Access Control and Intrusion Detection
Domain 2 - Access Control and Intrusion Detection. This domain tests the credential-to-egress chain: how a person is identified, authenticated, authorized, and audited at a door, and how intrusion sensors detect and report unauthorized entry without blocking lawful escape.
Core rules
- Access control is a chain: identification, authentication, authorization, accountability. A badge reader alone does not authorize; the controller and access rules do.
- A powered access control system includes credential, reader, controller, electric lock, door position switch (DPS), request-to-exit (REX), and power supply. The DPS reports held or forced doors; the REX allows lawful egress.
- Fail-safe locks unlock on power loss and are required where egress depends on the lock. Fail-secure locks stay locked and are limited to non-egress openings or controlled vestibules. Fire alarm interface and REX must preserve escape.
- Use anti-passback, two-person rules, interlocks or mantraps, visitor escort, and tailgating detection where asset criticality justifies them.
- Intrusion detection covers perimeter and interior: passive infrared, dual-technology, glass-break, vibration, and fence-mounted fiber. Zones must have supervised circuits and a defined response force.
Worked example
A server room has one egress door and a fail-secure lock. Occupants could be trapped in a power failure. The correct fix is a fail-safe lock with REX, DPS, forced-door alarm, and fire alarm release; fail-secure may remain on an inner cabinet or non-egress vestibule door. The reasoning is life safety first, then asset protection through detection and response.
Traps
Specifying fail-secure on egress doors; disabling or misplacing REX; installing alarms with no response plan; and placing motion sensors where HVAC or sunlight causes nuisance alarms.