Define the conditions separately
“Works offline” is too broad to be useful on its own. A local controller may continue recognising existing credentials while new invitations stop arriving. A management service may be unavailable even though the building’s internet connection is healthy. A door mechanism can develop a physical fault while every dashboard indicator remains normal. Name the condition before discussing the response.
Create a short dependency map covering power, network links, controllers, communication services and people. For each resident-facing function, identify what it needs and what remains possible when that dependency fails. Keep the detailed technical information controlled, while providing residents with a simpler explanation of available support and any expected change to their routine.
Understand local decisions and delayed changes
Where a controller holds authorised permissions locally, normal entry may continue during a network interruption. This is implementation-specific and must be demonstrated. Ask what happens to schedules, event records and credential expiry during a prolonged outage. Check how the device handles time synchronisation and how administrators know its information is current after reconnection.
Permission changes are a separate question. A lost credential may remain usable at an isolated controller until an authorised update reaches it. The building team needs a documented escalation route that recognises that limitation. Do not promise instant revocation unless the actual operating conditions support it, and never publish sensitive response details in general resident notices.
Distinguish power continuity from exit safety
A backup power supply can support selected equipment for a designed period, but a battery label does not establish the runtime of the complete entrance. Readers, controllers, locks, intercoms, network equipment and powered accessibility features may have different supplies. A competent professional should assess the load, monitoring, maintenance and replacement arrangements as a coordinated system.
Terms such as fail-safe and fail-secure describe aspects of equipment behaviour, not a universal answer for a building. Entry control and safe escape must be assessed together under the applicable fire strategy and requirements. Never alter locking, release or fire interfaces based on a general article. Use the responsible building and fire-safety professionals for decisions affecting life safety.
Plan for personal exceptions too
A broken phone or misplaced fob is not the same as a building-wide outage. Give residents a clearly explained assistance route, including what happens outside normal office hours. Verification should be proportionate and respectful, without encouraging staff to waive agreed safeguards under pressure. Any alternative access arrangement must be authorised and suitable for the specific building.
Consider people whose support arrangements change unexpectedly. A carer covering a different shift or a resident returning from hospital may need an adjustment that a rigid default schedule cannot accommodate. Assign authority for timely decisions and offer communication in accessible formats. Record only the information necessary to manage the request, not a detailed personal history.
Practise controlled recovery
Tests should be planned, authorised and coordinated with the building’s responsible people. Avoid disrupting occupied entrances or life-safety functions merely to demonstrate resilience. Where appropriate, use a test environment or a supervised maintenance window. Explain anticipated effects to residents and make sure people who need additional assistance are not left to discover the change at the door.
Recovery matters as much as the initial fault. Confirm that controllers reconnect, pending permissions reconcile and clocks and records are consistent. Review temporary arrangements and remove those no longer required. A service being marked “online” does not prove every resident-facing function is restored. Include a small set of agreed functional checks before closing the incident.
Keep a continuity plan people can use
ISO 22301 provides a business-continuity management framework, while ISO/IEC 27001 addresses information security management. These are useful organisational reference points, not guarantees of door availability. The National Cyber Security Centre also publishes incident-management guidance. Translate relevant principles into a short building-specific plan with roles, escalation contacts and communication responsibilities.
Review the plan after incidents, supplier changes and significant equipment updates. Record what residents experienced, not only what the technical service reported. Include an exit strategy for discontinued cloud services and unsupported products. Resilience is a maintained ability to respond and recover; it is not a permanent property conferred by buying connected hardware.