Introduction to Physical Access Control Systems (PACS)

Learn how physical access control systems regulate entry, including PACS components, controllers, readers, RFID credentials, locks, authorization rules, logging, and PACS versus LACS.

What Is a Physical Access Control System?

A Physical Access Control System (PACS) is an electronic system that regulates entry to physical locations. It protects buildings, rooms, controlled areas, and other physical entry points by deciding whether a person may pass through a door or barrier.

PACS deployments are common in offices, industrial sites, government and defense facilities, residential properties, storage areas, warehouses, and sensitive technical rooms such as server rooms.

The basic decision is straightforward: a person presents a credential, the system evaluates whether that credential is authorized for the requested location and time, and the entry point either remains secured or is temporarily released.

PACS Versus Logical Access Control

Physical access control and logical access control both protect resources, but they protect different kinds of resources.

Characteristic	Physical access control	Logical access control
What it protects	Buildings, rooms, doors, gates, and other physical areas	Accounts, operating systems, applications, networks, and digital resources
Typical request	A person presents a card at a secured door	A user enters a username and password to sign in
Decision result	An electric strike or electromagnetic lock releases, or remains secured	A system grants or denies access to a computing resource
Common record	Door, credential, time, and access result	Account, system, time, and authentication result

A card reader granting entry to an office is an example of PACS. A username and password granting access to a workstation is an example of a Logical Access Control System (LACS). In practice, organizations often use both: physical access protects the room containing computers, while logical access protects the computers and data inside it.

Benefits of Physical Access Control

Restricted entry: Access can be limited to defined locations based on identity, role, and authorization.
Accountability: Activity and transaction records can show attempted, granted, and denied entry.
Flexible administration: Administrators can change users, permissions, schedules, and doors without rekeying every lock.
Fast revocation: A missing, stolen, expired, or former employee credential can be disabled quickly.
Different privilege levels: Employees, visitors, contractors, supervisors, and administrators can receive different access.
Scheduled operation: Doors can automatically unlock during defined periods and return to a secured state afterward.

For example, an administrator can disable a lost employee card without replacing the lock on every door that the card could open.

Core PACS Architecture

An access point is the controlled entry location, commonly a door. A typical controlled doorway includes a reader, controller, credential, locking hardware, management software, communications connections, and power.

Component	Primary role	Examples	Relationship to the access decision
Access point	Physical location where access is requested	Office door, server-room door, gate	Defines the location being protected
Credential	Evidence presented by a user	Card, fob, PIN, mobile credential, fingerprint	Provides data for identification or authentication
Reader	Captures credential data	RFID reader, keypad, fingerprint reader	Sends captured data to the controller
Controller	Applies access rules and controls outputs	Single-door or multi-door controller	Grants or denies the request
Locking hardware	Maintains or releases the physical barrier	Electric strike, electromagnetic lock	Acts on the controller's release command
Management software	Administers users, permissions, doors, schedules, and reports	Central access-control workstation or server	Supplies configuration and displays events
Communications	Connects readers, controllers, and management systems	Wired network or controller bus	Carries credential data, commands, and events
Power	Supplies electronic components and locks	Power supply, battery backup	Enables normal operation and affects power-loss behavior

Small installations may use a standalone controller with limited administration. Larger deployments centrally manage many doors from management software. A controller may manage multiple access points, with a small controller often supporting several doors.

The Access Control Controller

The access control controller is the decision-making device that links readers, locks, and management software. It receives credential data from a reader, checks stored authorization rules, and sends a release command when access is permitted.

If authorization fails, the controller does not send the release command. The lock remains in its normal secured state, and the failed attempt can be recorded in the event log.

Controllers commonly store local copies of credentials, access groups, schedules, and door settings. This local memory allows a door to continue applying stored rules when the central management workstation or network connection is unavailable. Changes made centrally may not take effect at the door until communications are restored and synchronization occurs.

Controller configuration can include:

User permissions and credential status
Access groups
Time schedules
Door modes
Automatic locking and unlocking
Release duration
Event and communication monitoring

Readers, Credentials, and Authentication

A reader is installed at an access point and collects authentication data. Common methods include cards or RFID credentials, PIN entry, and biometrics such as fingerprints.

Method	Example credential	Typical reader or input device	Key consideration
Card or RFID	Contactless card or key fob	RFID or proximity reader	Evaluate credential security, duplication resistance, and management practices
PIN	Personal numeric code	Keypad	Protect the code from observation and avoid shared credentials
Biometric	Fingerprint	Fingerprint reader	Consider enrollment quality, privacy, matching accuracy, and fallback procedures

Identification is the claim of who or what a credential represents. Authentication is the process of checking that evidence. Authorization is the later decision about whether the authenticated credential may use a specific door at a specific time.

For example, a reader may identify card number 1042. The controller then checks whether that card is active, whether its user belongs to an appropriate access group, whether the requested door is included, and whether the current time is permitted. Reader-to-controller communication carries the credential data and the resulting control instructions.

RFID Credential Technologies

RFID, or radio-frequency identification, uses radio communication to read contactless cards or fobs.

125 kHz RFID

Low-frequency 125 kHz RFID is a legacy technology commonly associated with older proximity credentials. Many older formats provide limited protection against credential copying or unauthorized reading. Their security should be evaluated carefully before being selected for a new deployment.

13.56 MHz RFID

13.56 MHz is a higher-frequency RFID range used by several contactless credential technologies. Some technologies in this family support more capable card-reader communication and stronger security features.

Frequency alone does not guarantee encryption or security. The actual protection depends on the specific credential technology, cryptography, credential configuration, reader configuration, and key-management practices. New systems should select modern, secure credential technologies rather than relying only on legacy proximity cards.

Locks and Door-Release Hardware

Locks are the physical barrier controlled by the PACS. Common electronically controlled methods include electric strikes and electromagnetic locks.

Lock type	Basic operation	Typical location or use	Safety and power-loss consideration
Electric strike	An electrically operated door-frame component releases the latch when authorized	Doors using a mechanical latch and compatible frame hardware	Verify power, latch alignment, release duration, and required egress behavior
Electromagnetic lock	Electromagnetic force holds the door closed	Doors designed for an electromagnetic locking assembly	Power loss may release the lock; emergency egress and life-safety controls are essential

Locking hardware is mounted on the door, frame, or associated door hardware and is wired to the controller or a power interface. After a permitted decision, the controller causes a temporary release or unlock action.

Fail-safe describes a lock behavior that releases when power is lost, subject to safety and security requirements. Fail-secure describes a lock behavior that remains secured when power is lost, also subject to required egress provisions. The correct choice depends on the building, emergency-escape requirements, fire and life-safety codes, and the security risk. Never select or repair locking hardware without considering safe emergency exit.

Management Software

Access-control software is the administrative layer for larger or centrally managed systems. It commonly supports:

Credential enrollment and disabling
User administration
Access-group and permission assignment
Door configuration
Schedules and automatic door modes
Live event monitoring
Reports and investigations
Operator roles with different administrative permissions

A small system may operate with little or no central management software. This can reduce cost and complexity, but it also reduces centralized administration, reporting, and oversight.

Central software normally distributes rules to controllers and receives events from them. The controller may continue operating independently from locally stored rules during a communications interruption. However, administrators should verify how the particular system handles new credentials, revoked credentials, schedule changes, and queued events during an outage.

Authorization Rules and Access Policies

Authorization can depend on the credential holder, requested door, access group, date, and permitted time period. An access group is a reusable set of permissions that assigns people access to selected doors and schedules. An access schedule defines when a credential or group may use an access point.

For example, warehouse staff may use a loading-area door only during assigned shifts, while supervisors have broader access. IT administrators may be allowed into a server room during weekdays from 07:00 to 19:00, while general employees may enter the main office but are denied at the server-room door.

Least privilege in physical security means granting only the doors and times required for a person's role. It limits the impact of a compromised credential and makes access decisions easier to review.

access_group: IT Administrators
authorized_doors: Main Office, Server Room
schedule: Weekdays 07:00-19:00
credential_status: Active
denied_behavior: Keep door secured and create an access-denied event

Doors can also have automatic states independent of an individual credential. For example, a reception entrance may be unlocked on weekdays from 08:00 to 17:00 and return to a secured state afterward. The system should record both the scheduled unlock and the return to secured operation.

End-to-End PACS Operation

Consider a basic controlled door using a card reader, controller, and electric strike:

A user presents a card to the reader.
The reader captures the credential data.
The reader sends the data to the controller.
The controller checks locally stored rules or rules supplied by the central system.
The controller evaluates credential status, user or group permissions, door permissions, and the current schedule.
If the request is authorized, the controller activates its output for the configured release period.
The electric strike releases the door latch temporarily.
If the request is denied, the controller leaves the lock secured.
The system records the result and relevant door activity in an event log.

Presented credential	Door and schedule condition	Controller decision	Lock action	Event recorded
Active IT administrator card	Server room, within permitted hours	Granted	Electric strike releases temporarily	Access granted
Active general employee card	Server room, during business hours	Denied	Door remains secured	Access denied
Expired contractor card	Any controlled door	Denied	Door remains secured	Expired credential or access denied
Active warehouse staff card	Loading door, outside assigned shift	Denied	Door remains secured	Outside schedule

Event Logs, Reporting, and Accountability

An event log records system events such as access granted, access denied, door unlocked, door returned to secured state, communication loss, and operator actions. Reports can show attempted or granted entry activity by credential, person, door, date, and time.

These records support auditing, investigations, operational oversight, and accountability. For example, a security team can review who attempted to enter a server room, whether access was granted, and whether a controller lost communication at the same time.

PACS may integrate with time-and-attendance systems. An access event can be used as an input to an attendance workflow, but an entry event is not automatically equivalent to time worked or a payroll-approved attendance record. Organizations must define the applicable attendance policy and handle exceptions such as tailgating, off-site work, breaks, and multiple entries.

See A Short Introduction to Time and Attendance Systems for related concepts.

Typical PACS Administration Workflow

Enroll the credential.
Assign the user to an access group.
Associate the group with permitted doors and schedules.
Distribute the credential securely.
Review event records and investigate unusual activity.
Disable the credential when it is lost, expired, or no longer required.

Troubleshooting Common PACS Problems

A valid employee card is denied

Verify that the credential is active and correctly enrolled.
Confirm that the person belongs to an access group allowed at that door.
Check whether the attempt occurred within the permitted schedule.
Review controller and software event logs for the denial reason.
Confirm reader-to-controller communication and rule synchronization.

The reader detects a credential, but the door does not release

Determine whether the controller recorded an access-granted event.
Check the controller output and wiring to the electric strike or electromagnetic lock.
Verify lock power and mechanical door alignment.
Confirm that the configured release duration is appropriate.
Ensure that repairs have not bypassed door hardware, egress controls, or life-safety requirements.

Management software cannot reach a controller

Check network or communications connections and controller power.
Determine whether the controller is still operating from local stored rules.
Review communication-loss events.
Confirm that centrally made changes will synchronize after connectivity is restored.

A lost card may still be usable

Immediately change the credential status to disabled or revoked.
Confirm that the update has reached the applicable controller.
Review recent events for use of that credential.
Issue a replacement credential with appropriate permissions.

A door is in the wrong locked state

Review the configured door schedule and system time settings.
Check manual override, emergency, and maintenance states.
Verify the lock type and configured power-loss behavior.
Investigate recent operator actions and relevant event logs.

Exam-Relevant Summary

PACS controls entry to physical spaces; LACS controls access to digital resources.
The reader collects credential data, while the controller applies authorization rules.
Authentication and authorization are different: proving or presenting a credential does not automatically grant permission.
A controller can often continue using locally stored rules when central management software is unavailable.
125 kHz credentials are commonly legacy proximity technologies; 13.56 MHz technologies may provide more capable communication, but frequency alone does not prove security.
Electric strikes and electromagnetic locks are common electronic locking methods.
Fail-safe and fail-secure behavior must be evaluated with life-safety and emergency-egress requirements.
Event logs provide useful evidence for auditing and investigations.
Least privilege means assigning only the doors and time periods needed for a person's role.

For related physical-security foundations, see A Short Introduction To Alarm Systems and A Short Introduction To IP Video Surveillance.