Codes, Standards, Compliance, and Privacy
This domain tests the legal and standards environment around access control: life safety, building codes, accessibility, listing requirements, and privacy. Expect questions on egress, fire alarm release, ADA considerations, standards such as NFPA 101 and UL 294, PIV and FIPS 201, and data protection principles.
Codes and standards
NFPA 101 and the International Building Code govern means of egress, door locking, and fire alarm coordination. NFPA 70 covers electrical installation. Accessibility rules address opening force, hardware operation, and reach ranges. UL 294 addresses access control system units; UL 1076 addresses proprietary burglar alarm units. FIPS 201 defines PIV credential requirements for federal identity. OSDP defines reader-to-controller communication. The authority having jurisdiction makes the final compliance call.
Privacy
Access control generates personal data: badge photos, entry records, biometric templates, and video. Apply data minimization, purpose limitation, retention limits, access controls, and secure deletion. Some jurisdictions require notice, consent, or impact assessments for biometrics and employee monitoring. GDPR and CCPA-style laws may give individuals rights to access, correction, or deletion. Privacy applies to physical security records, not just IT systems.
Worked example
A designer proposes a magnetic lock on a public exit door. The door is in a means of egress and has no request-to-exit sensor or fire-alarm release. The plan fails life-safety review. The corrected design uses a compliant electrified lock with a request-to-exit sensor, manual release, fire-alarm interface, and door position monitoring. The reasoning starts with code and occupant safety, then adds security technology.
Traps
Do not treat a manufacturer's listing as proof of code compliance. Do not assume privacy law stops at the PACS server. Do not retain entry records or video indefinitely without a basis. Do not install biometrics without checking notice, consent, and retention rules.