| Security & Certification | Product security certification | Select products supported by documented third-party testing for the target market. Certification should apply to the complete lock or access-control system, not only to an individual electronic module. | UL 294 EN 14846 IEC 60839-11-1 | Request current certificates, certification scope, model numbers, test laboratory details, and the countries or regions covered. |
| Mechanical Security | Lock case, cylinder, and lever durability | Use commercial-grade components with tested cycle performance, protected mounting points, anti-drill provisions where required, and a mechanical key or emergency override policy suitable for the site. | ANSI/BHMA A156.13 EN 12209 EN 14846 | Check the tested cycle rating, door thickness range, backset, handing, cylinder format, fire-door compatibility, and replacement-part availability. |
| Authentication | Credential options | Support at least two independent credential methods, such as RFID card, mobile credential, PIN, biometric verification, or a mechanical override, with configurable permissions and revocation. | ISO/IEC 14443 ISO/IEC 15693 BLE | Confirm supported card technologies, credential encryption, offline operation, lost-card blocking, temporary access, audit records, and administrator roles. |
| Mobile Access | Bluetooth and smartphone compatibility | Bluetooth Low Energy access should support current Android and iOS versions used by the target market. The system should allow credential expiry, remote revocation, and event logging. | Bluetooth Low Energy AES-128/256 TLS | Test real phones, operating-system versions, pairing distance, credential sharing, offline behavior, and access recovery when a phone or account is lost. |
| Connectivity | Online and offline operating modes | The lock should continue to enforce locally stored permissions during temporary network outages. Online systems should synchronize events and configuration after connectivity is restored. | Ethernet Wi-Fi LTE/4G | Measure recovery time, event synchronization behavior, local memory capacity, network failover, and the effect of internet or cloud-service interruption. |
| Cybersecurity | Data protection and secure updates | Use encrypted communication, unique device credentials, role-based administration, secure firmware updates, audit logs, and a documented vulnerability-response process. | TLS 1.2 or later HTTPS Secure Boot AES | Ask about encryption at rest and in transit, password policy, certificate management, firmware signing, update frequency, penetration testing, and security incident notification. |
| Access Management | Administration and audit trail | Provide multi-level administrators, time schedules, zones or doors, visitor permissions, bulk user management, exportable reports, and tamper or forced-entry alerts. | RBAC NTP CSV/API Export | Confirm user capacity, event-retention period, time-zone handling, daylight-saving support, API documentation, and compatibility with existing identity systems. |
| System Integration | Building and access-control integration | For larger sites, prefer documented interfaces for access-control panels, property-management systems, visitor systems, elevators, alarms, and identity platforms. | OSDP v2 Wiegand REST API SIP/HTTP | Confirm wiring, reader compatibility, event direction, encryption support, licensing, API limits, and whether integration requires a proprietary gateway. |
| Power | Battery life and power backup | Battery-operated locks should provide a clearly stated service-life estimate under defined usage conditions. Wired units should include power-failure behavior and an emergency power method where appropriate. | Alkaline/Lithium Battery PoE 802.3af UL 294 | Test battery life using the expected daily access volume, temperature range, credential type, wireless mode, and alarm settings. Confirm low-battery alerts and emergency power access. |
| Environmental Protection | Weather, dust, and corrosion resistance | Exterior hardware should have an enclosure rating appropriate to the installation location, along with corrosion-resistant materials and operating-temperature specifications. | IEC 60529 IP Ratings ISO 9227 IEC 60068 | Check the exact IP rating, salt-spray test duration, operating temperature, humidity limits, UV exposure, drainage design, and suitability for coastal or outdoor environments. |
| Fire & Life Safety | Fire-door and egress compatibility | The lock must not compromise required emergency egress, fire-door assembly performance, or local building-code requirements. Fail-safe and fail-secure behavior must be selected by risk and code requirements. | NFPA 80 NFPA 101 EN 1634-1 UL 10C | Obtain door-assembly listings, release-time behavior, emergency-exit documentation, local authority approval requirements, and fire-rating limitations. |
| Accessibility | Usability and accessible operation | Controls should be reachable and usable by people with different abilities. The installation should preserve required clearances, opening forces, visual indicators, and accessible egress. | ADA ICC A117.1 EN 17210 | Review mounting height, lever operation, keypad visibility, tactile or audible feedback, door-opening force, wheelchair approach space, and local accessibility rules. |
| Installation | Door and hardware compatibility | The product should support the actual door material, thickness, swing direction, mortise or cylindrical preparation, frame condition, and power or network routing available at the site. | ANSI/BHMA EN Hardware Series Local Building Codes | Complete a door survey covering dimensions, alignment, fire rating, existing hardware, strike position, cable paths, and installation tolerances before ordering. |
| Performance | Response time and throughput | Authentication should be fast enough for the site’s traffic pattern, with predictable unlocking, relocking, and event-reporting behavior during peak periods. | Manufacturer Test Method Site Acceptance Test | Measure authentication time, unlock time, relock time, simultaneous-user handling, offline response, and peak-hour queue impact using representative credentials. |
| Supply & Lifecycle | Warranty, spare parts, and support | Commercial procurement should include a written warranty, defined technical support, firmware-maintenance policy, replacement batteries or parts, training, and an end-of-life plan. | SLA RMA Process Change Control | Confirm warranty duration, response times, local service coverage, spare-part lead times, minimum order quantities, software fees, and data-export rights if service is discontinued. |
| Compliance & Privacy | Personal-data and regional compliance | Collect only necessary personal data, define retention periods, restrict administrator access, and provide suitable data-processing and cross-border-transfer controls for the target region. | GDPR CCPA/CPRA ISO/IEC 27001 | Review hosting location, sub-processors, data deletion, access requests, breach notification, biometric-data handling, and contract terms for international data transfers. |