---

3.78

local time

time of the country where each access control unit is located

3.79

logging

function of an electronic access control system related to the recording and retrieving of changes (events) occurring within the system

3.80

logical access levels, pl

access rights, pl

ability of operators to perform functions within the electronic access control system such as configuration or administration, categorized terms of operator authorization/responsibilities

3.81

man trap

combination of two or more portals required to be used in sequence in order to gain access to a security controlled area

Note 1 to entry: The release of a subsequent portal is conditional upon the closure of the previous portal used and upon recognition of valid credentials.

3.82

master clock

general time synchronising device (clock) of an electronic access control system when there is more than one access control unit

3.83

memorized information

information known to the user

EXAMPLE: PIN code.

3.84

monitoring console

functional component that consists of devices used as control, logging and indicating interface for the operator of the electronic access control system

3.85

multiple access

dual access

function of electronic access control systems, which requires two or more sequential authorised access requests within a configurable time period to grant access

3.86

normal condition

access control system that is fully functional and able to process all events according to the pre-set rules

3.87 override, v

to bypass a function, generally temporarily

EXAMPLE: To temporarily disable the anti-passback function.

3.88

presence check

confirmation of the number (max., min.) of persons within a security controlled area

3.89

pre-set rules

set of predefined operating principles by which the electronic access control system functions

3.90

protected area

controlled area

area defined by a physical boundary, through which passage is controlled by means of one or more access points

3.91

reader

device for the input of credentials

EXAMPLE: Token reader, card reader, biometric reader, etc.

3.92

reader trace

function of electronic access control systems allowing the tracking of activities of all credentials for a specific reader

3.93

recognition

action of identifying authorised users requesting access by the comparison of presented credential data with recorded credential data

3.94

release time

period of time access points unlocked by the system according to pre-set rules

3.95

request-to-exit device

device local to an access point used to initiate free exit

3.96

RFID

contactless device for transmitting and/or receiving credential information by radio waves

3.97

roll call

function listing users or credentials recorded as being “IN” the area(s) controlled by the electronic access control system

3.98

scheduled access

timed free access

period of time during which an electronic access control system does not control access or exit as determined by pre-set rules

3.99

single free access granting

system function allowing the system operator to release a portal without credential recognition

Note 1 to entry: Upon closing, the portal is automatically secured by the system in accordance with pre-set rules.

3.100

singularization

limitation to one user passing the access point at the same time

3.101

soft anti-passback

system feature, which, upon granting access, generates only an alert following violation of anti-passback rules

3.102

stand-alone mode

mode of operation of the access control system without the communication between the access control unit and monitoring console

3.103

supervisor mode

function of electronic access control systems which requires a supervisor authorised access request to be used in conjunction with another credential in order to grant access

3.104

system administrator

person with the responsibility of deciding and/or implementing the electronic access control system processing rule

s3.105

system defined

options of electronic access control systems that are set to a fixed value (i.e. factory programmed) that cannot be changed in the field by reprogramming

3.106

system operator

person with the responsibility of manning the electronic access control system monitoring console who performs monitoring duties and may or may not enter/edit system data

3.107

system self-protection

functionality of an electronic access control system related to the prevention, detection and/or reporting of deliberate and/or accidental tampering and/or interfering with system operation

3.108

tailgating

person or entity, passing through an access point without using credentials by following a person or entity for whom access has been granted

3.109

tampering protection

method used to protect an access control system or part thereof against deliberate interference

3.110

timed anti-passback

system feature which traces an individual credential access request to a given area for which an access granted was not followed by an exit granted, or an exit granted was not followed by an access granted within a predetermined time period

Note 1 to entry: This feature prevents a second subsequent access request from being authorized to the same card into the same area, prior to the expiration of a user configurable anti-passback time.

3.111

timed free access granting

selectable time zone when the condition of portal release without credential recognition is permitted

3.112

time slot

interval of time between two given moments indicating the beginning and the end of a valid period within a time zone

3.113

time zone

one or more time slots combined with calendar information

3.114

token

portable device containing a readable unique identifier (credential) that can be associated with a user's data and access rights stored within the electronic access control system

3.115

transaction

event which corresponds to the release of an access point following recognition of a user identity

3.116

turnstile

portal designed to physically limit passage to only one person at a time

3.117

user

person requesting access through an access point

3.118

identification information

user identity

information which is transferred directly or via token by the user to the recognition equipment

3.119

visitor escorted access

function of electronic access control systems which grants access to an area to a given access level conditional on the sequential use of credentials of a different and specific access level

2. Abbreviations

For the purposes of this document, the abbreviations given in IEC 62642-1 and the following apply.

2. Conceptual models and system architecture

The electronic access control system shall include as appropriate to the specific configuration of the access control system the following basic functions: processing (A), communication (B), configuration (programming) (C), access point interface (D), recognition (E), annunciation (F), duress signalling (G), interfacing with other systems (H), self-protection (I), power supply (J), user interface (K):

A Processing: the comparing of changes occurring within the system with pre-set rules to produce predefined actions.

В Communication: transmission of signals between components of the access control system to ensure the application of pre-set rules.

C Configuration (programming): the setting of processing rules.D Access point interface:

• access point actuation: the portal releasing and securing according to pre-set rules;

• access point monitoring: the continuous reporting of the opened/closed status of the portal, and/or of the releasing/securing status of portal locking devices;

• access point actuation overriding: the releasing/securing of portal according to pre-set rules without recognition.

E Recognition: the recognizing of authorized users requesting access.

F Annunciation: the alert, display and/or logging functionalities:

• alert: the annunciation sub-functionality related to the activation of an indicator to prompt human assessment;

• display: the annunciation sub-functionality related to the visual and/or audible presentation of changes occurring within the system;

• logging: the annunciation sub-functionality related to the logging and retrieving of changes occurring within the system.

G Duress signalling: the silent warning by system users of on-going coercive access request conditions.

H Interface with other systems: the sharing of functionalities and/or changes occurring within systems.

I System self-protection: the prevention, detection and/or reporting of deliberate and accidental tampering and/or interfering with system operation.

J Power supply: module supplying power to the access control system. The power supply requirements in this standard do not cover the power needs for access point actuators. When a part of an electronic access control system (e g. access point interface) also forms a part of an intruder alarm system, the power supply of that part shall comply with the relevant requirements of IEC 62642-6.

К User interface: means by which the user requests access (e.g. keypad or token reader) and receives indication of access status.

Functions additional to the mandatory functions specified in this standard may be included in the electronic access control system providing they do not influence the correct operation of the mandatory functions.

The conceptual model of electronic access control systems and the system architecture are illustrated by Figure 1 and Figure 2

.

Figure 1 - Conceptual model

IEC 923/13

Mains

ІЕС 924/13

Components surrounded by dotted lines are not within the scope of this standard.

Functions may be distributed and may be located in more than one enclosure or integrated into a single cabinet.

System management annunciation and configuration may be performed by software applications only. The minimum requirements for the hardware platform shall be specified.

Figure 2 - Typical architecture of an electronic access control system

6 System performance functionality requirements

The equipment performance requirements shall be structured according to grades corresponding to levels of protection. This is achieved by classifying the security related functionalities (recognition, access point actuation, access point monitoring, duress signalling and system self-protection) in relation to risk levels.

The classification of the access control system shall be one of the four grades with Grade 1 being the lowest and Grade 4 the highest. The security classification shall be defined for each access point for entry and exit individually (see Table 1).

Different grades for access point interfaces can be used in the same installation as long as the functions provided by the access control system and credentials used fulfil at least the requirements of the highest security classification of access point(s) controlled by that system.When a function is included that is optional in the standard for the grade to which the component claims compliance, documentation should clearly and explicitly state which, if any, higher grade(s) such functions are compliant with. If such functions are not compliant with the requirements of a higher grade then this shall be clearly and explicitly stated in the documentation.

The risk levels are defined in terms of the value of the assets requiring protection and the determination (knowledge/skills) and methods of attack of persons intending to bypass the system (adversaries).

• Grade 1: low risk. The adversary is expected to have little knowledge of the access control system and be restricted to a limited range of easily available tools. The objective of the physical security is to deter and delay adversaries. Assets have limited value and adversaries in presence will probably give up the idea of attacking when confronted with minimum resistance.

• Grade 2: low to medium risk. The adversary is expected to have limited knowledge of the access control system and the use of a general range of tools and portable instruments. The objective of the physical security is to deter, delay and detect adversaries. The assets have higher value and adversaries in presence will likely give up the idea of succeeding when they realize they may be detected.

• Grade 3: medium to high risk. The adversary is expected to be conversant with access control system and have a comprehensive range of tools and portable electronic equipment. The objective of the physical security is to deter, delay, detect and help identify adversaries. The assets have high value and adversaries in presence may give up the idea of succeeding when they realize they may be identified and caught.

• Grade 4: high risk. The adversary is expected to have the ability or resources to plan the attack in detail and have a full range of equipment including means of substitution of components in the access control systems. The objective of the physical security is to deter, delay, detect and help identify adversaries. The assets have very high value and adversaries in presence may give up the idea of succeeding when they realize they will be identified and caught.

Table 1 - Grade classification

The access control unit shall be capable of unlocking portals in accordance with pre-set rules for a period of time either system-defined or system-programmable in accordance with Table 2. If the access point status is monitored then the release of the access point actuator shall cease when the access point is opened.

An electronic access control system shall be capable of controlling access in accordance with Table 2 and the timing diagram presented in Annex A. The requirements of Table 2 shall be applied to individual access points according to their grade. “Global” features shall be applied to all access points of the same grade.

Electronic access control systems should incorporate outputs capable of operating electromagnetic locks, electric strikes, frame mounted actuators, electrical, hydraulic or pneumatic deadbolts, and/or other types of electric locksets and electric panic bars.

Equipment shall be capable of monitoring the status of portals in accordance with system- defined pre-set rules or be configurable. Should the pre-set rules be system-defined, the permitted portal open time shall not be less than 10 s.

Equipment shall be capable of monitoring the status of portals, and the permitted portal open time shall be in accordance with pre-set rules that are configurable.

Table 2 - Access point interface requirements (1 of 2)