
Protects	Buildings, rooms, gates, doors, and other physical areas	Accounts, applications, files, networks, and computing resources
Typical credential	Access card, PIN, mobile credential, or fingerprint	Password, security key, certificate, or software token
Decision result	Releases or keeps a physical lock secured	Allows or denies use of a digital resource
Example	Permitting an IT employee into a server room	Permitting that employee to sign in to a server account

PACS and logical access controls can coexist in a broader security program. For example, an organization may require both entry to a server room and a separate authenticated account to administer a server. Controlling the room does not automatically authorize use of the systems inside it.

Benefits of Electronic Physical Access Control

Precise restrictions: Access can be limited to specific doors, areas, days, and time periods.
Accountability: Entry, exit, granted requests, denied attempts, and system events can create a useful activity history.
Fast credential revocation: A lost or stolen card can be disabled without changing every mechanical lock.
Centralized administration: Operators can manage users, roles, doors, schedules, and reports from a host computer or server.
Flexible changes: Permissions can be adjusted when someone changes jobs, leaves the organization, or needs temporary access.
Investigation support: Audit records can help establish who attempted to access a location and when.
Operational reporting: Reports can show denied attempts, door status, unusual activity, and other events.

Core PACS Components

Component	Primary function	Typical location	Relationship to other components
Access control controller	Applies rules and controls the lock	Secure equipment cabinet or electrical room	Connects readers, locks, sensors, and management software
Credential reader	Captures card, PIN, or biometric data	Beside the controlled door	Sends credential data to the controller
Credential	Provides evidence used to authenticate a user	Carried or presented by the user	Is evaluated by the reader and controller
Locking hardware	Creates or releases the physical barrier	Door, frame, or gate	Receives an electrical command from the controller
Management software	Manages users, permissions, schedules, doors, and reports	Host computer or server	Transfers configuration and retrieves events from controllers
Communications links	Carry data between system components	Cabling or network infrastructure	Connect readers and controllers to each other and to management software
Power and backup	Supplies operating power and continuity during outages	Power supplies, batteries, and equipment cabinets	Keeps controllers, readers, and locks operating according to policy

Access Control Controller

The access control controller is the device that connects readers, locking hardware, and management software. It receives credential data from a reader, checks the credential against authorized users and permissions, and sends an unlock command when the request is allowed.

When access is denied, the controller maintains the locked state. It can also apply access schedules, user permissions, automatic lock and unlock rules, and other door policies.

Controllers often support multiple doors through separate door channels or ports. A small controller may manage a few doors, while larger systems use multiple controllers across a site. The exact capacity depends on the equipment and design.

Offline operation

Many controllers store credentials, permissions, and schedules in local memory. If communication with the host computer or management server is interrupted, the controller may continue making decisions locally. This is called offline operation.

Offline behavior must be designed deliberately. The controller should apply its locally stored rules, record events locally, and synchronize those events when communication returns. It cannot apply a permission change that it has not received, so administrators should confirm synchronization after restoring connectivity.

Readers and Authentication Methods

A reader is installed at or near a controlled door. It captures a credential and forwards the relevant information to the controller. The reader generally gathers the input; the controller normally makes the authorization decision.

Method	Example credential	Advantages	Considerations
Card-based	RFID card, key fob, or mobile credential	Fast and convenient; easy to issue and revoke	Cards can be lost, shared, or copied depending on the technology
PIN-based	Personal identification number entered on a keypad	Does not require a physical card	PINs can be observed, shared, guessed, or reused
Biometric	Fingerprint recognition	Uses a characteristic associated with the person	Requires privacy controls, enrollment, suitable sensors, and careful handling of false matches or rejections
Multi-factor	Card plus PIN or biometric	Combines different evidence types and can increase assurance	More expensive and sometimes less convenient

Choose an authentication method according to security requirements, usability, environmental conditions, privacy expectations, and risk. A higher-security area may require two factors rather than a card alone.

RFID Credential Technologies

RFID, or radio-frequency identification, uses radio communication between a reader and a credential. Contactless cards and key fobs are common RFID credentials.

Technology category	Frequency	Typical characteristics	Security considerations
Low-frequency proximity	125 kHz	Common in older proximity cards and simple identification systems	Many older implementations provide limited protection and may be susceptible to copying or credential emulation
Contactless smart card	13.56 MHz	Supports two-way reader-card communication and can provide more advanced functions	Modern implementations may use encryption and stronger authentication; the specific product and configuration still matter

Older 125 kHz credentials often provide little or no cryptographic protection. A reader may simply receive an identifier and pass it to the controller. Modern 13.56 MHz smart-card systems can support two-way communication, encryption, and stronger credential security.

Frequency alone does not guarantee security. The credential protocol, key management, reader configuration, and system design determine the practical resistance to cloning and unauthorized use. Credential technology selection is therefore an important PACS security decision.

Electronic Locks

Locks are the physical barrier controlled by the PACS. They translate the controller's authorization decision into physical entry.

Electromagnetic lock: An electrically powered device that uses magnetic force to hold a door closed. It is commonly mounted on the door and frame.
Electric strike: An electrically controlled component installed in the door frame. When authorized, it releases the latch so the door can open.

The lock connects to a controller output, usually through appropriate power and control wiring. Correct selection and installation must consider the door type, frame, fire and life-safety requirements, egress rules, and the required behavior during power loss. Locking hardware can fail because of power problems, wiring errors, mechanical misalignment, or a damaged latch even when the controller has approved access.

Access Control Management Software

Management software provides centralized administration for many PACS installations. Common functions include:

Credential enrollment and credential revocation
User, role, and permission management
Door, reader, and schedule management
Monitoring of events and door states
Reports for granted and denied access
Multiple operator accounts with different permission levels

The software usually runs on a host computer or server and communicates with controllers over a network or other communications link. Smaller installations may use a local controller, standalone reader, or limited configuration tool without full management software. This can reduce cost and complexity, but it also reduces centralized administration, reporting, and ease of making organization-wide changes.

Conceptual user access assignment

User identity: Jordan Lee
Assigned credential: RFID card 004821
User group or role: IT support
Authorized doors or areas: Main entrance; server room
Access schedule: Monday-Friday, 08:00-18:00
Credential status: Active

Conceptual door configuration

Associated reader: Server-room reader
Associated locking hardware: Electric strike
Controller port or door channel: Controller 2, Door 1
Unlock duration: 5 seconds
Normal schedule state: Locked
Automatic schedule: Unlock 08:00; relock 18:00

How a PACS Access Decision Works

The user presents a credential at the reader.
The reader captures the card, PIN, biometric, or other credential data.
The reader transmits the data to the access control controller.
The controller evaluates the identity or credential, door permission, user group, credential status, and applicable time rules.
If authorized, the controller activates the locking hardware for the configured unlock duration.
If unauthorized, the controller leaves the door secured.
The controller records the event and sends it to management software when communications are available.

Credential status	Schedule status	Controller decision	Door result	Event record
Active and authorized	Within allowed period	Grant	Lock releases temporarily	Granted access recorded
Active but not authorized for this door	Within allowed period	Deny	Door remains secured	Denied attempt recorded
Active and authorized	Outside allowed period	Deny	Door remains secured	Denied attempt recorded
Disabled or revoked	Any	Deny	Door remains secured	Denied attempt recorded

If management software is unavailable but the controller remains powered and operational, the controller can use locally stored permissions and schedules. Events may remain in local memory until the connection is restored, after which they should synchronize with the host system.

Permissions, Schedules, and Door States

Administrators assign access rights by person or group. A permission can specify which doors or areas a user may access and when that access is valid.

Employees may access common areas during normal working hours.
IT personnel may access a server room during assigned support hours.
Visitors may receive temporary access to a lobby but not restricted work areas.
Warehouse workers may enter loading and inventory zones during their shifts.
Automatic schedules may unlock a door for a public period and relock it afterward.

Door state rules should be documented clearly. A normal state may be locked, while a schedule can temporarily change the state. Automatic relock behavior, unlock duration, and the response to a power failure should be tested as part of system commissioning.

Reporting and Accountability

An audit trail is a recorded history of access attempts and system events. PACS reports may include:

Granted access attempts
Denied access attempts
Credential enrollment, changes, and revocation
Door forced-open or held-open events, where sensors are installed
Controller communication and power events
Operator actions in management software

These records can help determine who accessed a location and when. They support operational reporting, incident investigation, maintenance analysis, and policy review. Organizations should define retention, privacy, and access rules for these records because access logs can contain sensitive information.

Integration With Time and Attendance

Some organizations use access events alongside workforce attendance functions. For example, a designated entrance reader may provide events to a time-and-attendance process. Shared credentials or readers may be used where the system supports that design.

Security access records and attendance records are not automatically equivalent. A door event may show that a credential was used, but it does not always prove that the credential holder performed work or remained on site. Attendance policies, labor requirements, privacy rules, and organizational procedures should determine how access data is interpreted.

Practical PACS Examples

Server room restriction

Only authorized IT personnel receive permission to enter a server room. Their credentials work at the server-room door and only during assigned support hours. Other employees may enter the office but receive a denial at the server-room reader.

Warehouse access

Warehouse employees can enter loading areas during their shifts. Office staff can enter common areas but cannot enter inventory storage zones. The controller applies different door permissions and schedules to the two groups.

Lost employee card

An employee reports a lost RFID card. An administrator revokes the credential in management software and confirms that the controller has received the updated authorization list. The card can no longer unlock its assigned doors, so replacing every physical lock is unnecessary.

Electric-strike door

A user presents a credential to a reader. The controller validates the request and, if approved, activates the electric strike. The strike releases the latch, allowing the door to open for the configured duration.

Controller communication interruption

The connection to the management computer fails. The controller continues applying its locally stored authorized-card list and schedules. It records events locally and synchronizes them after communication is restored.

Troubleshooting PACS Problems

A valid user is denied access

Possible causes: The credential is disabled, expired, or not enrolled; the user lacks permission for the door; the request is outside the schedule; or reader-to-controller communication is failing.
Checks: Verify credential status, review permissions and schedules, inspect controller event records, and check reader and controller communications.

The system approves access but the door does not open

Possible causes: An electric strike or electromagnetic lock fault, a power problem, incorrect controller-to-lock wiring or configuration, or mechanical door and latch misalignment.
Checks: Confirm that the controller issued an unlock command, check lock power and cabling, inspect the door hardware, and verify unlock timing.

Management software cannot communicate with a controller

Possible causes: A network or host connection interruption, controller power failure, or incorrect communication settings.
Checks: Determine whether the controller is still processing locally stored permissions, verify power and network connectivity, review connection settings, and confirm event synchronization after recovery.

A lost card may still be usable

Possible causes: The credential was not disabled, the controller has not received the updated authorization list, or the credential technology is vulnerable to copying.
Checks: Revoke the credential immediately, confirm controller synchronization, and review whether stronger credential technology is appropriate.

Security and Reliability Considerations

Protect controllers and power supplies from unauthorized physical access.
Use strong operator authentication and least-privilege permissions in management software.
Maintain accurate user, role, schedule, and credential records.
Plan power backup for controllers, readers, network equipment, and locking hardware where continuity is required.
Define behavior during power loss and communications failure.
Review whether older RFID credentials provide sufficient cloning resistance for the protected area.
Test revocation, offline operation, event synchronization, door relock, and emergency procedures.
Coordinate lock selection with fire, life-safety, and emergency-egress requirements.

Key Exam Notes

A PACS controls physical spaces; a logical access control system controls digital resources.
The reader captures credential data, while the controller normally applies authorization rules and controls the lock.
Authentication identifies or verifies a credential holder; authorization determines whether access is permitted.
Offline operation means a controller can continue making decisions from locally stored permissions and schedules during host communication loss.
125 kHz is commonly associated with older low-frequency proximity credentials, while 13.56 MHz smart-card systems can support more advanced communication and encryption.
An audit trail records access attempts and system events for accountability and investigation.
Credential revocation disables authorization without requiring all physical locks to be replaced.

For a concise review, see this PACS introduction as a reference while studying components, workflows, and access decisions.