What Is Security Hardware? A Complete Guide to Access Control Components

Security hardware is the physical equipment that controls who can enter a building, a floor, or a room. It includes intelligent controllers, card readers, electronic locks, request-to-exit devices, expansion modules, and the wiring and network infrastructure that ties it all together. If you manage a commercial facility, a campus, or a multi-tenant building, your access control system is only as good as the hardware it runs on.

This guide breaks down every major component of a modern access control system — what it does, how it connects, and what to look for when specifying or replacing hardware. Whether you’re building a new system from scratch or expanding an existing one, the decisions you make at the hardware layer will define your system’s capabilities, security posture, and total cost of ownership for years.

We’ll also cover the most important architectural decision you’ll face: centralized vs. distributed controller design. This single choice affects everything from wiring costs to fault tolerance to how many doors go offline when a single device fails.

The Five Layers of Access Control Hardware

Every access control system, regardless of brand or platform, is built from five functional layers. Understanding these layers helps you spec hardware correctly, troubleshoot problems faster, and avoid expensive mistakes during expansion.

• Layer 1 — Credentials and Readers: The user-facing components that capture identity. Cards, fobs, mobile credentials, PINs, and biometrics presented at a reader mounted at the door.
• Layer 2 — Intelligent Controllers: The decision-making hardware. Controllers receive credential data from readers, evaluate it against stored rules, and decide whether to grant or deny access.
• Layer 3 — Door Hardware: The physical mechanisms that secure the opening. Electronic locks (strikes, maglocks, electrified mortise), door contacts, and request-to-exit devices.
• Layer 4 — Expansion Modules: Additional I/O boards, reader interfaces, and downstream panels that extend the reach of your controllers beyond their built-in port count.
• Layer 5 — Network and Infrastructure: The Ethernet, RS-485, and power distribution that connects everything. This layer is invisible when it works and catastrophic when it doesn’t.

Let’s look at each layer in detail.

Intelligent Controllers: The Brain of the System

The intelligent controller is the most critical piece of hardware in any access control system. It’s the device that stores credentials locally, processes access decisions at the edge, and communicates with your access control software platform. When a controller fails, the doors it manages stop working.

What a controller does

When someone presents a badge at a reader, the reader doesn’t make the access decision. It sends the credential data to the controller. The controller checks the credential against its local database of authorized cardholders, evaluates the access rules (time schedules, access levels, anti-passback), and sends a signal to the door lock to grant or deny entry. This all happens in under a second.

Because the controller stores credentials and rules locally, it continues to make access decisions even when the network is down or the server is offline. This is called offline operation, and it’s one of the most important reliability features of modern access control.

Mercury MP1502

The Mercury MP1502 is the current-generation 2-door intelligent controller from Mercury Security, the most widely deployed access control hardware platform in the commercial market. It controls 2 doors directly and can expand to 64 doors via RS-485 downstream panels. It stores 240,000 cardholders locally, supports TLS 1.3 and FIPS 140-3 encryption, and runs on a Linux-based platform with ARM TrustZone secure boot.

The MP1502 is supported by numerous access control software platforms, including Avigilon Alta, Lenel OnGuard, Honeywell Pro-Watch, ACRE, and RS2 Technologies. Always verify OEM firmware and licensing before moving a board between platforms.

Distributed Network Door Controllers

Axis Communications makes network door controllers that can be installed near the controlled opening. Models such as the Axis A1210 use PoE, which can simplify installation by combining network connectivity and power on one cable. Verify software support, lock-power requirements, and licensing for the exact model.

The trade-off with any distributed controller is tighter dependence on its supported software and firmware. Confirm the migration path before standardizing on a controller family.

Lenel Intelligent System Controllers

Lenel (now LenelS2, a Carrier company) makes intelligent system controllers for their OnGuard platform. The LNL-2220 and LNL-3300 are the primary head-end controllers that manage downstream reader interface modules like the LNL-1300-S3. Lenel controllers communicate with their downstream modules over encrypted RS-485 and are tightly integrated with OnGuard’s event management and reporting.

Expansion Modules: Scaling Beyond Built-In Ports

No intelligent controller has unlimited ports. When you need more doors, more inputs, or more relay outputs than your controller provides natively, expansion modules let you scale without adding another controller.

Reader Interface Modules (SRIs)

A reader interface module connects one or two card readers to your intelligent controller over RS-485. The Lenel LNL-1300-S3, for example, is a single reader interface that adds one door to a Lenel ISC. Mercury’s MR52 serves the same function in Mercury-based systems. These modules can be daisy-chained up to 4,000 feet from the controller, making them ideal for doors that are far from the server room or IDF closet.

I/O Expansion Modules

When you need to monitor additional alarm zones, control elevator floors, or manage auxiliary devices like gates and bollards, I/O expansion modules provide the additional points. The Mercury MR16IN adds 16 monitored inputs, and the Mercury MR16OUT adds 16 relay outputs. Both connect via RS-485 and appear as additional I/O points in your access control software. Up to 32 modules can be multi-dropped on a single RS-485 port.

Common expansion scenarios include elevator floor control (one relay per floor), parking gate management, alarm zone monitoring integrated into the access control platform, and interlock sequencing for mantraps and airlocks.

Card Readers and Credentials

The reader is the only part of the access control system that end users interact with directly. It captures the credential — a card number, a mobile token, a PIN, or a biometric template — and sends it to the controller for evaluation.

Reader Protocols

There are three common communication protocols between a reader and a controller:

• Wiegand: The legacy standard. Sends credential data as a series of binary pulses over two wires (D0 and D1). Simple, universal, and unencrypted. Every controller on the market supports Wiegand. The limitation is that communication is one-way (reader to controller only) and the data is sent in the clear — vulnerable to interception.
• OSDP (Open Supervised Device Protocol): The modern standard. OSDP uses RS-485 serial communication, supports bidirectional data flow, and offers AES-128 encryption via OSDP Secure Channel. The controller can send display messages and LED commands back to the reader. OSDP is the SIA standard and the recommended protocol for all new installations.
• Clock and Data: An older protocol similar to Wiegand but using clock and data lines instead of D0/D1. Still found in legacy installations but rarely specified for new work.

For new installations, OSDP is the correct choice. It provides encrypted communication, tamper supervision (the controller knows immediately if a reader is disconnected or tampered with), and the ability to update reader firmware remotely. Wiegand is acceptable for budget-constrained retrofits where you’re reusing existing reader wiring.

Credential Types

The credential is what the user presents to the reader to prove their identity:

• Proximity (125 kHz): Legacy RFID cards and fobs. HID ProxCard II is the most common. Easy to clone — not recommended for any security-sensitive application.
• Smart Cards (13.56 MHz): Higher-frequency cards with encryption. HID iCLASS SE, SEOS, and DESFire are common examples. Much harder to clone than proximity cards and support mutual authentication between card and reader.
• Mobile Credentials: Smartphone-based credentials delivered via Bluetooth Low Energy (BLE) or NFC. These can reduce physical card management and allow faster provisioning and revocation.
• PIN Codes: Numeric codes entered on a keypad. Typically used as a second factor (card + PIN) rather than standalone, because PINs can be shared and don’t create a unique audit trail.
• Biometrics: Fingerprint, facial recognition, iris scan, or palm vein readers. Used in high-security environments where identity verification (not just credential verification) is required.

Door Hardware: Locks, Contacts, and REX Devices

The door hardware layer includes everything that physically secures the opening and reports its status back to the controller.

Electronic Locks

There are three primary types of electronic locks used in access control:

• Electric Strikes: Replace the standard door strike plate. When energized (or de-energized, depending on fail-safe vs. fail-secure), the strike releases and the door can be pushed or pulled open. Most common in commercial office environments. Available in fail-safe (unlocked when power is lost) and fail-secure (locked when power is lost) configurations.
• Electromagnetic Locks (Maglocks): A magnet mounted on the door frame holds the door closed with 600–1,200 lbs of holding force. When power is removed, the door releases. Maglocks are always fail-safe — they unlock when power is lost. This makes them suitable for fire-rated exits but requires a UPS or battery backup if you need the door to remain locked during a power outage.
• Electrified Mortise Locks: Full mortise locksets with integrated electronic control. They combine mechanical locking with electronic access control, allowing both card access and key override. Common in higher-end commercial and institutional installations.

Door Contacts

A door contact is a magnetic switch that tells the controller whether the door is open or closed. It’s typically a two-piece device: a magnet on the door and a reed switch on the frame. When the door opens, the magnetic field breaks and the switch changes state. The controller uses this information for door-held-open alarms, forced-entry alarms, and accurate event logging.

Request-to-Exit (REX) Devices

A REX device allows people to exit a secured area without presenting a credential. This is a life safety requirement — you cannot require a credential to exit a building. Common REX devices include push buttons (press to exit), motion sensors (passive infrared detectors that sense someone approaching the door from the inside), and crash bars with integrated REX switches.

When a REX device activates, it sends a signal to the controller. The controller unlocks the door and logs the event as a legitimate exit, suppressing the forced-door alarm that would otherwise trigger.

Centralized vs. Distributed Architecture

This is the single most consequential design decision in any access control system. It affects wiring cost, fault tolerance, scalability, and long-term maintenance. Get this wrong and you’ll live with the consequences for a decade.

Centralized Architecture

In a centralized design, intelligent controllers are located in a central equipment room (MDF, IDF, or security closet) and long cable runs connect each door’s readers, locks, and contacts back to the controller. A single Mercury MP1502 in a central closet might control 2 doors with built-in ports, plus 62 additional doors via RS-485 expansion modules distributed throughout the building.

• Advantages: All controllers in one location for easy maintenance. Centralized power and battery backup. Simpler network design — fewer IP addresses and switch ports required.
• Disadvantages: Long cable runs to remote doors (up to 500 feet for Wiegand readers, 4,000 feet for RS-485 modules). More wire labor and materials. A controller failure can take many doors offline simultaneously.

Distributed Architecture

In a distributed design, controllers are placed near the doors they manage. A PoE network door controller, for example, can be mounted near the controlled opening and powered from the nearest network switch. Each controller is an independent network device with its own IP address.

• Advantages: Short cable runs from controller to door hardware. Simpler door-level wiring. A single controller failure only affects 1–2 doors. PoE-powered controllers eliminate the need for separate power supplies at each location.
• Disadvantages: More network devices to manage (each controller needs a switch port and IP address). More distributed points of failure in the network layer. Controllers in ceilings and above doors are harder to physically access for maintenance.

Hybrid Approach

Many real-world deployments use a hybrid approach. Central controllers can handle high-density floors where doors are close together, while distributed network controllers can serve remote or isolated openings where home-run cable would be impractical.

Before mixing controller architectures, verify that the selected access-control platform supports each exact device, firmware version, and license type in the same deployment.

Network and Power Infrastructure

Access control hardware requires two infrastructure systems: data communication and power distribution. Failures in either will take doors offline.

Data Communication

• Ethernet (TCP/IP): Connects intelligent controllers to the access control server. Standard CAT5e or CAT6 cabling. Each controller requires a unique IP address and a port on your network switch.
• RS-485: Connects downstream expansion modules and reader interfaces to the head-end controller. Shielded twisted pair, up to 4,000 feet. Supports daisy-chain and multi-drop topologies with up to 32 devices per bus.
• Wiegand / OSDP: Connects readers to controllers. Wiegand uses a 4-6 conductor cable (D0, D1, power, ground, LED, buzzer) with a maximum run of about 500 feet. OSDP uses RS-485 with a maximum run of 4,000 feet.

Power Distribution

• 12/24V DC Power Supplies: Traditional controllers like the Mercury MP1502 require an external power supply, typically mounted in the same enclosure. The power supply also feeds the door locks and readers through the controller.
• PoE (Power over Ethernet): Axis controllers draw power from the network switch over the Ethernet cable. PoE (802.3af) provides up to 15.4W, and PoE+ (802.3at) provides up to 30W. This is sufficient to power the controller and one lock in most configurations.
• Battery Backup: Critical for fail-safe locks (maglocks) that release when power is lost. A UPS or in-enclosure battery backup keeps the system running during power outages. Size the battery for at least 4 hours of standby operation.

Cybersecurity in Access Control Hardware

Access control hardware is increasingly a target for cyberattacks. Controllers are networked devices running operating systems and firmware. If compromised, an attacker could unlock doors remotely, extract cardholder data, or use the controller as a pivot point into the corporate network.

Modern hardware addresses this with several security features:

• TLS 1.2/1.3 Encryption: Protects communication between the controller and the access control server. Prevents man-in-the-middle attacks on the network.
• OSDP Secure Channel (AES-128): Encrypts communication between the reader and the controller. Prevents credential interception at the reader cable.
• FIPS 140-3 Compliance: The Mercury MP1502 uses FIPS 140-3 validated OpenSSL cryptographic modules. This is a federal standard for cryptographic hardware.
• Secure Boot (ARM TrustZone): Ensures the controller only runs authenticated firmware. Prevents tampering with the controller’s operating system.
• Axis Edge Vault (CC EAL6+): Axis controllers include a hardware-based cryptographic computing module for secure key storage and device identity.
• AES-256 RS-485 Encryption: Current-generation expansion modules (Mercury S3 series, Lenel S3 series) encrypt the RS-485 bus between the controller and downstream modules.

When specifying hardware, prioritize devices that support encrypted communication at every link in the chain: server to controller (TLS), controller to reader (OSDP Secure Channel), and controller to expansion modules (AES RS-485). Legacy hardware that communicates in the clear is a security liability.

Choosing the Right Hardware for Your System

The right hardware depends on three factors: what software platform you run, how many doors you need to control, and whether you value platform independence.

Transparent Pricing for Access Control Hardware

If you manage your own access control system and have the technical capability to install hardware, Rapid Security Hardware offers access control boards to end users, facilities managers, IT teams, and purchasing departments with transparent pricing and free shipping.

Each product page states the item condition, current inventory, shipping options, and applicable RSH guarantee. Use the compatibility tools or contact a specialist before ordering if the board label or platform requirements are unclear.

Free standard shipping on every order. Overnight shipping $30 flat. Business-day Orders placed now ship Monday, October 19.

Related Reading

• Mercury Security Boards & Panels: Complete Buyer's Guide: MP1502, MR52, MR16IN — how the boards connect and the installation mistakes that cause most callbacks.
• Lenel Card Readers: How to Add a Door to Your OnGuard System: LNL-1300-S3 reader protocol compatibility and installation guide.
• Mercury MP1502 Replacement & Expansion Guide: Detailed specs, compatibility info, and how to order the MP1502 direct.