Yes, physical access control is part of cyber security: anyone who can walk into your server room, open the records cabinet or reach a production control panel can bypass the best firewall you own. Modern card access systems are also networked software, so the permission list, device identities and access logs need protecting like any other digital asset.
Key takeaways
- Manage physical and digital access with the same identity and permission logic, under one line of responsibility.
- The Verizon 2026 DBIR found the human element in 62% of breaches; walking through a door uninvited is the physical side of that risk.
- The most common gaps are cloneable legacy cards, leavers' cards left active, shared admin logins and access logs that can be edited.
- Access logs are personal data, so retention, permissions and deletion rules must be defined.
- When choosing a door system, ask "who makes the decision and who can change the record?" rather than "does it read cards?".
In many companies the door cards belong to the security team, while email and servers belong to IT. Attackers do not respect that split; they use whichever entrance is least guarded. This guide explains how to treat your card access control system as part of your cyber security plan.
Why is physical access a cyber security problem?
Most cyber attacks start at a keyboard, but a physical gap often decides how far they get. An unlocked server room, an unknown USB stick plugged into a socket or a laptop left open on a desk can undo much of what you spend on network security. In industrial sites the stakes are higher still: as our guide to OT and SCADA security explains, physical access to control panels affects production directly.
People sit at the centre of this picture. According to the Verizon 2026 Data Breach Investigations Report, the human element was present in 62% of breaches. Tailgating through a door, lending a card to a colleague or posing as a courier to get into the building is phishing in physical form.
The cost is not trivial either. IBM's Cost of a Data Breach Report 2026 puts the global average cost of a data breach at a record $4.99 million. The UK government's Cyber Security Breaches Survey 2025/2026 found that 43% of businesses experienced a cyber breach or attack in the previous 12 months.
What cyber risks do door access systems carry?
A card access system is made up of cards, readers, door controllers, a server and an admin panel. Each layer is an attack surface, yet most organisations only look at the first one, the card.
| Risk | How it happens | What to do |
|---|---|---|
| Card cloning | Unencrypted 125 kHz cards, and cards read only by their serial number (UID), can be read at short range and copied | 13.56 MHz cards with cryptographic authentication in critical zones, a second factor, a system that does not store card numbers in clear |
| Lingering access | A leaver's or a finished contractor's card is never switched off | Validity periods and deactivation from one place |
| Shared admin login | Everyone signs into the panel with the same account, so no one knows who changed what | Personal logins, separated permissions, an audit log |
| Editable records | Access logs can be deleted or altered after the event | A log structure that is tamper-evident |
| Rogue device | An unauthorised reader or terminal joins the network and sends data | Device identity, encrypted connections, revocation from the panel |
| Network outage | When the internet drops, the door either locks everyone out or lets everyone in | Offline behaviour chosen per access point |
We cover the differences between card types in 125 kHz vs 13.56 MHz cards, and how cloning works in practice in our guide to access card cloning risk.
For how a door should behave when the connection is lost, see access control offline mode.
How do you manage physical and digital access together?
The goal is that a person's rights in the building and in your systems are granted on the same logic and withdrawn at the same moment. The zero trust principle of "verify every access, grant the least privilege" applies to doors as much as to applications. The seven steps below work for a small office and a multi-site factory alike.
- Classify critical areas. Server rooms, archives, safes, HR files and production control rooms should be separate zones; data centre access control is a good model for them.
- Grant access by role. Rather than opening doors person by person, use access groups and link each group only to the zones and hours it needs.
- Review your card technology. Replace easily cloned cards in stages; look beyond the frequency at whether the reader authenticates the card cryptographically, and ask whether the card number is held in plain text anywhere in the system.
- Make leaving a single process. Email, files and door access should close on the same day from the same list; the checklist is in offboarding all employee accounts.
- Time-limit contractors and visitors. When a contract or visit ends, the card should stop working on its own; contractor access and HSE compliance covers this in detail.
- Protect the panel and devices like any IT asset. Without personal logins, separated permissions, up-to-date software and a device inventory, the door system can become the weakest link on your network.
- Protect and review the logs. Watch rejection reasons and out-of-hours entries regularly; in a breach, the 72-hour KVKK notification process will lean on these records.
These steps are behavioural as well as technical. Spotting and stopping a tailgater is a staff habit, so add physical scenarios to your security awareness training programme.
Why do access logs matter for data protection?
Which door an employee used and when is personal data. Under Türkiye's KVKK, much as under the GDPR, the organisation is the data controller and must protect it. The law's data security provision requires appropriate technical and organisational measures, so who can see access logs, how long they are kept and how they are deleted should be written down.
Visitor records raise the same question. Names, phone numbers and ID details written in a paper book sit where anyone can read them; we compare the options in paper visitor logs and KVKK. For the wider topic, browse our security and data protection guides.
How does SmartPass make this easier?
SmartPass is software that brings card access control, staff time and attendance (PDKS), visitor management and canteen management together in one panel. When a card is presented, the server decides on the entry, and a rule changed in the panel applies at every door straight away. Most of the risks in the table above are addressed in the product's design.
Picture a three-shift factory where a maintenance contractor's agreement ends on Friday and someone from finance leaves the same week. Because the contractor firm's contract period is set in SmartPass, the first card read after it ends is rejected as "outside the company contract", with no need to switch off cards one by one. Once the departing employee is deactivated, their card stops working too; when a person is deleted in Smart360, their name and personal details in SmartPass are erased and the card is cancelled.
The features that matter most from a cyber security point of view are:
- Card numbers are not stored: At the moment of reading, the device turns the number into a one-way hash using a key unique to the organisation; the database holds only the hash and the last four digits.
- Device identity: Each device joins with its own identity and administrator approval, and uses an encrypted, mutually authenticated connection; a device revoked in the panel is refused on its next request.
- Chained records: Access and audit records are linked in a hash chain, so deletion or alteration is detected when the chain is verified.
- Separated permissions: With 43 separate panel permissions you can grant, for example, visitor reception only or timesheet viewing only; every change is logged with its previous and new value.
- Offline operation: Doors carry a copy of the permission list signed by the server, so decisions follow the same rules when the internet is down, and each point's behaviour (follow the cache, stay closed, stay open) is chosen separately.
On data protection, the organisation chooses how long access records are kept, between 30 days and the upper limit of its package; once that period ends, the fields linking records to a person are deleted automatically every day. Visitors are not asked for an ID number. You can find more on the SmartPass product page.
How can Digital Bridge help?
Door security is not just a software choice; it also means assessing existing turnstiles and readers, designing zones and permissions, and aligning with IT policies. Digital Bridge handles site survey and installation for card access control systems. SmartPass's fixed terminal is brand-independent and works with OSDP readers and dry-contact relays, so existing turnstiles and doors with a relay input can often be reused; the survey confirms what applies to your site.
If you want to connect physical access to a broader security programme, our cyber security consultancy covers risk assessment, the permission model and leaver processes together. Our SME cyber security checklist is also a useful place to start.
What should your next step be?
Start by applying the risk table in this guide to your own site: note which card type you use, whether leavers' cards are closed on their last day and who signs into the panel with which permissions. The row with the most "we don't know" answers is your priority.
To assess SmartPass for your own doors, review the features on the SmartPass page. Because SmartPass is installed together with hardware, pricing is quoted according to the number of access points and people; to buy it, fill in the SmartPass sales form, or arrange a site survey through our contact page.