PSAP cheat sheet

Access control has four decision elements: identification (who claims to be), authentication (proof of that claim), authorization (what is permitted), and accountability (audit trail of what occurred).

Risk = likelihood × impact; a qualitative matrix (e.g., 5×5) ranks likelihood and consequence, while quantitative analysis expresses risk in annualized loss expectancy (ALE) = single loss expectancy (SLE) × annualized rate of occurrence (ARO).

Defense in depth layers deterrence, delay, detection, assessment, and response; no single barrier is treated as sufficient, so a failed reader, door, or network link still leaves a residual layer.

Least privilege and need-to-know govern authorization: each credential holder receives only the access required for the role, and access is reviewed on a defined cycle (typically quarterly or annually).

Threat, vulnerability, and risk are distinct: a threat is an actor or event with intent and capability, a vulnerability is a weakness that can be exploited, and risk is the combination of both against an asset's value.

Separation of duties and dual custody reduce insider risk for high-value areas: two authorized persons must act together, and no single individual can both grant and audit their own access.

Access control models: discretionary (owner grants), mandatory (system labels, clearance-based), role-based (permission sets tied to job roles), and attribute-based (rules evaluating multiple attributes at decision time).

Residual risk is what remains after controls are applied; acceptance of residual risk must be documented and approved by an accountable authority, not assumed by the installer or integrator.

Core PACS tiers: credential, reader, intelligent controller (door-level decision and lock control), host server or cloud service (badging, rules, reporting), and client workstations; the controller holds local decisions when the host is unreachable.

An intelligent controller stores the local access database and schedules, and makes grant/deny decisions offline; a pure panel that relies on the host for every decision fails open or closed per configuration when communications drop.

Door hardware interface signals typically include reader data lines, request-to-exit (REX), door position switch (DPS), lock relay output, and alarm/forced-door and held-door inputs; each input has a supervised or unsupervised circuit.

Wiegand is a one-way clock-and-data interface limited to roughly 26–40 bits; OSDP is a bidirectional, encrypted-capable serial protocol supporting secure channel and reader-to-panel tamper reporting.

Supervised circuits use end-of-line resistors so the panel distinguishes normal, alarm, open, and short conditions; unsupervised contacts report only open/closed and cannot detect a cut wire.

A typical PACS network segments controllers on a dedicated VLAN with the host server, using encrypted management traffic; remote or inter-building links use VPN or TLS rather than exposing controller ports to the internet.

Time zones and holiday schedules are defined once and applied to access levels, so a rule change propagates from host to controllers and remains effective offline.

Elevator control, turnstiles, intercoms, and visitor management integrate as additional device types; each integration adds a failure mode that must be tested for fail-safe or fail-secure behavior.

Low-frequency 125 kHz proximity cards carry a static identifier and are clonable with inexpensive tools; high-frequency 13.56 MHz smart cards support mutual authentication and encrypted sectors (e.g., MIFARE DESFire, SEOS-class credentials).

Wiegand output transmits the credential number in clear; a reader that outputs only Wiegand cannot authenticate the card, so cloning or replay is possible on the wire.

Card + PIN raises assurance to two factors (something held, something known); biometrics add inherence and are subject to false accept rate (FAR) and false reject rate (FRR).

Crossover error rate (CER) or equal error rate is the FAR/FRR intersection point used to compare biometric devices; lower CER indicates a more accurate matcher at the chosen threshold.

Mobile credentials use BLE, NFC, or a secure element in the phone and are bound to a device; revocation must be possible remotely, and lost-device reporting is part of the credential lifecycle.

Multi-factor authentication combines at least two of: something you know, something you have, something you are; two credentials of the same type (two cards) are not multi-factor.

Anti-passback prevents a credential from being used to enter twice without an intervening exit; it may be hard (deny), soft (allow with log), or time-based (reset after an interval).

Identity proofing before credential issuance includes verifying government ID, matching to an authoritative source, and recording the issuance event; visitor and contractor credentials are time-limited and visibly distinct.

Fail-safe locks unlock on loss of power (maglocks, electric strikes on egress paths); fail-secure locks remain locked on power loss (some electric bolt locks). Life-safety egress normally requires fail-safe release.

A maglock holds by electromagnetic force rated in pounds (commonly 600–1,200 lb); it requires a request-to-exit device and, per fire and life-safety codes, a means to release on the egress side without a key or special knowledge.

Electric strikes replace the strike plate and release the latch; they require the door to be latched and are not suitable where the frame cannot be modified or where positive latching must be maintained.

Door position switches (reed or Hall-effect) report open/closed for held-door and forced-door alarms; a held-door alarm fires when the door stays open beyond a programmable time.

Request-to-exit devices include push buttons, passive infrared (PIR) sensors, and REX switches integrated in the lock; PIR-based REX can be defeated by an object passed under the door, so some designs require a second confirming sensor.

Power supplies for locks and controllers should be dedicated, battery-backed, and sized for continuous load plus inrush; voltage drop over long runs is calculated from wire gauge, current, and distance.

Controllers are rated for the door hardware they drive; relay contact ratings and lock current must be checked, and inductive loads such as strikes require suppression (diode or MOV) to avoid contact arcing.

Fire alarm interface: on alarm, doors on egress paths release via the fire alarm relay; the release must be coordinated with the authority having jurisdiction (AHJ) and tested during commissioning.

Design begins with a door schedule and access-area matrix mapping each opening to credential group, schedule, hardware type, and monitoring requirement; this becomes the basis for the bill of materials.

Site survey records door construction, frame type, power availability, cable pathways, and existing fire and life-safety devices before hardware selection is fixed.

Cabling standards: reader cabling uses shielded twisted pair appropriate to the protocol (Wiegand or RS-485 for OSDP), lock power uses adequate gauge for current and distance, and all cabling is labeled and documented.

Separation of power and data cabling, grounding of shields at one end, and surge protection on long exterior runs reduce noise and lightning-induced failures.

Commissioning tests each door for grant, deny, REX, DPS, forced-door, held-door, fire release, and power-fail behavior; results are recorded and signed off before handover.

As-built documentation includes door schedules, wiring diagrams, IP addressing, controller configuration exports, and credential group definitions; it is essential for future maintenance and audit.

Integration with video management, intrusion, intercom, and visitor systems uses documented APIs or event streams; the integrator must verify that events (e.g., door forced) trigger the expected cross-system response.

Phased cutover and rollback plans protect operations when replacing an existing PACS; parallel operation may be required until all credentials are re-enrolled and tested.

PACS devices are operational technology on the enterprise network; they must be inventoried, patched, and segmented, and default vendor passwords changed before commissioning.

The OSDP Secure Channel encrypts and authenticates reader-to-controller traffic; Wiegand has no encryption, so protocol choice is a security control, not a convenience.

Controller firmware and host software must be kept current; end-of-support devices are a documented risk requiring compensating controls such as network isolation and monitoring.

Network segmentation places controllers and readers on a dedicated VLAN with ACLs limiting traffic to the host server and management systems; no direct internet exposure.

Remote access for service uses VPN or a jump host with MFA and session logging; vendor backdoors and shared accounts are prohibited or tightly controlled.

Credential data at rest (card numbers, biometric templates) is protected by encryption and access control; biometric templates are treated as sensitive personal data and are irreversible by design.

Logging and monitoring: authentication events, configuration changes, and door alarms are forwarded to a SIEM or log server, with time synchronization (NTP) so events correlate with video.

Incident response for PACS includes credential revocation, controller isolation, forensic preservation of logs, and a tested recovery procedure for restoring configuration from backup.

Alarm monitoring distinguishes forced door (opened without a valid grant), held door (open beyond time), and tamper (enclosure or reader); each has a defined response procedure and escalation path.

Operators must verify alarms against video or a second source before dispatching, to reduce nuisance responses from tailgating, deliveries, or cleaning crews.

Credential lifecycle: issuance, activation, suspension, reissue on loss, and termination on separation; terminated credentials are removed from the controller database, not just the host.

Access reviews reconcile the credential database against the HR or authoritative roster; orphaned or duplicate accounts are removed and the review is documented.

Maintenance includes battery testing on power supplies, lock and strike adjustment, sensor cleaning, and periodic functional tests of fire release and fail-safe operation.

Incident response phases: detect, contain (lock down or isolate), assess, notify per policy, recover, and review lessons learned; evidence is preserved with chain of custody.

Business continuity: define manual override or keyed backup procedures for power or network outage, and confirm that fail-safe doors still secure the asset when power is restored.

Performance metrics such as alarm response time, false alarm rate, and open work orders are tracked to demonstrate operational effectiveness to management and auditors.

NFPA 101 (Life Safety Code) governs means of egress: doors must be openable from the egress side without a key or special knowledge, and access-controlled egress doors must release on fire alarm or power loss as permitted by the code edition.

NFPA 72 covers fire alarm and the interface that releases access-controlled doors; the release relay and its supervision are part of the fire alarm system, not the PACS.

The ADA and ICC A117.1 set accessibility requirements: operable hardware height, opening force limits, and clear widths apply to doors with access control hardware.

Local building and fire codes and the authority having jurisdiction (AHJ) govern final acceptance; code edition and local amendments take precedence over manufacturer recommendations.

FIPS 201 and HSPD-12 define federal identity credential standards (PIV) and are commonly referenced for high-assurance credentialing in regulated environments.

Privacy: biometric data and cardholder records are personal information subject to laws such as GDPR, state biometric statutes, and breach notification rules; collection is limited to what is necessary and retention is defined.

Video and access logs are subject to retention schedules and legal hold; access to logs is role-restricted and audited, and signage or notice is provided where required.

Audit and compliance evidence includes access reviews, commissioning test records, maintenance logs, and incident reports; these are retained per the organization's records schedule.