Commercial Access Control Systems: Components, Standards, Costs, and How to Choose

Commercial access control systems decide whether a credential can unlock a specific opening at a specific time, then record what happened. Choosing one starts with people, doors, permissions, egress conditions, and failure scenarios—not a reader model or vendor shortlist.

That distinction matters because the reader is only the visible part of the access control solution. Controllers, locking hardware, door sensors, request-to-exit devices, power, communications, software, and operating policies all affect whether an opening works as intended. A system that looks simple in a demonstration can become difficult to manage if those dependencies were never documented.

The practical approach is to plan door by door. Once you know who uses each opening, who administers access, and what must happen during an outage, you can compare architectures, credentials, integrations, costs, and vendors on equal terms.

This guide will answer:

• What is a commercial access control system?
• How commercial access control works
• Core components of a controlled opening
• How standalone, on-premise, cloud, and hybrid architectures differ
• Credentials, permissions, and visitor access
• Standards, egress, and reader communications
• Reliability, cybersecurity, and privacy
• Integrations and multi-tenant workflows
• How to plan every opening
• Implementation, retrofit, and commissioning
• Cost drivers and total cost of ownership
• How to compare vendors and define product fit
• FAQs

ButterflyMX Access Control

More than 100K, 5-star ratings!

What is a commercial access control system?

A commercial access control system authenticates a credential, applies permission rules, controls a physical opening, and records relevant events. It combines identities and access policies with readers, controllers, locking hardware, exit devices, power, communications, data, and management software.

This is physical access control: it governs entry to doors, gates, elevators, and other controlled openings. It is distinct from logical access control, which governs access to computers, networks, and digital resources. 

The Security Industry Association overview of physical access control describes the connected parts of a basic system, including components that buyers can easily overlook, such as a door position switch and request-to-exit device. Replacing a lock or mounting a reader does not create a complete system by itself. The door, frame, latch, release hardware, controller, wiring, power, and exit behavior must work together.

A video intercom can support identification and visitor entry at a shared entrance, but it does not automatically replace full access control across a property. Some openings may need broader permission rules, door monitoring, event records, or specialized hardware. That is why planning should begin with employees, tenants, visitors, contractors, service providers, administrators, and the openings each group uses.

How commercial access control works

Commercial door access control follows a six-step decision sequence. Authentication verifies a credential or claimed identity. Authorization is the separate decision about which openings that identity may use and when.

1. A person presents an approved credential, such as a card, fob, mobile credential, or biometric.
2. The reader captures the credential data and sends it to the controller or applicable decision service.
3. The system authenticates the credential according to its configuration.
4. The controller checks authorization rules, including role, location, schedule, and current access status.
5. If access is granted, the controller commands the locking hardware to release or unlock as designed.
6. The system records the granted or denied event and may also record door status, alarms, or administrative changes.

Presenting a valid credential does not necessarily prove that the person holding it is the person to whom it was issued. The level of identity assurance depends on the credential, enrollment process, policies, and configuration. That distinction becomes important when a property compares the convenience of different credentials with the risk at a particular opening.

Credential issuance is also the beginning of an ongoing process, not a one-time task. Administrators need repeatable procedures for changing schedules, replacing lost credentials, removing access when someone leaves, reviewing exceptions, and retaining appropriate event records. NIST FIPS 201-3 also distinguishes authentication from authorization, although its PIV requirements apply to federal employees and contractors rather than commercial buildings generally.

Watch how ButterflyMX works:

Core components of a controlled opening

Every controlled opening should be scoped as a complete assembly. The equipment will vary with the door, risk, and applicable requirements, but each component below answers a different operational question.

The opening itself belongs in this model. A new reader cannot correct a misaligned door, worn latch, unsuitable release device, damaged frame, or unverified power supply. During a retrofit, inspect the door and frame, locking and release hardware, wiring path, power, network path, monitoring, and exit behavior together. Reuse existing equipment only after its condition and compatibility have been confirmed.

How standalone, on-premise, cloud, and hybrid architectures differ

Access control architecture describes where software, data, administration, and access decisions reside. It does not determine the credential type, reader protocol, network medium, or fail-safe or fail-secure behavior. Vendors also use cloud terminology differently, so ask for a diagram that identifies each system component and dependency.

No architecture is universally better, cheaper, or more secure. Cloud-based access control may reduce local server work, but it does not remove the need to maintain door hardware, power, and local connectivity. On-premise access control gives the property or its provider more local infrastructure to operate. A hybrid system divides those responsibilities, which makes clear support boundaries especially important.

Choose the model that fits your administration, maintenance ownership, scaling needs, outage requirements, and total cost over the expected life of the system. Most important, confirm local decision-making, cached permissions, event buffering, and backup power instead of assuming that a cloud or on-premise label tells you how the system behaves offline.

Credentials, permissions, and visitor access

Cards, fobs, mobile credentials, and biometrics are credential choices, not architecture choices. Compare them by enrollment, revocation, user experience, reader compatibility, fallback options, assurance needs, and privacy obligations.

Multiple credential types can coexist only when the readers, controllers, and management software support the planned combination. The fallback method matters as much as the primary credential. A property should know what happens when a card is lost, a phone is unavailable, a reader fails, or an administrator must grant a temporary exception.

Permissions should follow roles and operating boundaries. In a multi-tenant building, the base-building team may control shared entrances and service areas while tenant administrators manage their own employees. Visitors and contractors can receive narrower, time-limited permissions. Role-based access control makes these differences explicit instead of assigning access one door and one person at a time.

Some properties also use policies such as anti-passback, which limits repeated credential use without a corresponding exit, or a two-person rule for selected areas. Tailgating occurs when someone follows an authorized entrant through an opening without separately presenting a credential. These controls address different risks and should be applied only where the opening, system, and operating process support them.

A complete visitor process covers invitation or enrollment, verification, approved doors and times, expiration or revocation, and event records. It also assigns responsibility: the building team, tenant administrator, or another authorized person must know who can approve access and who removes it. When mobile or biometric information is involved, establish appropriate consent, retention, deletion, and backup-access policies.

Standards, egress, and reader communications

UL 294 is not automatically required for every commercial opening. Applicability depends on the electrified opening, the adopted code edition, and the Authority Having Jurisdiction, or AHJ. UL 294 establishes construction, performance, and operational requirements for access control system units, including performance Levels I through IV.

Use precise listing language. Listed equipment is not the same as declaring an entire installation UL approved or code compliant. Compliance depends on the equipment, application, installation, adopted requirements, and AHJ determination.

Fail-safe hardware releases when power is removed; fail-secure hardware remains secure on the controlled side. Neither term means that an opening is inherently safe or secure. The choice must be coordinated with required egress and the other conditions at that opening. This article is educational and does not replace project-specific code review or AHJ approval.

Reader communication is a separate design decision. OSDP is an open panel-to-reader protocol recognized as IEC 60839-11-5:2020. It supports supervised, bidirectional communication and Secure Channel. The Security Industry Association source describes OSDP version 2.2.2 as released in October 2024. Wiegand is a legacy interface that buyers may encounter. Rather than judging security by cable type alone, ask the vendor to document protocol support, encryption, supervision, configuration, and future migration options.

FIPS 201-3, published in its January 2022 context, governs federal PIV credentials. Its distinction between authentication and authorization is useful beyond federal facilities, but its requirements should not be presented as a blanket mandate for commercial properties.

Reliability, cybersecurity, and privacy

Asking whether an access control system works offline is too broad. Power loss, local network failure, internet loss, hosted-service disruption, and credential-device failure affect different components. Each scenario should be documented and tested separately.

Some controller designs may continue making local decisions after an upstream connection is lost, but that behavior depends on the product and configuration. Require a written account of cached permissions, local decisions, event buffering, credential updates, backup power, and recovery after service returns. Then include those conditions in commissioning rather than relying on a sales demonstration under normal connectivity.

Cybersecurity also depends on more than whether the system is wired, IP-based, cloud-hosted, or on-premise. Reader protocol, encryption, supervision, network design, configuration, software maintenance, and administrator practices all matter. No architecture label establishes security on its own.

Governance connects those technical controls to daily operation. Assign ownership for administrator accounts, review access periodically, define event-retention rules, and set an escalation process for lost credentials, suspected misuse, and system incidents. Mobile and biometric data may require additional retention, consent, deletion, and privacy controls.

Integrations and multi-tenant workflows

Access control may connect with video surveillance, intrusion systems, visitor management, building management, notifications, and analytics. The useful question is not simply whether an integration exists. Buyers need to know what data moves, which actions are supported, whether the connection is native, partner-delivered, or custom, and who supports it after installation.

Elevator access illustrates why those details matter. A project may involve a cab reader, destination controls, or permissions tied to floors, but those are not interchangeable implementations. Document the intended elevator access sequence and responsibility boundaries without assuming that the access control product replaces the elevator system.

In a multi-tenant property, map shared entrances, tenant suites, service areas, elevators, and visitor routes separately. The base-building team may administer common areas while each tenant controls its own users. A visitor may need permission for the main entrance and a destination floor without receiving access to service rooms or unrelated tenant space. That map shows where one system can manage the requirement and where complementary systems are appropriate.

A video intercom can complement commercial building access control by supporting visitor identification and entry at a shared entrance. It may not govern every protected opening, however. ButterflyMX may fit shared entrances, visitor and mobile access, remote administration, and elevator access workflows in commercial and multi-tenant properties. Evaluate that fit against current product capabilities and the requirements for each opening rather than assuming one product replaces every interior controller or specialized high-security system.

How to plan every opening

A door inventory turns broad goals into requirements that installers and vendors can price, design, and test. Complete the same record for every opening, including doors that will retain existing hardware.

The method stays consistent across property types even when the answers differ. An office may separate employee entrances, executive areas, and service doors. A multi-tenant or mixed-use property may divide authority among base-building staff, tenant administrators, retail spaces, shared amenities, and elevators. An industrial site may assign different requirements to public, production, loading, and restricted areas. These examples do not prescribe a universal security tier or architecture; they show why each opening needs its own record.

Use the same completed door schedule, integration requirements, outage tests, support assumptions, and lifecycle horizon for every proposal. Otherwise, a lower quote may simply omit power work, exit devices, monitoring, commissioning, or ongoing services included elsewhere.

After the inventory is complete, map your shared entrances, visitor processes, and elevator access with ButterflyMX to see where it may fit the property’s requirements.

Implementation, retrofit, and commissioning

Commercial access control is rarely a routine self-install project. Even a limited retrofit can involve the door and frame, locking hardware, electrical work, networks, software, egress, and approval requirements. Depending on the opening and jurisdiction, the project may require coordination among access control specialists, locksmiths, electrical teams, network teams, and life-safety reviewers.

1. Survey every opening and validate the door schedule against actual site conditions.
2. Confirm door and frame condition, hardware compatibility, power, communications, monitoring, egress, and applicable approval requirements.
3. Define administrators, roles, schedules, credential enrollment, visitor processes, and responsibility boundaries.
4. Plan migration from existing credentials and train the people who will operate the system.
5. Commission granted access, denied access, door status, request-to-exit, alarms, revocation, visitor entry, and every documented outage scenario.
6. Hand over diagrams, configuration records, support contacts, operating procedures, and escalation paths.

Existing locks, cabling, readers, or power supplies may be reusable, but reuse should follow inspection and compatibility review. A single-door project still needs disciplined attention to the door, frame, lock, power, wiring, exit behavior, and administration model.

Commissioning is where design claims become observable behavior. Test the approved credential, a revoked credential, the wrong schedule, a held-open door, and each relevant loss of power or connectivity. The handoff should also make clear who fixes hardware, who administers users, who maintains software, and who coordinates future changes.

Cost drivers and total cost of ownership

Commercial access control system cost cannot be reduced to a reliable generic cost-per-door figure. Opening condition, lock hardware, readers, controllers, labor, wiring, power, networking, jurisdiction, integrations, and commissioning can materially change the project. A useful proposal separates one-time spending from recurring and lifecycle obligations.

• One-time costs can include door hardware, readers, controllers, power, wiring, network work, software setup, installation labor, and commissioning.
• Recurring costs can include software or hosting, support, connectivity, credential administration, and applicable service arrangements.
• Lifecycle costs can include maintenance, component replacement, upgrades, expansion, training, documentation, and internal administration.

Cloud subscriptions may replace some local server expense, while on-premise systems can shift more spending toward local infrastructure, backups, software maintenance, and internal support. Neither model proves a lower total cost of ownership by itself.

For a fair comparison, require every proposal to use the same door schedule, integrations, implementation scope, outage assumptions, support term, and planning horizon. Also identify what the property team must operate internally. A quote that excludes training, credential administration, maintenance, or future support may move costs rather than eliminate them.

How to compare vendors and define product fit

A useful access control vendor comparison is a demonstration against documented requirements, not a contest of feature lists. Give every provider the same opening inventory, permission model, integration needs, failure scenarios, implementation scope, and cost categories.

Ask each vendor to demonstrate normal entry, denied entry, credential revocation, visitor access, administrator changes, event records, and the relevant outage scenarios. The demonstration should answer five questions:

• Does the proposal cover every opening, including power, exit devices, monitoring, and commissioning?
• Where are permissions, event records, and access decisions managed?
• What continues during power, local-network, internet, and hosted-service disruptions?
• Which integrations are included, what functions do they deliver, and who supports them?
• What costs are one-time, recurring, and expected across the planned lifecycle?

Responsibility matters as much as equipment. Document who administers users, performs updates, monitors system health, handles support escalation, coordinates opening-specific reviews, and plans future expansion. If an integration is delivered by a partner or custom provider, identify who owns troubleshooting when systems cross organizational boundaries.

ButterflyMX is worth evaluating when a commercial or multi-tenant property emphasizes shared entrances, visitor access, mobile credentials, remote administration, or elevator access workflows. Confirm current capabilities, integration scope, and outage behavior for the proposed configuration. Specialized interior or high-security openings may still require complementary controllers, hardware, systems, and expertise.

Frequently asked questions

Is UL 294 required for every commercial access control system?

No. UL 294 is not automatically required for every commercial opening. Applicability depends on the electrified opening, the adopted code edition, and the Authority Having Jurisdiction, so the equipment and installation should be reviewed for the specific application.

Can a commercial access control system be self-installed?

Commercial access control commonly requires coordinated lock, electrical, network, and life-safety work, even when its software is simple to use. A limited project may still require licensed trades, permits, or AHJ review depending on the opening and jurisdiction.

Can access control be added to one existing door?

Yes, a single-door retrofit may be feasible after the door, frame, lock, power, wiring, egress, and administration requirements are inspected. Do not assume that existing hardware or wiring can be reused until its condition and compatibility have been confirmed.

Does a video intercom replace commercial access control?

Not necessarily. A video intercom can support visitor identification and entry, while complete access control may still be needed for permissions, multiple openings, door monitoring, and audit records. The answer depends on the property, the openings, and the required security processes.

The right commercial access control system is the one that meets documented requirements at each opening—not the one with the longest feature list. Define the people, permissions, door conditions, egress needs, integrations, outage behavior, and lifecycle responsibilities first. Then require every vendor to design, demonstrate, and price against that same record.

If your plan includes shared entrances, visitor access, mobile credentials, remote administration, or elevator access, see whether ButterflyMX fits those parts of your commercial or multi-tenant property. Map the relevant openings and request a configuration based on the access plan you have defined.

Get your free quote!

Fill in the form below, and we'll email you right back.

Want a free quote?

Fill in the form below, and we'll email you right back.