Most access control systems use a smart card to allow a person or vehicle to identify themselves.
What is often overlooked is how the card gets into the hands of the cardholder.
This article is the first part of a new series of access control workflow tasks which need to be considered when implementing a new system.
What determines if a person is going to have a card?
First of all, do we want everyone to have a card?
Should visitors and contractors be escorted by an employee at all times?
Do they need a smart card or will a simple printed paper or plastic card be enough to identify them?
Quite often for employees, being issued with a card is part of the Human Resources process when a new employee starts with the business.
Some organisations that require everyone to have a card use a workflow system.
This system, usually external to the access control system has a series of requests and approvals so that there is an audit trail of who authorised a person to have a card and what permissions they should have.
Once approved, the data to print and encode a card is sent to the card production system and the access permissions are sent directly to the access control system.
Once we have decided that someone needs a card, what does the card production process look like?
There are a number of decisions that need to be made:
- What should be printed on the card
- How the data is captured
- Should card production be on-site or offsite?
- What other systems need the card data
What should be printed on the card
At a minimum, the person’s name and photograph should be printed on the front side of the card.
Some organisations add branding, such as the logo of the company, however there is a risk in doing this if the card is lost on the street, whoever picks it up already knows which organisation the card belongs to and potentially they may try to attack it.
In large organisations, colour blocks, either around the photograph or on the card are quite popular.
The colour of the block relates to which areas someone has access to.
This is useful for a security officer on patrol to visually challenge someone if they are in an area where they should not be and is faster than checking the access control system.
The potential downside here is if the person moves to a different department or role, they may need to get their card replaced to update the colour block.
Printing a set of instructions of what to do if the card is lost is a smart idea.
If a post box address is printed on the back, someone can simply drop the card into a postbox and it will be returned to the organisation that owns the card without exposing the name or address of the organisation.
Card numbers are also usually printed on the back, however it may be more convenient to use a desktop reader to read the card number rather than expecting someone to type it in.
How the data is captured
Basic data such as name, department and location can be extracted from the Human Resources system to gather that data, but we also need a photograph.
Some organisations may have a small photo studio setup to capture photos when people start work at a new company for marketing purposes, or an area in security where a photo can be captured with a webcam for printing.
For large, complex organisations where there are large numbers of people involved, it may be a better option to email the employee a link to a self-service portal where they can upload their photo and confirm the information is correct themselves.
Should card production be on-site or off-site
This will largely come down to volume of cards required.
An organisation where maybe two people a week start, it’s feasible to have the production on site.
For a large organisation with hundreds of new starters at a time, or a university where a typical intake for a new academic year can run into several thousand cards, off-site becomes far more practical.
Hybrid solutions can also be setup where most of the card production is off-site, but the organisation can print cards on site if a person starts earlier than expected or if a replacement card is needed.
It’s important to ensure with a hybrid solution that there is a control mechanism in place to stop the card from being printed off-site as part of a bulk production run if the card had already been printed on-site.
What other systems need the card data?
In a modern building, access control is only one of a myriad of systems that will use the card.
Others could include:
- Follow-me printing
- Cashless vending
- Time and attendance
- PC Logon
When planning a card issuance process, these systems and their data requirements need to be taken into account to ensure that all data is captured and passed to the correct system.
Also take into account various scenarios that could be used.
As an example, is there a possibility that we need to block access to follow-me printing and access control, but still allow someone to buy food at the restaurant?
This is where a card management system with customisable workflow configurations comes into its own – it can be built with the exact organisational processes in place without requiring one system such as access control to hold lots of additional data that is not required in other systems.