Industrial organizations can invest heavily in access control and still struggle when an auditor asks a seemingly simple question: who had access to a particular area, why were they authorized, and who approved that access?
Industrial organizations can invest heavily in access control and still find themselves struggling when an auditor asks a seemingly simple question: who had access to a particular area, why were they authorized, and who approved that access?
The problem is often not that the access-control technology cannot provide the necessary security. Instead, compliance gaps can emerge from the way credentials are managed, policies are translated into system rules and different security and business systems are connected.
According to an HID Global spokesperson, process and governance issues remain among the most common causes of compliance weaknesses in industrial access-control environments.
"In my experience, the biggest compliance gaps are usually process and governance related," the spokesperson said.
These shortcomings can include credentials remaining active after workers change roles or leave an organization, regulatory requirements failing to translate into access-control rules, disconnected identity and access systems, and organizations collecting large amounts of security data without being able to produce meaningful evidence when an audit takes place.
For security systems integrators, this means supporting industrial compliance involves more than deploying readers, controllers and credentials. It increasingly requires attention to how access is governed throughout its lifecycle and how the resulting activity can be demonstrated later.
Credential lifecycle management remains a weak point
One of the most basic compliance problems occurs when access is granted correctly but is not subsequently reviewed. Industrial environments can make this particularly challenging because the people requiring access may change frequently.
Employees can move between roles. Contractors may work at a facility temporarily. External specialists might require access only while performing a particular task. Credentials and permissions that were legitimate when they were issued may therefore become inappropriate later.
HID identified poor credential lifecycle management as one of the most common compliance gaps.
"Access is granted but not regularly reviewed or removed when roles change or personnel leave," the spokesperson said.
The issue illustrates why credential issuance should not be treated as the end of an access-management process. Organizations also need procedures for changing permissions, reviewing them and eventually revoking them.
For integrators, this can influence system architecture. An access-control deployment designed primarily around credential issuance may not adequately address what happens months or years afterwards.
The ability to identify inactive credentials, enforce expiration dates, document changes and connect physical access with authoritative identity information can become important when supporting a customer's compliance requirements.
Turning policy into system rules
Having a documented security policy does not necessarily mean that policy is being enforced by the access-control system. HID sees the translation of compliance requirements into practical system rules as another major source of problems.
"Policies exist, but approvals, access levels, retention settings, and audit requirements are not enforced consistently," the spokesperson said.
For example, an organization may have a policy specifying who should be allowed into a particular area. But if those requirements are translated inconsistently into permission groups or individual credentials, the access-control system may not reflect the policy accurately.
The same applies to approval processes. A company could require authorization before particularly sensitive access is granted, but that requirement provides limited compliance assurance if administrators can change permissions without the approval being recorded.
Data retention creates another potential discrepancy. An organization may determine that particular access records need to remain available for auditing, yet the technical configuration may retain them for a shorter period.
For integrators, requirements gathering therefore needs to go beyond asking which doors employees should be permitted to open. It may also involve understanding how permissions are approved, how exceptions are managed, what records must be retained and how the customer intends to demonstrate that these policies were followed.
Integration can determine whether policies remain accurate
Compliance problems can become more difficult when access control operates separately from the systems containing employee, contractor and identity information. HID identified lack of integration as another common issue, particularly when HR, identity, visitor-management and physical access-control platforms are disconnected. Disconnected systems can leave organizations dependent on manual processes.
A worker's employment status may change in one application without automatically affecting the credential held in another. A contractor could reach the end of an assignment while access permissions remain unchanged until somebody manually updates the physical security platform.
The more systems and manual handoffs involved, the more opportunities there are for information to become inconsistent. This challenge is particularly relevant in complex industrial facilities where access systems may need to support different categories of personnel.
HID noted that technology complexity can itself contribute to compliance problems.
"Multiple PACS platforms, identity systems, visitor management solutions, biometric devices, and OT/IT integrations can create data silos, synchronization issues, inconsistent access policies, and gaps in audit trails if not properly architected and governed," the spokesperson said.
This means adding more technology does not automatically strengthen compliance.
A highly integrated industrial site may contain extensive identity and physical security infrastructure, but the value of those systems depends on whether information moves between them accurately and whether security policies are applied consistently.
For systems integrators, integration therefore needs to be considered not simply as a feature that improves convenience, but as part of maintaining reliable access governance.
The audit-readiness problem
Another common problem is that industrial organizations collect security information but struggle to use it effectively when compliance needs to be demonstrated.
"Organizations collect data but struggle to demonstrate compliance quickly during an audit," HID said.
Access-control platforms can generate considerable volumes of event information. But storing events is different from maintaining an effective audit trail. According to HID, a modern access-control environment should make it possible to establish who received access, who used it, who changed the permissions and who administered the system.
Credential records should therefore cover more than an individual's name.
HID recommends retaining details such as the credential identifier, issuer, approver, issue and expiration dates, assigned role and subsequent revocation. Access events should record both successful and unsuccessful attempts, along with timestamps, the user or credential involved, the location being accessed and the authentication method.
Where access is denied, recording the reason can provide important context.
That distinction matters because an auditor or investigator may need to understand not just whether somebody attempted to enter an area, but why the system accepted or rejected that attempt.
Recording changes to access rights
Changes to permissions can be equally important. HID recommends maintaining a record of what access was changed, the permissions that existed previously, the new permissions, who approved the change and who implemented it.
The organization should also retain when the change occurred and the business reason for making it. Such information can help reconstruct how somebody acquired access to a particular area.
Without that history, an organization might be able to show that a person entered a location but have difficulty explaining why that individual had the necessary permissions at the time.
This can become especially significant when access rights change frequently.
A current snapshot of permissions does not necessarily explain the state of the system when an incident happened six months earlier.
A useful audit trail therefore needs to preserve changes over time rather than simply showing the latest configuration.
Administrators need an audit trail too
Industrial organizations also need visibility into the actions of the people administering access-control systems. HID recommends recording administrator logins, user creation and deletion, role changes, credential issuance and revocation, configuration changes and software updates.
Other activities such as exporting logs and carrying out backup or restore operations should also be retained. Administrator activity can be important because changes made within the security platform affect what the system subsequently allows or denies.
If a user's permission changes unexpectedly, investigators need to be able to determine whether the change was automated, approved by another system or manually performed by an administrator.
That shifts auditing from simply watching credential holders to also monitoring how the access-control environment itself is managed.
Do not overlook system events
The audit trail should extend beyond users and administrators. HID also recommends retaining security and system events such as tampering alarms, controller failures, communications outages, logging failures and time-synchronization changes.
These events can provide context when reconstructing an incident.
If a portion of an audit trail is missing, for example, knowing that a communication or logging failure occurred during the same period could help explain the gap.
Accurate timestamps are also important when access-control information needs to be compared with records from other systems.
This makes the integrity and availability of the logging infrastructure itself part of audit readiness.
Retention needs to be decided in advance
Another consideration is how long these records should remain available. HID suggests retaining access logs for at least 12 months as a rule of thumb.
The company recommends keeping permission changes, credential lifecycle information and administrative records for three to seven years, or longer where regulations, contractual obligations or incident investigations require it.
The appropriate retention period will depend on the organization and the requirements it needs to meet. For integrators, the important point is that retention should form part of system design rather than being addressed only after an audit request arrives.
Long-term record keeping can affect storage requirements, database design, reporting and the way archived information is protected and retrieved.
Compliance is a governance problem as much as a technology problem. Access-control technology continues to become more capable, but HID's assessment suggests that industrial compliance failures frequently occur elsewhere.
"In short, while complex solution stacks can create challenges, credential lifecycle management and poor policy-to-system implementation remain the most common root causes of compliance failures," the spokesperson said.
HID argues that stronger programs should concentrate on governance, integration and automation. For integrators, that changes the scope of the compliance conversation.
The objective is not simply to make sure the correct credential opens the correct door today. The system must also respond when someone's authorization changes, preserve evidence of those changes and allow the organization to explain later why access was granted.
Ultimately, an industrial access-control system may demonstrate its compliance value most clearly when something has to be proven after the event.
As HID put it, the objective during an audit should be straightforward: an organization should be able to show quickly "who had access, who approved it, who used it, and who changed it."
Designing a system capable of answering those questions requires the technology, processes and governance surrounding access control to work together.