SESE Training – Matthew Fabian
Home › Access Control

Capstone: design a secure lab

Apply all five modules to a two-door secure lab, then compare with the model answer.

⏱ ~45 minModule 6 of 6Quiz ↓
🎯 Learning objectives
  • Apply wiring, rules, PIAM, credential and sync decisions to one real design

Design access control for a new secure lab with two doors: a glass front door and a steel rear door that is a fire exit. Then check your answer against the model outline below.

  1. Choose locks and fail mode for each door, and explain the egress and fire alarm wiring.
  2. Choose reader technology and wiring (OSDP Secure Channel, card plus PIN after hours).
  3. Create an area with both doors as perimeter doors and decide which side is entry.
  4. Create cardholder groups (Lab Staff, Lab Managers) and access rules with schedules.
  5. Add a temporary rule for a two-week equipment vendor, and a visitor escort rule.
  6. Set up ClearID: area owner, two-step approval, private visibility.
  7. Decide how staff are fed in (Entra ID via ClearID or Card Sync) and how terminations are handled.

Stretch goal: once you have finished the Video Surveillance track, extend the design with door cameras linked to both door entities (see Tying video to access control).

Model answer

1.Model answer outline (try the exercise first)

  • Front glass door: mag lock (fail-safe) on COM/NC, PIR plus PUSH TO EXIT button cutting power directly, fire alarm drops lock power at the supply.
  • Rear fire door: fail-secure, fire-rated electric strike on COM/NO, mechanical egress via lever, REX switch in the lever with Unlock on REX off.
  • Supervised DPS on both doors with EOL resistors at the contact; AC fail and battery inputs from the power supply.
  • OSDP readers with Secure Channel keys changed from default; card-and-PIN schedule after 18:00.
  • Area Secure Lab, rules on the area for groups only; temporary rule for the vendor; escort required for visitors.
  • ClearID area owner is the lab manager; supervisor then area owner approval.
  • Identities from Entra ID; termination process deactivates the cardholder immediately.
Progress is saved in this browser only.