For many organisations, access control is still centred on the building. But operations and the majority of physical risk often aren’t.
In sectors like critical infrastructure, assets are distributed across remote sites, infrastructure, and locations without power. And workforces are increasingly fluid. Contractors and engineers move between sites, often needing access to unmanned locations at short notice.
Access control needs to reflect these realities and support freedom, flexibility, and efficiency without compromising security (or add complexity and cost). It’s a big ask.
Building-centred access control creates blind spots
In the past, access control was designed around fixed locations, users, and credentials. But that model doesn’t work when assets are distributed.
Even if sites are visited infrequently, they still need to be protected. Especially as remote, often unmanned, locations are being targeted more frequently. And access needs to be easy for those authorised.
Without the right setup, issues can include technicians having to collect keys or be escorted onto site. Keys can be lost, shared or copied. Access isn’t time-bound. Sites can be left unsecured. And visibility is limited, making it difficult to track who accessed what, when, and why.
The impact can be significant
Focusing only on buildings for access management leaves gaps that, however small, can have a big impact. This includes:
- Increased security risks: Unauthorised access becomes more likely when remote sites lack proper protection.
- Operational inefficiencies: Time can be wasted and costs incurred in a range of ways, from credentials being issued manually to delays getting started on site.
- Compliance challenges: Regulatory demands are increasing. NIS2, for example, requires physical access logs for all locations, not just connected sites.
- Reporting is difficult: If there’s no record of who accessed what or when, audits are incomplete and investigations lack traceability.
A shift to identity-based access is what’s needed
For access control to operate efficiently and effectively across distributed assets, it must start with the individual. Access control then moves from ‘Who can enter this building?’ to ‘Who is this person and what can they can access – why, where, when and how?’
Shifting from purely location-based decisions to identity-driven access. With that approach, access authorisations can stay in line with policies and regulations at every access point, and follow users across:
- Locations (e.g., sites, towns and countries)
- Asset types (e.g., buildings and infrastructure)
- Access methods (e.g., doors, locks, barriers, gates and turnstiles)
- Identifier types (e.g., mobile keys, wallet badges, etc.)
How does that look in practice?
Here’s an example of how things work when you have the right, indentity-based access management in place.
- A contractor requests access to a substation at a specific time.
- The manager responsible approves this request remotely, online.
- Access is issued instantly to the contractor’s smartphone and is stored as a mobile key.
- They arrive in driving rain and use this mobile credential to quickly gain access through the perimeter gate, into the storeroom and to the equipment they’re authorised to use.
- Every access event is logged automatically.
- Their access to this substation expires in line with the company’s policy, or the time and date set by the manager approving access.
This approach eliminates physical key management, reduces delays, and ensures every access event is controlled, time-bound and fully traceable.
What do you need to make it work?
The move to identity-centric access control requires the right platform. Particularly when assets are distributed. Ideally, it should enable all of the following.
- Centralised governance: One place to manage people, permissions, assets and events.
- Coverage beyond doors: Control that extends, without compromise, to cabinets, gates, remote infrastructure, and more, in online and offline environments.
- Real-time control: Instantly grant or revoke access.
- Full visibility: An end-to-end audit trail showing who accessed what, when and why.
- Works in all environments: Including harsh weather and remote locations without power.
- Works with a range of identifiers: From badges to mobile keys.
One platform, every access point
Our AEOS-iLOQ platform is designed to manage access centrally across every location and environment. It takes an identity-first approach and is built on a best-of-breed partnership between AEOS access control and iLOQ’s smart locks.
AEOS enables centralised, online access control that’s easy to use, manage, integrate, and scale. And iLOQ’s smart locks extend your access control system to every location – from power plants in remote areas to gates in extreme climates. They’re opened via a mobile key on your smartphone and powered by NFC from the phone. So they don’t need batteries, cables, or a signal.
This streamlined platform enables:
- Operational and cost efficiencies: Including reduced travel, fewer manual processes and lower key-management costs.
- High levels of security: Including reduced risk of unauthorised access and lost or shared credentials.
- Easy compliance: Including clear reporting and straightforward auditing.
- Flexibility and scalability: Including the ability to easily add new sites, users and parameters.
- Sustainability improvements: Including no batteries and reduced travel for maintenance etc.
A system for how you work now
The building is no longer the centre of access control. Organisations that continue to treat it that way risk gaps in security, inefficiciencies in operations, and a lack of visibility where it matters most.
Organisations that extend access control beyond the building gain control that reflects how access actually works – across every location, asset, and environment.
Learn more about this technology
