A commercial access control system is a set of credentials, readers, door controllers, locks, and management software that decides who may enter which door of a business, at which hours, and records every attempt. It replaces keys with rules that an administrator can change in seconds. This guide explains how the parts fit together, how a commercial system differs from a home one, and what to specify before you request quotes. If you want the product-level view of how cameras strengthen the doors you already have, see Argu’s access control page.
Key takeaways
- A commercial access control system has 5 building blocks: credentials, readers, controllers, locks, and management software.
- Commercial systems differ from residential ones in scale (tens to thousands of users), audit trails, schedules, and integration with fire alarm and video systems.
- The two reader protocols that matter most are Wiegand 26-bit (legacy, one-way) and OSDP v2 (bidirectional, encrypted).
- Door hardware must match the life-safety rules: a lock that fails secure must still allow free egress under NFPA 101.
- A badge read proves a credential was presented, not that only one person entered. Camera-based tailgating detection closes that gap.
What Does a Commercial Access Control System Include?
A commercial access control system includes 5 layers that work in sequence every time someone approaches a door. Knowing each layer helps you compare quotes line by line instead of by total price.
Credentials
The credential is what the person carries or knows. The common types are 125 kHz proximity cards, 13.56 MHz smart cards built on ISO/IEC 14443 such as MIFARE DESFire EV3, mobile credentials on a phone, PIN codes, and biometrics. Older 125 kHz cards are easy to copy, so most new commercial projects choose 13.56 MHz smart cards or mobile credentials. Our guide to biometric access control systems covers fingerprint, face, and iris options.
Readers
The reader sits at the door and reads the credential. It sends the data to the controller over a wire, using Wiegand or OSDP. Wiegand 26-bit is simple and widely supported but one-way and unencrypted. OSDP v2, maintained by the Security Industry Association, is bidirectional, supports encryption, and lets the controller detect a reader that has been unplugged.
Controllers
The controller makes the decision. It holds the list of valid credentials and schedules, checks each read against them, and triggers the lock relay. Most controllers handle 2 to 4 doors, so a 40-door building typically has 10 to 20 of them in telecom rooms or above ceilings. A good controller keeps working from a local copy of its rules if the network drops.
Locks and door hardware
Electric strikes, magnetic locks, and electrified locksets all do the physical job. The choice is not only about cost. Fail-safe locks release when power is lost, and fail-secure locks stay locked. Doors on an escape route must always allow free exit, which is why egress rules such as NFPA 101 shape lock selection and must be checked with the local authority having jurisdiction.
Management software
The software is where administrators enroll users, assign door groups, set schedules, and read reports. It can run on a server in your building or on a hosted platform. Our guide to cloud based access control compares the two models.
Commercial vs Residential Access Control
The main difference is scale and accountability. A home keypad answers one question: does this code open this door. A commercial system must answer who, when, where, and for how long, and keep the answer for audit.
| Factor | Residential | Commercial |
|---|---|---|
| Typical users | 1 to 10 | 20 to several thousand |
| Doors managed | 1 to 3 | 4 to hundreds |
| Schedules | Rarely used | Per person, per door, per shift, plus holidays |
| Audit trail | Usually none | Every grant and denial logged with time and door |
| Integration | Standalone | Fire alarm release, video, elevators, visitor desk |
| Credential revocation | Change the code | Disable 1 person across all sites in one action |
How Do You Choose a Commercial Access Control System?
Start from the doors, not the brand. List every opening, mark what each one protects, and decide the credential and lock type per door class. Then compare systems on how they handle growth and change.
Count and classify the doors
Most buildings have 3 classes of door: perimeter doors (the lobby and loading dock), interior restricted doors (server room, finance, labs), and general interior doors. Perimeter doors need the strongest credential and a camera. Interior restricted doors often justify a second factor such as card plus PIN. General doors may only need a schedule.
Check for open standards
Ask whether the system works with readers and controllers from more than one manufacturer. A proprietary design can lock you into one vendor for the life of the system. Open protocols such as OSDP v2 and standard card formats keep that choice open.
Plan for growth
If you expect to add a second floor or a second site, check how the software licenses doors and users. Some vendors charge per door, others per user, and some per site. Price a 50 percent growth scenario before signing.
Confirm the installation scope
Cabling, door prep, power supplies, and commissioning are often the largest part of the work. Our access control system installation guide walks through what to expect step by step.
Where Cameras Fit in a Commercial Access Control System
Access control records that a credential was accepted. It cannot see whether a second person followed through the door on the same read, a pattern called tailgating or piggybacking. The log shows 1 entry while 2 people entered.
Argu adds a monitoring layer on the cameras that already cover the entrance. An agent counts the people who pass after each badge scan and raises an alert, naming the door and time, only when the count does not match. It works with the badge record produced by Wiegand 26-bit or OSDP v2 readers, without replacing the panel, reader, or turnstile. Where a site enables facial matching, it reads standard 1080p to 4K feeds at 15 to 30 frames per second. For sites that cannot send badge or facial data to an outside cloud, on-premise deployment is available.
For a plain-language look at the hardware at the door, read our door access control system guide, and for the older card technology, see the key card entry system overview.
Commercial Access Control Specification Checklist
- How many doors today, and how many in 3 years?
- Which credential: 13.56 MHz smart card, mobile, PIN, biometric, or a mix?
- Reader protocol: OSDP v2 or Wiegand 26-bit?
- Lock type per door, and fail-safe or fail-secure for each?
- What happens to each door if the network is down for 1 hour? For 1 day?
- Which doors connect to the fire alarm for automatic release?
- How long are logs kept, and can they be exported in a standard format?
- Who is the single point of contact for installation and support?
Frequently Asked Questions
What is a commercial access control system?
It is an electronic system that controls entry to a business by checking a credential against stored rules at each door and logging every attempt. It replaces mechanical keys with credentials that can be disabled instantly.
How many doors can one controller handle?
Most door controllers handle 2 to 4 doors each. Larger buildings connect many controllers to the same management software.
What is the difference between Wiegand and OSDP?
Wiegand sends data one way without encryption. OSDP v2 is bidirectional, supports encryption, and lets the controller detect tampering or a disconnected reader. OSDP is the safer choice for new installations.
Is a commercial access control system better than keys?
For most businesses, yes. A lost badge is disabled in one action, schedules limit who enters after hours, and the audit trail shows who opened which door. A lost mechanical key requires rekeying the lock.
Can I add cameras to an existing access control system?
Yes. Camera-based analytics can read the feeds already covering your doors and compare them with the badge record, without replacing readers or controllers.
Does access control stop tailgating?
Not on its own. It records that a credential was used, not how many people passed. Camera-based tailgating detection is the usual way to close that gap.
A commercial access control system decides who may open each door. It does not show who walked through behind them. Argu watches that moment on the cameras you already have, on top of whichever readers and controllers you choose. Talk to Argu about the entrances where tailgating worries you most.
Last updated: October 2026
