Government access control is the set of physical and digital security frameworks that protect public-sector facilities, classified information, and critical infrastructure. It enforces federal compliance rules and requires high-assurance authentication, which is what separates it from the access control used in a typical office building.
That distinction matters more than most buyers expect. A government access control system is not just a stronger version of a commercial one. It is a compliance discipline. The credentials, the hardware origins, and the way the system is configured all have to satisfy federal standards like FIPS 201-3, FICAM, and NDAA Section 889 before the doors ever lock.
We install access control for federal, state, and local government facilities nationwide, and the pattern is consistent: the technology is rarely the hard part. The compliance and procurement layer is. This guide explains how government access control works, the standards that govern it, the hardware rules that disqualify the wrong equipment, and how to buy and install a system that actually passes review.
Key Takeaways
- Credentials are the foundation. Federal facilities authenticate people with PIV and CAC smart cards under FIPS 201-3, not the plain proximity cards most commercial buildings use.
- Compliance is a chain, not a checkbox. It runs HSPD-12 to FIPS 201-3 to OMB M-19-17 to FICAM to the GSA Approved Products List, and a system has to satisfy the whole chain.
- NDAA Section 889 bans specific hardware. Cameras, and the networked readers and controllers tied to them, that carry components from banned manufacturers disqualify a government install, even if everything else is correct.
- Buying compliant hardware is necessary but not sufficient. A system purchased off the GSA Approved Products List still fails review if it is configured incorrectly in the field by an unqualified integrator.
- Procurement vehicle access matters as much as capability. An agency can only buy through the contracts it is approved to use, so the contractor has to hold the right purchasing agreements.
Have a security project?
What Is Government Access Control?
Government access control is a physical access control system (PACS) that manages entry to public-sector buildings and the federal identity credentials that authorize each person. The National Institute of Standards and Technology defines a physical access control system as the electronic system that controls the ability of people to enter a protected area through authentication and authorization.
There are two layers worth separating. Physical access control governs doors, gates, turnstiles, and elevators. Logical access control governs networks, applications, and data. Government facilities tie the two together through a shared identity credential, so the same smart card that opens a secure door can also log a user into a federal system. This guide focuses on the physical side and the identity layer underneath it.
A government PACS uses the same core components as any commercial system: credentials, readers, door controllers, management software, and electrified locks. The difference is what each component has to comply with. For the general mechanics of how these parts work together, our guides on types of access control systems and commercial access control systems cover the fundamentals. The sections below focus on what changes when the building belongs to the government.
Why Government Facilities Are Held to a Higher Standard
Government facilities carry federal mandates, classified-area rules, and hardware-origin restrictions that commercial buildings never face. A private office decides its own security policy. A federal building inherits its requirements from law and federal directive, and failing to meet them can stall a project or void a contract.
Scale is part of the challenge. The federal real-property inventory spans hundreds of thousands of buildings and facilities nationwide, ranging from single field offices to large secured campuses. Each one has to align its access control to its risk level and the rules that apply to it.
The harder problem is organizational. On a typical government project, several parties touch the access control system: a general contractor, an electrical subcontractor, a procurement officer, and the agency’s own security staff. Each one can assume someone else owns compliance. That gap is where non-compliant systems get installed, because the people specifying and wiring the equipment often do not know the federal credential requirements exist.
Compliance also cascades downward. Federal standards like FIPS 201 and FICAM are written for federal agencies, but state and local governments frequently adopt the same frameworks, either by mandate or because they are the proven baseline. Law enforcement facilities add another layer through the Criminal Justice Information Services (CJIS) Security Policy, which sets access requirements for any building that handles criminal justice data. Our government security systems overview covers the agencies and facility types involved.
Federal Credentials: PIV, CAC, and PIV-I
Government access control runs on smart-card credentials that carry cryptographic keys and biometric data, not the simple badge numbers used in most commercial buildings. These credentials prove identity to a high assurance level before a door ever opens. Three credential types cover almost every scenario.
- PIV (Personal Identity Verification): The standard credential for civilian federal agencies, issued under FIPS 201-3. A PIV card holds a personal identification number, cryptographic keys, and biometric templates.
- CAC (Common Access Card): The Department of Defense version of the PIV credential, issued to military personnel, DoD civilians, and contractors. It follows the same FIPS 201 foundation.
- PIV-I (PIV-Interoperable): A credential issued by non-federal organizations that is technically interoperable with, and trusted alongside, federal PIV cards. It lets contractors, state agencies, and private partners carry a credential that federal systems can recognize.
Readers authenticate these cards through mechanisms defined by federal guidance, including PKI authentication that validates the card’s cryptographic certificate and biometric checks that match the cardholder to the stored template. The reader hardware itself has to be capable of this. Standard proximity readers cannot validate a PIV credential, which is why credential-grade readers from manufacturers like HID are common on government projects.
Compliance Standards That Govern Government Access Control
Government access control compliance is a connected chain of directives and standards, not a single rule. It starts with a presidential directive and ends with an approved-products requirement, and a compliant system has to satisfy every link. The chain runs in this order:
HSPD-12 (2004) → FIPS 201-3 → OMB M-19-17 → FICAM → GSA Approved Products List.
Homeland Security Presidential Directive 12 ordered a common, secure identity standard for federal employees and contractors. NIST turned that directive into FIPS 201, now in its third revision. The Office of Management and Budget directed agencies how to implement identity management through memoranda like M-19-17. FICAM, the Federal Identity, Credential, and Access Management framework, ties those credentials to physical and logical access. The GSA Approved Products List then names the specific products tested to meet the standard.
These are the standards a government access control system most often has to meet.
| Standard | What it governs | Why it matters for access control |
|---|---|---|
| HSPD-12 | The common federal identity credential | Establishes the requirement that PIV credentials exist at all |
| FIPS 201-3 | PIV credential and authentication requirements | Defines the smart card, its data, and how readers authenticate it |
| FIPS 140-3 | Cryptographic module validation | Required for network-connected access control devices and software |
| FICAM | Federal identity, credential, and access management | Connects credentials to building and system access |
| FISMA | Federal information security program management | Sets the security and risk framework agencies operate under |
| OMB M-19-17 | Agency identity management implementation | Directs how agencies modernize and manage identity |
| NIST SP 800-116 | PIV use in physical access | Maps credentials and authentication factors to facility risk |
| CJIS | Access to criminal justice information | Adds requirements for law enforcement facilities |
FIPS 201-3 took effect on January 24, 2022, and is the version current systems are measured against. FIPS 140-3 matters because most modern access control runs over a network, and any device handling cryptographic operations has to use a validated module.
Access Control Models Used in Government
Government access control uses four models to decide who is allowed through which door: MAC, DAC, RBAC, and ABAC. The model determines how access rights are assigned and enforced, and high-security facilities often combine more than one. These are the four types referenced across federal security guidance.
| Model | How access is decided | Government use case |
|---|---|---|
| Mandatory Access Control (MAC) | Central authority assigns security labels such as Confidential, Secret, and Top Secret | Classified areas where clearance level dictates entry |
| Discretionary Access Control (DAC) | The resource owner grants access at their discretion | Lower-sensitivity shared spaces |
| Role-Based Access Control (RBAC) | Access is tied to a person’s job role | The everyday workhorse for assigning agency staff permissions |
| Attribute-Based Access Control (ABAC) | Access depends on attributes like role, time, location, and clearance | Dynamic, high-security environments needing fine-grained rules |
A complete access control process moves through five stages regardless of model: authorization, authentication, accessing, management, and audit. For the deeper mechanics of each model and how they apply outside government, our guide on types of access control systems covers them in full.
Have a security project?
Facility Security Levels and Authentication Factors
Government facilities set their access requirements by Facility Security Level (FSL), a rating from I to V assigned through the Interagency Security Committee risk process. A higher FSL means a higher-consequence facility, which means stronger authentication at the door. The framework connects the building’s risk to the number of credentials a person must present.
Inside a facility, spaces are categorized by sensitivity, and each category requires a different number of authentication factors:
- Controlled areas require one authentication factor, such as a valid credential.
- Limited areas require two factors, such as a credential plus a PIN.
- Exclusion areas require three factors, adding a biometric to the credential and PIN.
The three factor types are something you have (the card), something you know (a PIN), and something you are (a biometric). NIST Special Publication 800-116 lays out how these map to security areas. Systems can be deployed as standalone installations at a single building or as enterprise platforms that manage credentials and access across many facilities from one place.
NDAA Section 889 and TAA: The Hardware Rules
Federal law bars government buyers from purchasing video surveillance and telecommunications equipment built with components from specific banned manufacturers, and that restriction reaches the access control systems those components sit inside. Section 889 of the 2019 National Defense Authorization Act prohibits federal agencies, and recipients of federal grant funding, from buying covered equipment from Hikvision, Dahua, Huawei, ZTE, and Hytera. The ban reaches any product containing those companies’ covered components, not just their branded devices.
This rule bites access control specifically because the prohibited components show up inside the cameras integrated with a system and the networked parts of readers and controllers. A single non-compliant device can disqualify an otherwise well-designed system, and the violation often is not obvious because the banned component sits inside a third-party product. The Trade Agreements Act (TAA) adds a separate country-of-origin requirement for equipment bought through GSA Schedule contracts.
This is one of the most common ways a government project goes wrong, so we specify NDAA-compliant options on every government install and verify component origins before equipment reaches the site. Our pages on NDAA-compliant security and Hikvision NDAA compliance explain which products qualify and why the distinction matters.
Modern Enhancements: Biometrics, Mobile Credentials, and AI
A credential authenticates the card, not the person holding it, so government systems increasingly add biometrics and analytics to close that gap. Lost or borrowed badges and tailgating, where an unauthorized person follows an authorized one through a door, are the leading real-world breach methods even when the credential system works perfectly.
Biometrics answer this by tying access to the person. Facial, iris, and fingerprint authentication confirm identity at the door, and FIPS 201-3 includes facial image biometrics among its approved authentication methods. In Exclusion areas, a biometric becomes the required third factor alongside the card and PIN. Analytics layered on the camera feed can also flag tailgating in real time, turning the access control system into an active monitor rather than a passive log.
A few enhancements are becoming standard on government projects:
- Mobile credentials let a phone act as the credential through platforms that support government identity requirements, reducing the cost and risk of lost physical cards.
- OSDP readers replace the legacy Wiegand protocol with an encrypted, two-way connection between reader and controller, which is the modern secure standard.
- Unified intrusion and access control put door events and alarm events on one platform, so a forced door and an unauthorized entry surface in the same view.
Visitor management is its own requirement at most government facilities, covering check-in, watch-list screening, and escort tracking. We cover it in depth in our guide to visitor management systems for government.
How to Buy and Install a Compliant Government Access Control System
Buying a compliant government access control system is necessary but not sufficient. Purchasing hardware off the GSA Approved Products List does not make a facility compliant. The system still has to be configured correctly in the field, and agencies regularly fail compliance review even with approved equipment because the installation was done wrong. Compliance is an integration competency, not a product you can buy off a shelf.
That reframes how to evaluate the project. The most common failure mode is the low-cost-bid trap: a general contractor or electrical subcontractor who has never heard of PIV or FICAM defaults to the cheapest system that opens a door, and procurement reuses an outdated spec that never mentioned federal requirements. The system gets installed, and the problem only surfaces at review.
Three steps prevent it:
- Specify federal compliance explicitly in the RFP. Name FIPS 201-3, FICAM, and NDAA Section 889 as requirements, and require every bidder to provide a written certificate of compliance.
- Require a qualified integrator. The lead designer on a federal PACS project should hold a Certified System Engineer ICAM PACS (CSEIP) credential or equivalent. This is the single clearest signal that a contractor understands the standards.
- Confirm procurement vehicle access. An agency can only buy through contracts the contractor is approved to use, so verify the purchasing agreements before the technical evaluation, not after.
That last point is often the deciding one. Our procurement approvals cover CMAS, GSA Schedule 84, BuyBoard, Sourcewell, OMNIA Partners, and PEPPM, part of a roster of more than 15 purchasing vehicles that decides whether an agency can put us on contract in the first place. Our procurement programs page lists the current vehicles.
On the technical side, the work is as much about the credential layer as the hardware brand. We install federal-grade platforms from HID, LenelS2, Brivo, Avigilon Alta, ASSA ABLOY and Schlage, and Genetec, and match each system to the facility’s Facility Security Level and compliance mandate instead of standardizing on one product line. On project after project, the constant has been treating compliance as part of the install phase, not a checkbox bolted on at the end, which is what separates a system that passes review from one that does not. Our government case studies show how that plays out on real public-sector projects, and our access control installation page covers the broader service.
Budget for the full system, not just the hardware. Total cost of ownership on a government project includes readers and controllers, software licensing, secure network cabling, integration labor, and the compliance documentation itself. Our access control cost guide breaks down the line items. Legacy facilities can usually migrate in phases, running old and new systems in parallel rather than replacing everything at once.
Also read: AI Weapons Detection for Government
Frequently Asked Questions
What are the four types of access control?
The four types of access control are Mandatory Access Control (MAC), Discretionary Access Control (DAC), Role-Based Access Control (RBAC), and Attribute-Based Access Control (ABAC). MAC uses central security labels, DAC lets the resource owner grant access, RBAC ties access to job roles, and ABAC decides access from attributes like role, time, and clearance.
What is FICAM compliance?
FICAM compliance means a system meets the Federal Identity, Credential, and Access Management framework, which governs how federal agencies issue identity credentials and connect them to physical and logical access. It builds on FIPS 201 and ensures that credentials like PIV cards are trusted and validated consistently across facilities and systems.
What is the difference between PIV and CAC?
PIV (Personal Identity Verification) cards are issued to civilian federal agency employees and contractors, while CAC (Common Access Card) cards are the Department of Defense version issued to military personnel, DoD civilians, and contractors. Both follow the FIPS 201 standard and use the same smart-card and authentication foundation.
Does NDAA Section 889 apply to access control systems?
Yes, when the equipment carries covered components. NDAA Section 889 bans federal agencies and grant-funded buyers from purchasing video surveillance and telecommunications equipment with components from Hikvision, Dahua, Huawei, ZTE, and Hytera. That reaches access control hardware, including the cameras and the networked readers and controllers integrated with a system, when a banned component is embedded inside, even in a third-party product.
What are the five steps of access control?
The five steps of access control are authorization, authentication, accessing, management, and audit. Authorization defines who may enter, authentication verifies identity at the door, accessing grants or denies entry, management maintains credentials and permissions, and audit logs and reviews every entry event.
The Bottom Line
Government access control is a compliance discipline built on top of doors and readers. It runs on federal smart-card credentials (PIV, CAC, and PIV-I), follows the chain from HSPD-12 through FIPS 201-3, FICAM, and the GSA Approved Products List, and lives or dies on hardware that satisfies NDAA Section 889. The technology is well understood. Getting it specified, purchased through the right vehicle, and configured correctly in the field is the real work.
Safe and Sound Security designs and installs compliant government access control systems nationwide, approved on 15+ government procurement vehicles and stocked with NDAA-compliant options for federal, state, and local facilities. If you are scoping a project and want to make sure it passes review the first time, get in touch with our team.
Have a security project?
Sources
- NIST FIPS 201-3, Personal Identity Verification of Federal Employees and Contractors
- GSA IDManagement.gov: Physical Access Control Systems
- NIST Computer Security Resource Center Glossary: Physical Access Control System
- GSA: Homeland Security Presidential Directive 12
- NIST Special Publication 800-116 Revision 1: Guidelines for the Use of PIV Credentials in Facility Access
- NIST Computer Security Resource Center: Federal Information Security Modernization Act
- FBI Criminal Justice Information Services (CJIS)
- Federal Acquisition Regulation 52.204-25: Prohibition on Covered Telecommunications and Video Surveillance Equipment
