Building Electronic Access Control

Layout for printing
Policy Number:
UW-404
Responsible Office:
UW-Madison Police Department

University Policy

Rationale/​Purpose:

This policy codifies the use of electronic access control through a single centralized access control system to protect lives, research and property at the University of Wisconsin–Madison. Centralized electronic access control is used to enhance safety and security of the University through integrating best practices with appropriate equipment, technology, and physical security measures. The policy outlines the requirements for installation, required areas for electronic access control, daily operations and practices, and responsibilities. The existence of this policy or electronic access control does not alleviate any responsibilities for University personnel, students, or contractors for the security and maintenance of any electronic access control credentials and/or physical keys issued to them.

This policy is in place to:

  • Enhance the safety and security of all people using University of Wisconsin–Madison facilities.
  • Enhance the safety and security of all research, physical and intellectual property at the University of Wisconsin–Madison.
  • Ensure disparate electronic access control systems are not installed and used at the University unless expressed written permission is provided by the Associate Vice Chancellor (AVC)/Chief of Police.
  • Ensure proper authorizations are in place for granting access to specific areas.
  • Ensure compliance with Federal, State, and University of Wisconsin Technical Guidelines and applicable building and fire codes.
  • Provide direction to contractors and units or divisions for planning to add electronic access control to University facilities in whole or part.
Definitions:
Access door
Any physical opening into or within a building that utilizes electronic locking hardware connected to the Central Access Control System (CACS) and may have a card/credential reader to permit authorized access during locked times.
Administrator
University personnel responsible for the high level functions of the CACS including the ability to add authorized users and assign those users roles and permissions within the system for their assigned areas.
Cardholder
University of Wisconsin-Madison student, staff, faculty, affiliate, contractor, or other authorized person with the need to access university space controlled by the CACS and who is issued a credential in the form of an ID card, fob, authorized biometric or other approved device for the CACS. This person does not have the ability to make any changes in the access control system.
Electronic access control
A system that remotely controls entry and egress points of a room(s), area(s), or building(s) utilizing doors/access points with electronic locking mechanisms, doors with electronic locking with a reader to authorized cardholders access during locked periods, and doors that are locked at all times allowing egress only.
Electronic key control system
a secure cabinet for storing physical keys that utilizes electronic access to obtain keys from the cabinet and, where possible, shall be connected to the CACS.
Major project
New construction, additions, major remodeling project, or utility improvements with a budget of $3 million or more.
Non-capital project
Additions, remodeling or other improvements with a budget under $185,000.
Significant project
New construction, additions, remodeling project, or utility improvements with a budget less than $3 million.
User
Authorized user with direct access and training on the central access control system application. The user has the ability to grant and removes access, to adjust schedules, or modify programs based on roles and permissions assigned to the user by an administrator.
UW–Madison
The University of Wisconsin–Madison.
Scope:

The policy is applicable to current and future UW–Madison and UW System sites and facilities located at UW–Madison that use electronic access control, including spaces leased from UW–Madison and space leased to UW–Madison which fall under the operational jurisdiction of the UW–Madison. Additionally, the policy applies to all facilities that add electronic access control after the effective date (including all new construction that incorporates electronic access).

The policy applies to all personnel, schools, colleges, departments, offices and other divisions of the University of Wisconsin-Madison and all private companies leasing space within UW–Madison facilities after the policy’s effective date as well as private companies adding electronic control after the policy’s effective date.

This policy applies to all Wiscard and/or access control system credential/card holders.

This policy applies to all architects, all contractors, vendors or third parties providing work on an area described in Scope.

Exemptions to this policy include:

  • Private companies leasing space within UW–Madison facilities or UW–Madison Police Department (UWPD) jurisdiction with their own access control and/or security system in place before this policy’s effective date.
  • University owned hotel rooms using electronic key cards and locks for accessing hotel rooms; however, these spaces are strongly encouraged at the next remodel to utilize a compatible visitor management system and switch to the CACS to provide better security and streamline the ability to enter authorized areas (e.g., exterior door(s) of the building with the hotel rooms, elevators to the hotel floor(s) etc.)
  • Those receiving an explicit written exemption from the AVC/Chief of Police.
Policy:
  1. The Centralized Access Control System (CACS) shall be utilized for electronic access control on required access points and other access points where electronic access control meets a specific security need.
    1. The CACS may utilize authorized credentials (e.g., card, badge, fob, etc.), approved biometrics, or pin together with either an authorized credential or biometric.
      1. Pins may not be utilized without multifactor authentication at the access point.
    2. The CACS shall be used for all electronic access control points unless the access point meets the criteria in Scope V.
    3. Wireless or stand-alone locking systems or similar must have approval for use by UWPD, FP&M, and DoIT prior to install. Wireless approved systems must be compatible with the campus card access system. No wireless systems will be used for exterior perimeter doors or other areas deemed high security/sensitive by occupants or UWPD unless no other option is feasible, and only with prior authorization by UWPD.
      1. Stand-along locking systems may not be used in required areas as listed in I.3.A. and must have an exemption from the AVC/Chief of Police.
    4. In facilities adding Electronic Access Control, it is required in the following areas:
      1. Exterior points of entry (electronic locks for the purpose of remote lock/unlock on all specified doors, and using card/credential reader as needed for sensible traffic flow dependent upon building size and occupancy), as well as all remaining exterior doors designated for egress or emergency exit only with request to exit devices as needed and door position switches,
      2. Access to animal care areas,
      3. Access to high security areas, including as mandated by federal and/or state regulations and guidelines,
      4. Sensitive and critical mechanical spaces,
      5. Telecom, MDF/IDF, elevator, and server rooms,
      6. Those rooms deemed necessary by UWPD or building occupants due to security concerns (e.g., personnel, medical or other sensitive records, stairwells, etc.)
    5. All Major Projects shall include electronic access control on required areas, as specified in I.2 and 4, and shall not be removed from a project without explicit documented permission from the AVC/Chief of Police or designee.
      1. The placement of electronic access control shall be done in consultation with designated personnel from the UW–Madison Police Department (UWPD).  Any communications regarding electronic access control must include the designated UWPD personnel.
      2. If any UW personnel or contractors removes required electronic access control points from the major project plans without explicit permission from the AVC/Chief of Police or designee, then the employing unit, department, division or company shall be responsible for any additional costs incurred to install the required electronic control access points.
    6. All Significant Projects and Non-Capital Projects shall consult with designated UWPD personnel to see if the project covers any areas where electronic access control is required.
      1. Any areas of the project requiring electronic access control as decided by designated UWPD shall have electronic access control installed as part of the project unless explicit documented permission is given by the AVC/Chief of Police or designee.
    7. All schools, colleges, divisions, departments, units or private entities leasing space from UW–Madison may request the installation of CACS on access points within their control.  Any such request must be made to UWPD.  
      1. Designated UWPD personnel, and as needed Physical Plant and Fire Safety personnel, will meet with the requesting entity to review and clarify the request.
      2. UWPD will provide a report to the entity detailing mandatory requirements and potential options regarding utilizing the CACS.  
      3. Any adjustments to a project adding the CACS must be reviewed by UWPD, and as needed, FP&M and Fire Safety personnel.
    8. All electronic access control installations shall comply with Federal, State, and/or University of Wisconsin–Madison Technical Guidelines and the applicable building and fire codes.
  2. Required access controlled doors shall be keyed with a UWPD high security keyway for manual override by emergency responders.  The override key shall not be available to non-UWPD personnel unless, and at the sole discretion of UWPD, the school, division or department meet and maintain the following criteria, including any potential associated costs:
    1. The facility is equipped with a UWPD approved Electronic Key Control System (EKCS) which is networked to UWPD and allowing UWPD designated personnel to have remote access to the EKCS, and the EKCS is programmed to alarm and/or send a notification to UWPD if the override key is removed from the EKCS.
    2. For each such facility, up to two people per facility, with written authorization from the current dean or director with primary use of the facility, may be granted access to the override key in the EKCS.
    3. The override key may only be removed by these designated personnel in the event of a significant emergency or CACS outage where electronic access at the door level has failed.
    4. Authorization for access to the override key may be revoked at any time by the Dean or Director for any reason and by UWPD for failure to adhere to this policy or the Master Key Policy.
    5. The school or division that authorized access will be responsible for any costs associated with re-keying all electronic access points if the personnel last removing the override key does not return the key within a reasonable amount of time or has lost possession of the override key.
    6. Classroom doors that have been placed on the CACS may be keyed with the classroom key unless there are additional security requirement, in which case, the UWPD high security keyway shall be utilized.
  3. Schools, divisions, departments or units with CACS doors not deemed as required by UWPD may be required to cover the costs for maintenance of the electronic access hardware related to those doors, including, but not limited to, the building controllers.
    1. This includes spaces where access control may be bypassed through other entry routes into the space that are not covered by the CACS.
    2. This includes CACS doors that do not utilize the UWPD high security keyway (except classroom doors on CACS may utilize the classroom key)
  4. Any biometric system used with the CACS must be approved by both DoIT and UWPD and must be compatible with the current CACS. Biometrics may be used to grant access without an additional credential unless required by federal, state or local regulations.
  5. Door Configurations:
    1. As technology, standards and regulations change, the configuration list may change dependent upon new federal or state regulations and changes in available technology. When this occurs, appropriate changes shall be made to the technical guidelines.  Technical Guidelines are maintained by Capital Planning and Development.
    2. Classroom locking options shall be ADA and International Fire Code Compliant.
    3. Unauthorized or unapproved hardware installed by end-users will be removed, and replaced with authorized hardware as needed or required and paid for by the school/college/division/building responsible for the unauthorized hardware.
  6. Emergency Key Box:
    1. All new construction with electronic access control shall include a recessed emergency key box with a tamper switch that will be wired into the CACS.
    2. All remodeling projects that involve the addition or upgrade to a fire alarm system, sprinkler system or access control system shall have a recessed emergency key box with a tamper switch that will be wired into the CACS (preferred) or Fire Control system if CACS is not available in the facility.
    3. Any emergency key box installed shall have an override key switch located at the fire alarm control panel.
    4. The type and brand of emergency key box installed shall be the ones approved by the FP&M Environment, Health & Safety Unit.
  7. Electronic Key Control System (EKCS)
    1. All new construction projects shall include at least one standard electronic key control system. The electronic key control system shall store keys for use by first responders, departmental users, and physical plant staff.
    2. The EKCS shall be networked with the ability for UWPD Infrastructure Security staff to update access to keys within the EKCS.
    3. When possible, the EKCS shall be integrated into the CACS.
    4. Unless authorized by UWPD, master keys or higher level keys shall be stored in an EKCS for that facility, if one has been installed in the facility.  Those requiring access to the master key shall be granted access through the EKCS.
      1. Master key(s) and higher level keys shall be returned to the EKCS before the person checking them out leaves the building.  The person checking out the master key(s) and higher level keys is responsible for the security and return of the master key(s) and higher level keys.
      2. Any person with access to the master key(s) and higher level keys from the EKCS is responsible for adhering to the Master Key Policy.
  8. Responsibilities
    1. Card Holders:
      1. Card holders shall only use the CACS to access authorized areas and follow all rules and regulations for entering the area.
      2. Card holders shall not provide their credential to anyone else to use to access areas permitted by the credential.
      3. Card holders shall not use their credential to provide access to someone they do not know, including piggy backing, or to someone who is not authorized to enter the area.
      4. Card holders shall escort their guests when required and follow all rules of the area pertaining to guests.
      5. Card holders shall not clone or duplicate their credential.
      6. Card holders not abiding by this may have their access revoked, face University disciplinary sanctions and/or statutory/criminal penalties.
    2. Users:
      1. User shall complete any required training to appropriately use the CACS.
      2. Users shall use the CACS only to make authorized changes within the scope of their work.
      3. Users shall not share data from the CACS outside of the scope of their work with other persons.
      4. Users shall not publically release any data from the system without prior authorization from UWPD in consultation with UW–Madison Legal and/or UW Madison Records Custodian as needed.
      5. Users shall not use the CACS for personal gain.
      6. Users may not use the CACS to track anyone outside of officially sanctioned work requirements or to harass, to stalk, or to commit a crime against someone.
      7. Users not abiding by the policy may have their CACS permissions revoked, face University disciplinary sanctions and/or statutory/criminal penalties.
    3. University of Wisconsin – Madison Police Department (UWPD)
      1. The UWPD shall oversee and coordinate the use of the CACS.  All university units supporting electronic access control will provide full transparency of operations to UWPD.
      2. Designated UWPD staff will consult and coordinate with other entities planning access-controlled installations whether required or optional, including new construction or other projects.
        1. Fire Safety Personnel will be consulted in areas where CACS may impact egress as required by fire code.
        2. FP&M and DoIT will be consulted as needed depending on the scope, complexity and network needs of the project.
      3. UWPD will coordinate procurement of components.
      4. The AVC/Chief of Police or designee will review all requests to release access control related records as UWPD is the record holder for the CACS.
      5. The AVC/Chief of Police or designee may grant exceptions to policy.
      6. The AVC/Chief of Police or designee will be the administrator of the CACS.
    4. Division of Information Technology (DoIT)
      1. DoIT will manage the network and server infrastructure associated with the CACS.
      2. The Vice Provost/CIO or designee will review and approve for technology.
      3. Consult as needed on access control projects/installations that impact the UW–Madison technology infrastructure.
    5. Facilities Planning and Management (FP&M)
      1. FP&M is responsible for, and has authority over, construction activities in all UW–Madison buildings and to ensure installations are both code compliant and meet University standards.
      2. Request for repair, maintenance, and replacement of access control equipment may be done by Physical Plant or a designated access control integrator.
      3. Designated staff from Environmental Health and Safety, Space Management, Capital Planning and Development and/or Physical Plant will consult as needed on access control projects/installations.
    6. Policy Governance
      1. The AVC/Chief of Police, the Vice Provost/CIO of DoIT, and the Associate Vice Chancellor for FP&M, or designees from each of the above, shall comprise the access control working group, which will periodically review this policy, and recommend changes to the approval authority when warranted.
      2. UWPD and Facilities Planning & Management shall cooperatively maintain technical guidelines and standards for electronic access control and physical security measures based on currently available technology and best practices. These technical guidelines will be reviewed annually by access control staff.
      3. The approval authority for this policy is the Vice Chancellor for Finance and Administration.
Related UW-Madison Policies:
Related UW–Madison Documents, Web Pages, or Other Resources:
External References:

Policy Administration

Approval Authority:
Vice Chancellor for Finance and Administration
Policy Manager:
Chief of Police
Contact:
Infrastructure Security Lieutenant -- Jeffrey Ellis, Jeffrey.ellis@wisc.edu
Effective Date:
12-01-2020
Date Issued:
11-01-2020
Retrieved:
04-27-2024 03:00:27