Access Control Systems: London FM Security Guide
- Solomons FM
- 3 hours ago
- 12 min read
You're usually looking at access control systems when something has already gone wrong. A key has gone missing. A contractor is still turning up with a valid fob after the job ended. A member of staff lets someone through the front door because reception is busy and nobody wants a scene in the lobby. Then the office manager gets asked a simple question that's hard to answer without the right system: who was in the building, where did they go, and who approved it?
That's why access control stops being an IT gadget and becomes a facilities issue very quickly. In London, buildings are busy, mixed-use, and often older than the systems bolted onto them. Security has to work with front-of-house staff, cleaners, engineers, delivery drivers, tenant reps, and SIA guards who need clear procedures.
Table of Contents
Why Access Control Is a Non-Negotiable for London Businesses - What it changes on the ground - Why London sites feel the pressure sooner
Comparing the Main Types of Access Control Systems - The main system categories - Access Control System Comparison - What works and what usually disappoints
Understanding the Key System Components - Input devices at the door - The controller is the brain - Output devices do the physical work - The software is where management lives
Integrating Systems for Total Site Security - Why integration matters to security staff - Practical integrations that earn their keep - Human response still decides the outcome
Navigating Compliance and Data Privacy
- Data retention and user records - Residential and mixed-use sites need extra care
Procurement A Practical Checklist for Managers - Start with the building, not the catalogue - The checklist I'd use on a live job - Budget for ownership, not just installation - Supplier questions worth asking
London-Specific Operational Management Notes - Where SIA teams make the difference - Audit trails matter when something goes wrong
Why Access Control Is a Non-Negotiable for London Businesses
A good access control system is a digital gatekeeper.
It decides who gets in, where they can go, and when that permission ends.
That sounds very simple, but in practice it solves three daily problems that catch London sites out. Unauthorised entry, poor visibility, and weak control over keys and passes.
In a small office, you might get away with mechanical locks for a while.
In a London office building with shared entrances, out-of-hours contractors, couriers, and hybrid staff patterns, that approach falls apart. You need a record, a process, and a way to change permissions without changing cylinders and chasing keys across departments.
The wider market tells you this isn't a niche issue. The UK Electronic Access Control Systems Market is projected to grow from USD 1,482.41 million in 2023 to USD 3,403.53 million by 2032, with London and the Southeast accounting for approximately 40% of the market share because of the concentration of corporate and financial buildings that need stronger security and compliance measures, according to Credence Research's UK electronic access control systems market outlook.
What it changes on the ground
The first change is control. If someone loses a card or fob, you can disable it.
If a contractor only needs weekend access to a plant room, you schedule that access and remove it automatically.
If a delivery arrives after hours, security can verify the person, log the event, and grant limited entry based on site rules.
The second change is accountability. You stop relying on memory and start relying on event history.
That matters when HR asks who entered an office after a complaint, when a tenant queries a weekend callout, or when your insurer wants to know whether the building was properly secured.
Why London sites feel the pressure sooner
London buildings often have awkward realities. They have older doors, shared receptions, mixed commercial and residential use, tenants with different risk profiles & security officers covering several duties at once.
Access control systems bring order to that mess, but only if the setup reflects how the building runs.
What doesn't work is buying a system around a brochure feature list.
What works is mapping it to real operations;
Who opens the building.
Who covers lunch at reception.
Who responds to alarms at night.
Who checks a forced-door alert when the loading bay is active.
The technology matters, but the operating model matters just as much.
Comparing the Main Types of Access Control Systems
Most managers make the mistake of comparing access control systems by headline price alone. That's the wrong starting point.
The better question is this: what sort of building are you trying to control, and how much day-to-day management do you want to carry?
Try to think of the options like home security. A basic key lock is cheap and familiar. A smart lock with remote control is easier to manage but needs planning. A heavy-duty setup for a multi-tenant site costs more because it has to do more.
The main system categories
Mechanical locks are still common on internal doors and low-risk areas. They're simple, but they're labour-heavy once keys are copied, lost, or not returned. They give you almost no audit trail.
Electronic card or fob systems are the standard commercial choice. They're very practical for offices because reception teams and security staff can issue, cancel, and replace credentials without changing hardware at every door.
Card-based credentials dominated the UK market in 2025, accounting for 45.70% of market size, according to Mordor Intelligence's UK access control market analysis.
Wireless systems are very useful in retrofit jobs where running cable becomes disruptive or expensive.
That matters in London because many buildings weren't designed for modern security infrastructure.
The same market analysis notes that retrofit and upgrade projects accounted for 69.55% of UK access control deployments in 2025, and mobile credentials are projected to grow at a 9.74% CAGR through 2031, which fits the move toward upgrading the existing stock rather than starting from scratch.
Cloud-based or ACaaS platforms (Access Control as a Service) suit sites that want remote administration, easier software updates, and less dependence on a local server room. They're often a good fit for multi-site occupiers or landlords managing several addresses.
Biometric systems have their place too, but not everywhere. They can tighten control on sensitive rooms, yet they also create more policy questions, user concerns, and support issues. For most offices, they're not the first tool to reach for unless there's a genuine high-risk area.
Access Control System Comparison
System Type | Best For | Typical Cost | Security Level | Scalability |
|---|---|---|---|---|
Mechanical locks | Low-risk internal doors, very small sites | Lower upfront, higher admin over time | Basic | Limited |
Electronic card or fob systems | Offices, receptions, shared staff areas | Moderate | Strong if well managed | Good |
Wireless access control | Retrofit projects, heritage or awkward buildings | Moderate to higher depending on door estate | Strong when specified properly | Good |
Cloud-based ACaaS | Multi-site portfolios, remote management | Ongoing subscription model plus hardware | Strong with proper governance | Very good |
Biometrics | Restricted rooms, higher-security zones | Higher | High when correctly deployed | Selective rather than broad |
What works and what usually disappoints
For most London offices, card, fob, or mobile-based electronic systems are the practical centre ground. They're very manageable, familiar to users, and flexible enough for staff, visitors, and contractors.
What often disappoints is overcomplication.
Sites may buy advanced functions that they never put to use.
Mobile credentials sound tidy, for example, but they need enrolment rules, phone support expectations, and a fallback for visitors and users with dead batteries. The tech isn't the problem. The missing process is.
If you're also reviewing front desk flow, pre-registration, and guest handling, it's worth looking at how visitor management systems for office buildings fit alongside door control. The handover between reception and access permissions is where a lot of weak practice shows up.
Buy for the building you run on a difficult Tuesday evening, not the one shown in the installer's showroom.
Understanding the Key System Components
An access control system isn't one box on the wall. It's a chain of parts that has to work together cleanly. The simplest way to understand it is like a computer. You have input devices, a processor, and output devices.
Input devices at the door
The input side is what the user touches. That might be a card reader, keypad, intercom, or biometric scanner. It's the point where someone requests access.
The common mistake is treating the reader as the whole system. It isn't. A smart-looking reader on a weak door, badly mounted lock, or poor credential policy won't make the entrance secure. The door set still matters.
The controller is the brain
The controller is where the decision gets made. It receives the credential data, checks the rules, and decides whether the person can enter. If the system is designed properly, it also records the event and sends the information where it needs to go.
This is the part many office managers never see, but it's where a lot of project quality shows up. A tidy controller layout, clear naming conventions, and sensible door groups make future changes much easier. A messy setup can create support calls every time a tenant move or staff change happens.
Output devices do the physical work
Once the controller makes a decision, the output side acts on it. That usually means disengaging a maglock, releasing an electric strike, sounding an alert, or triggering a related action.
On-site check: If the door releases but doesn't reliably close and secure behind the user, the access control system hasn't solved the security problem.
The software is where management lives
There's also a practical fifth component.
Management software.
That's the dashboard where permissions, schedules, door groups, reports, and alarm events are handled. Security staff and facilities teams spend more time here than with the hardware itself.
When the software is well set up, admin becomes routine. Add user. Assign profile. Set expiry. Review event.
When it's badly set up, everything becomes a workaround, and people start bypassing the process because the system feels slower than the old key cabinet.
Integrating Systems for Total Site Security
A standalone door system is useful.
An integrated security setup is what helps you run a site.
The moment an access event can be checked against CCTV, matched to a visitor booking, and seen by the guard team in real time, the building becomes easier to manage and harder to abuse.
Why integration matters to security staff
A forced-door alarm means very little on its own. It could be a genuine breach, a cleaner with a trolley, a delivery, or a faulty closer.
When your access control ties into cameras and the monitoring process is clear, the SIA officer or remote operator can verify what's happening and respond properly.
For sites that want doors, alarms, and operator response working together, CCTV monitoring services for London properties are part of the same operational picture, not a separate purchase.
Practical integrations that earn their keep
Some integrations sound impressive but add little value day to day. Others pay back in reduced confusion and faster response.
Works with CCTV: If someone tries to force a door, tailgate another person into the building, or enter outside normal hours, security can quickly review the footage and see exactly what happened.
Works with visitor management: Reception staff can pre-register visitors, issue temporary passes or credentials, and avoid relying on handwritten sign-in books.
Supports reception and concierge teams: In residential and mixed-use buildings, staff can check who's at the door before allowing access.
Works alongside alarm systems: If a door is left open or forced, the system can flag it immediately so someone can investigate.
Remote access: Site or facilities managers can check access events from wherever they are instead of travelling to the building just to investigate a single incident.
Human response still decides the outcome
The best systems support people. They don't replace them.
Solomon's security personnel receive site-specific training so they understand the access control, CCTV, alarm, fire panel and visitor procedures already in place at each location. This helps officers operate the client's existing systems correctly and respond professionally when an incident or access issue occurs.
A night officer still needs a clear instruction for what to do when a plant room door opens outside schedule.
A concierge still needs to know whether a courier can be escorted beyond the lobby.
A control room still needs named contacts for escalation.
This short video gives a useful visual sense of how monitored access and surveillance come together in practice.
Navigating Compliance and Data Privacy
Compliance tends to get left until late in the project, usually after someone asks whether the system is acceptable for insurance, resident safety, or an audit request.
Compliance should shape your specification at the start, because it affects hardware choice, data handling, and operating procedures.
Data retention and user records
Access control generates personal data. Names, credential IDs, timestamps, and movement history can all form part of a record about identifiable people.
That means your organisation needs a clear reason for collecting it, sensible access to the logs, and a retention approach that matches your obligations.
From an FM point of view, the practical questions are straightforward.
Who can export logs?
Who approves requests?
How long are records kept?
How are leavers removed?
What happens if HR, legal, or the police ask for event history?
If nobody owns those answers, the software will become a compliance problem.
Residential and mixed-use sites need extra care
Communal residential developments have more explicit security requirements.
For developments seeking to meet Secured by Design guidance, buildings with 10 or more flats may require visitor door entry and access control systems incorporating features such as security-encrypted electronic credentials, vandal-resistant visitor panels and integrated access control.
For larger developments of more than 25 flats, the guidance also recommends systems capable of recording access events for a minimum of 30 days, according to the NACD excerpt on visitor door entry and access control requirements.
For mixed commercial and residential buildings in London, poor coordination presents challenges.
Office standards, concierge practice, landlord obligations, and resident expectations all meet at the front entrance.
The access control policy has to reflect that reality.
Procurement A Practical Checklist for Managers
Most procurement problems start before the first quote arrives. The manager asks for “a new door entry system”, three suppliers price three different things, and nobody is comparing like with like. You need a short working brief that reflects your site.
Start with the building, not the catalogue
Walk the site and list the doors that matter.
Not every door needs the same treatment.
Main entrance, tenant demise, comms room, cycle store, plant access, loading bay, and roof route all have different risks and traffic patterns.
Then list the user groups.
Permanent staff, cleaners, residents, contractors, managing agents, delivery drivers, security officers, and visitors all need different rules. If you skip this step, the installer will make assumptions, and you'll spend the first months undoing them.
The checklist to use on a live job
Map critical doors first: Don't count every cupboard on day one. Identify entrances, restricted areas, and doors linked to complaints, losses, or out-of-hours activity.
Check the existing door hardware: Some old doors can be upgraded sensibly. Others need a proper hardware refresh because the frame, closer, or lock case is already the weak point.
Decide who administers the system: If reception issues passes but security handles incidents, both teams need the right permissions and training.
Ask how leavers and expired contractors are removed: If the supplier can't show a clean workflow for enrolment and deactivation, admin will drift.
Review integration requirements early: CCTV, visitor workflows, intercoms, and alarm outputs should be specified before the final quote.
Test reporting and audit functions in the demo: A polished dashboard means little if you can't quickly pull a usable event report.
Confirm support and fault response: A failed reader on a side entrance is an operational issue, not just a technical ticket. Make sure out-of-hours support is covered.
Ask suppliers to explain how the system behaves during a network outage, a power issue, and a door hardware failure.
Budget for ownership, not just installation
The invoice is rarely the true cost.
Hardware, software, licences, credentials, installation, training, support, and future door additions all sit inside the total budget.
Hardware remains the foundation of the market, contributing 61.05% of UK access control market revenue in 2025, while cloud or ACaaS software is forecast to grow at 8.45% CAGR through 2031, according to Mordor Intelligence's assessment of hardware and cloud growth in the UK access control market.
Supplier questions worth asking
Who owns the configuration data: You need a clean handover, not dependence on one installer.
How are user permissions structured: By tenant, floor, department, or door group.
Can the system support future changes: A split floor, a new tenant, or weekend events shouldn't mean replacement.
What training is included: Front desk, security and FM teams use systems differently. Make sure staff receive site-specific training on the access control, CCTV, alarm and visitor procedures they will be expected to follow.
Who takes first call on faults: Your installer, guarding provider, FM helpdesk, or managing agent.
One practical option in London is to use a security and facilities provider whose staff are trained to work confidently with the systems already installed on site. Solomon's Facilities Management provides site-specific training for its personnel so they understand each client's access control, CCTV, alarm and visitor procedures as part of the wider security operation.
London-Specific Operational Management Notes
London sites rarely fail because the reader didn't beep. They fail because the people around the system aren't coordinated. The night guard doesn't know whether to challenge a late contractor. Reception hasn't been told that a tenant booked weekend works. The managing agent wants an incident report, but nobody can pull the relevant event history quickly.
Where SIA teams make the difference
On a well-run site, access alerts feed into clear human action.
If a side entrance opens out of hours, the SIA officer checks the live situation, confirms whether the person is authorised, records the event, and escalates if needed. If the lobby is busy, reception and security know who owns visitor approval and who issues temporary credentials.
Audit trails matter when something goes wrong
Technology records what happened, but trained personnel know what to do with that information. Solomon's security officers receive site-specific training so they can work with each client's access control, CCTV and alarm systems, helping ensure incidents are recorded accurately and escalated in line with the site's procedures.
The NACD guidance recommends retaining access event records for a minimum of 30 days as set out in the NACD guidance on communal visitor door entry and event retention.
The practical lesson applies beyond residential sites. If there's an incident, you need a record that security teams, management and stakeholders can rely on. A clear audit trail helps investigations, supports accountability and provides evidence when incidents need to be reviewed.,
For managers refining post-incident handling, incident response procedures for security operations are closely tied to how access events are logged, reviewed, and escalated.
If you need help operating the day-to-day security of a London office, residential block or mixed-use site, Solomon's Facilities Management can support your existing security arrangements through site-trained SIA-licensed personnel, visitor management, incident reporting, reception support and out-of-hours cover.
Comments