Access control systems – the electronic door locks, keypads and fob readers that control who can enter your building – are governed by an industry code of practice called NCP 109, maintained by the National Security Inspectorate (NSI). A new version of that code (Issue 4) is now in effect, and the previous version was formally withdrawn in September 2025.

For most building and facilities managers, the day-to-day question is not really about the code itself – it’s about whether your system is actually doing its job. The most common issues we see are not technical failures; they are management ones:
– Access cards or fobs that were never cancelled when a member of staff or contractor left
– People with a higher level of access than their role requires
– No regular audit of who has access to what, and when it was last used
– Magnetic door locks that release when the fire alarm activates – which sounds sensible, but can create a security gap if not properly configured

That last point is now addressed specifically in the updated standards: magnetic locks on emergency exit doors must form part of a fully tested and compliant system. A maglock that simply drops open when the fire alarm goes off may not meet current requirements.

If your access control system has not been reviewed in the last 12 months, or if you are not sure who currently holds active access credentials for your building, it is worth asking the question. The technology is rarely the problem – governance is.

Source: NCP 109 Issue 4, Code of Practice for Access Control Systems, National Security Inspectorate (nsi.org.uk)