In this article

Key Takeaways
What school access control actually covers
What New Jersey requires, and what is general guidance
Step 1: Assess before you buy
Step 2: Build a controlled main entrance
Step 3: Choose the credential model
Step 4: Write the access control policy
Step 5: Manage visitors, volunteers and contractors
Step 6: Connect access control to cameras, alarms and emergency plans
Step 7: Check fire code, accessibility and privacy
Step 8: Plan total cost, training and testing
How GuardEX can help
FAQ
Sources
Recommended

School access control is the set of doors, credentials, people and procedures that decide who enters a building, where they can go and when. The strongest programs treat it as a layered system, not a product purchase: a controlled main entrance, credentials assigned by role and schedule, a visitor check-in process, and written steps for outages and emergencies. This guide walks New Jersey school administrators and facility managers through that planning process, and separates general best practice from what New Jersey rules actually say.

Key Takeaways

Start with a documented site assessment, then choose technology. Hardware follows the risks you find, not the other way around.
Funnel visitors to one controlled main entrance and verify identity, purpose, destination and authorization before anyone moves deeper into the building.
Assign credentials by role, door and time, and review the account roster on a schedule. Many gaps come from stale accounts, not missing hardware.
Write manual procedures for power, network and system outages, and test emergency and first-responder access.
Check fire code, ADA and student privacy (FERPA) before you finalize a design. No system guarantees safety or compliance on its own.

What school access control actually covers

Access control is the active management of who enters school facilities. New Hampshire’s School Safety Resource Center describes it as staff authorization, barriers, locks and related systems working together to guard against unauthorized entry, and notes it works best when layered throughout the building.

That layered view matches the federal one. CISA’s K-12 School Security Guide recommends a systems-based approach in which physical security features, personnel, policies and procedures, and training operate together rather than relying on technology alone.

In practice, a school’s access control usually includes:

Perimeter and site: fencing, gates, parking and drop-off areas, and signs that direct visitors.
Building envelope: exterior doors, door hardware, vestibules and the main office sightline to the entrance.
Interior zones: classrooms, offices, server rooms, athletic areas, and spaces that need restricted access after hours.
People and process: badges, escorts, check-in and check-out, contractor rules and staff training.
Records: door event logs, visitor records and account reviews.

What New Jersey requires, and what is general guidance

It helps to keep two buckets apart. New Jersey districts must maintain school safety and security plans under N.J.A.C. 6A:16-5.1, and the state’s minimum requirements document for those plans includes a building assessment item stating that access into each building should be controllable through designated entry points, with one entry point for visitors if possible. The same document points districts toward lower-cost procedural measures alongside technology.

Most of what follows, including credential tiers, visitor-management software and audit routines, is general best practice from federal agencies and professional bodies, not a New Jersey mandate. Several of the sources below come from other states or federal agencies. They are useful models, but your district’s own board policy, counsel, local fire official and insurer decide what applies to your buildings. Nothing here promises legal compliance or a particular insurance outcome.

Step 1: Assess before you buy

The U.S. Department of Justice’s guide to school security technologies advises districts to assess vulnerabilities, safety benefits, capital costs, site modifications, staffing, training, maintenance and repair before selecting any technology. It is an older document, but the sequence still holds: define the problem, then pick the tool.

A practical assessment covers:

Every entry point. Main entrance, side doors, gym and cafeteria doors, loading docks, portable classrooms and doors that staff prop open.
Who needs to enter, and when. Teachers, custodians, coaches, food service, bus staff, volunteers, vendors, contractors and after-hours community groups.
Sensitive areas. Main office, records, IT closets, nurse’s office, mechanical rooms and any space holding cash or equipment.
Current failure points. Lost keys, shared codes, doors that do not latch, blind spots at the entrance and badges that were never collected.
Emergency needs. How first responders get in, how doors secure quickly, and how the system behaves when power fails.

Our security site assessment guide lays out how we think about walking a property and ranking risks, and the same logic applies to a school campus.

Step 2: Build a controlled main entrance

New Hampshire’s guidance recommends one main entrance, controlled authorization before interior entry, exterior doors locked during the school day, signs directing visitors to the main entrance, and a secure vestibule. Those recommendations are a common template, and they are consistent with the single-visitor-entry idea in New Jersey’s plan requirements.

What that looks like day to day:

Exterior doors stay closed and secured during the school day, with any exceptions written down.
A camera and intercom or video door station lets office staff see and speak to a visitor before releasing the door.
A vestibule or reception counter keeps visitors out of hallways until they are cleared.
Signs at every other door direct people to the main entrance.
Staff are trained not to hold doors for people they do not recognize, and not to prop doors for convenience.

The tradeoff is operational. A single entrance concentrates arrivals and dismissals, so plan staffing at the front office for the busiest 15 minutes of the day, not the average one.

Step 3: Choose the credential model

The four commonly recognized access-control models are discretionary, mandatory, role-based and rule-based. Schools rarely use the terms, but the ideas map onto daily decisions. The Partnership for Assessment of Readiness for Safety in Schools (PASS) School Safety Guidelines, 7th Edition, published in 2025, says access control can combine mechanical locks with electronic systems such as controlled locks, card readers and cards, and it favors electronic systems for controlling access by time and by opening.

Approach	How it works in a school	Strength	Tradeoff
Mechanical keys	Physical keys issued to staff	Simple, works without power	Hard to track; rekeying after a lost key is slow and costly
Cards or fobs	Electronic credentials tied to a person	Can be disabled individually; logs entries	Requires account management and reader maintenance
Role-based permissions	Groups such as teacher, custodian, coach	Easier to administer at scale	Roles need periodic review as jobs change
Time- and door-specific rules	Access limited to certain doors and hours	Matches the real school schedule	More setup; exceptions must be handled
Visitor screening and badges	Check-in, ID check, printed badge	Identifies who is in the building	Depends on staff following the process

Most schools end up with a hybrid: electronic readers on exterior and key interior doors, mechanical locks where electronic hardware is not justified, and a clear map of which is which.

Security Magazine reported in 2024 that electronic credentials can be activated or revoked remotely faster than physical keys can be recovered, and that integrated systems can trigger alerts when a secured door stays open past a configured time. That speed matters most on the day an employee leaves or a card goes missing.

Step 4: Write the access control policy

A school access control policy turns the hardware into rules people can follow. A strong one covers:

Controlled entrances and which doors are open at which times.
Verification: identity, purpose, destination and authorization.
Credentials: who issues them, what each role can open, how they are returned or deactivated.
Groups: staff, students, visitors, volunteers, vendors, contractors and deliveries, each with its own rules.
Check-in and check-out: badges, escorts and sign-out.
System events: alerts, outages, student release and emergencies.

Published district procedures are good models. The procedure from Illinois’ BPS101 states that electronic screening is not authorization by itself: staff must still verify identity, purpose, destination and authorization, and may set escort or time conditions. It also requires manual procedures during outages.

Frederick County Public Schools in Maryland has a school security and facility access regulation, updated March 3, 2026, that requires exterior doors to stay secured, sends visitors to the main entrance, calls for a visitor-management entry or paper log during outages, requires government-issued photo ID for unrecognized visitors, and requires badges and sign-out.

These are examples from other jurisdictions, not New Jersey law. Have your school attorney and board review any language you adapt.

Account governance is part of the policy

The New York State Comptroller’s October 2026 audit, Building Access in Schools, identified effective practices that cost little: periodic reviews of active accounts, automatic expiration for nonemployees, deactivation linked to HR changes, updated annual rosters, and credentials for first responders. It also notes schools can often improve access management with existing reports and settings, and by setting protocols for vendor devices.

A simple governance checklist:

Name one owner for the credential roster.
Tie deactivation to HR separation and contractor end dates.
Set expiration dates on every nonemployee credential.
Review active accounts at least once per school year, and after any staffing change.
Log who approved every after-hours access grant.

Step 5: Manage visitors, volunteers and contractors

PASS recommends that every school issue visitor badges to people who are not staff or students and record visitors using government-issued identification, with badges that identify the visitor. It describes electronic visitor-management systems as tools that record who entered, when, why and whom they visited, and that can capture photographs or scan driver’s licenses and support badging and volunteer tracking.

School staff member checks a visitor’s identification

When you write requirements for a visitor management system, cover the same ground: visitor authorization, ID scanning, badge issuance, and a record of each entry and its purpose. Then decide what happens when the system is down, because the visit still needs to be logged.

Contractors deserve their own track. Consider:

Advance notice from the vendor with names of workers.
Badges that expire at the end of the job.
Escort rules for occupied areas during school hours.
A rule on whether vendor laptops or devices may connect to school systems.

Step 6: Connect access control to cameras, alarms and emergency plans

Access control is more useful when it shares information. PASS recommends district-wide visitor monitoring and alert procedures, and BPS101 requires visitor records that support accountability. Typical integrations include:

Video and intercom at entrances so staff can verify before releasing a door.
Door-held-open alerts routed to the front office or a monitoring team.
Remote lock and unlock for lockdown, lockout and dismissal.
Visitor records available to the people who run emergency accountability.
After-hours alarms tied to door events.

Integration adds dependencies. Each connected system needs its own maintenance, network security and a person who knows how to respond to its alerts. An alert nobody answers is a log entry, not protection. This is where staffing decisions come in: some campuses pair electronic controls with an on-site officer at arrival and dismissal, or with remote security monitoring and video security systems for after-hours coverage.

Step 7: Check fire code, accessibility and privacy

Security features must coexist with life-safety rules. New Hampshire’s guidance says electronic access systems should give first responders access and comply with the applicable state fire code, and recommends coordinating with public safety personnel so protective features meet ADA and fire-safety requirements. It also recommends regular audits of system operation, electronic fobs and metal keys. In New Jersey, talk to your local fire official and building code officer before you change door hardware, add delayed-egress devices or alter exit routes.

Privacy is the other check. The U.S. Department of Education’s FERPA guidance for partner organizations says schools should disclose only the student information necessary for a service, use reasonable methods to limit access to people with legitimate educational interests, and use written agreements when outsourcing institutional services. For access control, that means asking what student data the system stores, who can see it, and what the vendor contract says about it. The Department also explains that FERPA permits necessary disclosures of student-record information without consent to address emergencies, subject to its emergency provisions.

Questions to put to any vendor:

Does the system support fail-safe or fail-secure operation as your fire official requires?
What happens to doors during a power or network loss?
How are admin accounts protected, and are software updates included?
Who owns the door event data, and how long is it kept?
What training, maintenance and repair terms are included?

Step 8: Plan total cost, training and testing

The DOJ guide’s emphasis on lifecycle cost still applies. Include in your budget: hardware, installation, door and frame repairs, network and power upgrades, software licensing, maintenance, staff training and replacement credentials. Cheap readers on poorly hung doors fail in a season.

Then test it:

Walk every door and confirm it latches and locks as designed.
Test emergency and first-responder access on a set schedule.
Run drills that include the access control steps, not just the evacuation route.
Audit active credentials against the current staff and contractor list.
Revisit the configuration whenever a building, schedule or program changes.

CISA’s guide supports this loop: assess, assign credentials by role and time, test, train, exercise, then revise.

How GuardEX can help

GuardEX is a New Jersey security company that plans and installs access control systems and offers school security services built around each property’s risks and operations. We start from the site, not a product list. If you are mapping entrances and deciding what to fix first, contact GuardEX to talk through your campus.

Campuses with gates, athletic fields or after-hours use may also want to read our overview of gate security and access control, and our guide to commercial door security covers the hardware side of exterior doors.

FAQ

What are the four types of access control?

The four commonly recognized models are discretionary, mandatory, role-based and rule-based access control. Schools most often use role-based permissions (teacher, custodian, coach) combined with rule-based limits on time and door. Mechanical keys and visitor badges sit alongside them.

What should a school access control policy include?

It should define controlled entrances, how staff verify identity, purpose, destination and authorization, and how credentials are issued and deactivated. It should also cover visitors, volunteers, contractors and deliveries, plus outages, student release and emergencies. Have your attorney review it against New Jersey requirements.

Is electronic access control better than keys for schools?

PASS favors electronic systems for controlling access by time and by opening, and credentials can be revoked individually. Keys still have a role where power is unreliable or hardware is not justified. Many schools use both and document which doors use which.

Can access control replace security officers?

No. Technology records and restricts entry, but people verify visitors, respond to alerts and handle incidents. CISA’s guidance describes physical features, personnel, policies and training working together, so most plans pair them.

Access Control for Schools: A Planning Guide for NJ Campuses