To successfully create a tender for access control, a detailed needs analysis, consideration of legal frameworks such as the GDPR and relevant standards such as DIN EN 60839-11-1, as well as VdS guidelines, are essential. A precise specification of services, clear evaluation criteria, and an emphasis on manufacturer independence are decisive for selecting a future-proof system and a qualified installer.

Sound planning for future-proof access control systems

Creating a tender for access control systems is a complex task that goes far beyond technical specifications. It requires a strategic approach to create long-term value, minimise risks, and ensure legal compliance. Independent planning is decisive here.

Key Takeaways

  • A sound needs analysis and a precise specification of services are decisive for the success of your access control tender.
  • Compliance with the legal framework (GDPR) and technical standards (DIN EN 60839-11-1, VdS 2358) is essential for legal compliance and security.
  • Manufacturer independence and independent consulting, as offered by PLANATEL®, minimise risks and secure a future-proof, cost-efficient solution free of manufacturer dependency.

A modern access control system not only protects sensitive data and critical infrastructure from unauthorised access, but also contributes significantly to the safety of employees and assets. The decision for such a system, and its implementation, begins with a carefully prepared tender. This is the cornerstone for a system that meets your company's current and future requirements while also fulfilling all statutory requirements. Strategic, manufacturer-independent planning is the key to success here.

Article image: Zutrittskontrolle Ausschreibung erstellen - hero

The strategic importance of a sound access control tender

Implementing an access control system is an investment that goes far beyond the mere purchase of hardware and software. It affects operational processes, data security, and compliance with legal requirements. An inadequately prepared tender can lead to considerable follow-up costs, system incompatibilities, and insufficient protective effect. It is therefore of strategic importance to shape the tender process with the utmost care and expertise.

A well thought-out specification of requirements that precisely defines the specific requirements and protection objectives forms the basis for a successful award. It enables potential providers to develop tailored solutions and avoids misunderstandings that could later lead to costly rework. Strategic planning takes into account not only current needs, but also future extensions, integration possibilities with other systems such as fire alarm systems or time-recording, as well as the scalability of the solution. This ensures that the system remains flexible throughout its entire life cycle and meets the company's changing requirements. Without such forward-looking planning, there is a risk of investing in a short-lived or inefficient solution that does not meet actual security needs. PLANATEL® supports you in getting these strategic decisions right from the start and making a viable, long-term decision.

Fundamentals of the needs analysis: what must your access control achieve?

Before a tender can be formulated, a comprehensive needs analysis is essential. This analysis defines in detail which functions the access control system must fulfil and which specific protection objectives are to be achieved. It is about drawing a clear picture of the current situation and the desired future state. This includes identifying all areas requiring protection, defining different user groups (employees, visitors, service providers), and setting their respective access permissions, who may go where, and when.

A central aspect is the integration of the access control system into the existing IT infrastructure and other building management systems. Should the system, for example, communicate with time-recording, building control, or fire alarm systems? Such interfaces must be identified and precisely described at an early stage. Furthermore, the physical conditions of the access points must be taken into account, such as the type of doors, gates, or barriers, the number of access points, and the identification media required (e.g. RFID cards, biometric methods, mobile solutions). A sound needs analysis minimises the risk of planning errors and ensures that the tendered system is precisely tailored to your company's specific requirements. PLANATEL® accompanies you through this critical phase, to systematically capture all relevant aspects and translate them into a clear requirements profile.

The planning and operation of access control systems in Germany, Austria, and Switzerland are subject to a large number of legal frameworks and technical standards. Compliance with these regulations is of the greatest importance not only for safety, but also for legal compliance and avoiding liability risks. A central body of rules is the General Data Protection Regulation (GDPR), since access control systems process personal data. Companies must ensure that all data collected is processed lawfully, for a specific purpose, and stored securely. This includes the principles of data minimisation and transparency, and the establishment of automated deletion mechanisms for access logs.

In addition to the GDPR, technical standards and guidelines must be observed. DIN EN 60839-11-1 (VDE 0830-8-11-1), for example, sets requirements for the systems and equipment of electronic access control systems and governs safety requirements as well as operating characteristics. In addition, the VdS guidelines, such as VdS 2358 "Guidelines for access control systems, Part 1: Requirements", provide important specifications for planning, installation, and operation. DIN EN 13637 is also relevant for escape and rescue routes, defining requirements for electrically controlled emergency exit systems. Taking these standards and guidelines into account in the tender is decisive for obtaining a system that meets the highest safety standards and guarantees full insurance coverage in the event of a claim. PLANATEL® has the expertise to integrate these complex bodies of rules into your tender documents and to ensure legal compliance.

Article image: Zutrittskontrolle Ausschreibung erstellen - mid

Technical specifications and system architecture in the tender

The technical specification of services is the heart of every access control tender. It must formulate precisely and unambiguously which components and functions the system should have. This includes the detailed description of the hardware, such as identification media (e.g. RFID transponders, smart cards, biometric scanners), readers, control panels, and door terminals. The software components, including the management software for permissions, logging, and reporting, must also be exactly specified. It is important here to pay attention to open interfaces and standards, in order to enable future extensions and integration with other systems, and to avoid manufacturer dependency.

Another critical point is the system architecture. Should it be a centralised or decentralised system? What requirements exist for fail-safety, redundancy, and the security of data transmission? Defining security grades in accordance with DIN EN 60839-11-1 is just as relevant here as specifying measures against manipulation and cyberattacks. The tender should also take into account aspects such as scalability, ease of maintenance, and the possibility of remote maintenance. A detailed description of these technical specifications ensures that offers are comparable and that the selected system meets your company's high technical requirements. PLANATEL® prepares a technically sound and manufacturer-independent specification of services for you that takes all relevant details into account.

The tender process: from the specification of services to the award

The tender process for access control systems is a multi-stage procedure that requires a systematic approach, in order to guarantee transparency, fairness, and the selection of the optimal provider. It begins with the preparation of a detailed specification of requirements, which precisely describes the client's functional and non-functional requirements. In accordance with DIN 69901-5, the specification of requirements defines the totality of the demands placed on the deliverables and services of a contractor. This document forms the basis for the specification of services published in the tender.

After the tender is published, the offer-submission phase follows, in which potential contractors present their solutions and prices. A careful offer review is decisive here. This should cover not only the costs, but also the technical feasibility, compliance with the specifications, the provider's references, and their service offerings. Clear and objective evaluation criteria must be set in advance and communicated in the tender, to enable a transparent and comprehensible decision. Common mistakes, such as imprecise wording or missing evaluation criteria, can lead to delays and suboptimal results. PLANATEL® supports you in structuring the entire tender process, from preparing the schedule of services to the final award decision, and ensures that all steps proceed in a legally compliant and efficient way.

Manufacturer independence and independence as a success factor

A critical success factor in tendering access control systems is the absolute manufacturer independence and financial independence of the consulting partner. Many companies fall into manufacturer dependency when they commit too early to a particular solution or provider. This can lead, in the long term, to higher costs, limited flexibility for extensions, and a weaker negotiating position. Manufacturer-independent planning means that the selection of the system is based exclusively on the client's objective requirements and is not influenced by commissions or partnerships with particular manufacturers.

PLANATEL® has operated as an independent planning and consulting company since 1992 and guarantees this neutrality. We receive no commissions from manufacturers or installers. Our focus is solely and exclusively on our clients' interests. This enables us to select the most suitable technology and the most qualified provider for your specific project, without having to compromise on functionality, security, or economic efficiency. We analyse the market, evaluate different systems objectively, and recommend the solution that best meets the defined requirements. This independence is your guarantee of a future-proof and cost-efficient access control solution, free of unnecessary manufacturer dependency, giving you maximum freedom to shape the future.

Common mistakes and best practices in tendering access control

Creating a tender for access control systems is complex, and certain mistakes recur that can jeopardise the success of the project. A common mistake is the inadequate definition of the protection needs and security objectives. Without a clear idea of exactly what is to be protected and against which threats, the requirements can be either excessive or inadequate. This leads to unnecessary costs or insufficient protection. Another mistake is the use of overly general wording in the specification of services, which leaves providers too much room for interpretation and makes offers difficult to compare.

Best practices, by contrast, emphasise the need for a detailed risk analysis in advance, in order to determine the actual protection needs. The specification of services should be functionally and technically precise, without, however, prescribing manufacturer-specific products. It is advisable to reference recognised standards and guidelines, in order to create objective evaluation criteria. Another best practice is the early involvement of all relevant stakeholders, including the works council, to ensure employment-law aspects and acceptance of the system among employees. In addition, the tender should cover not only implementation, but also aspects such as maintenance, support, training, and the system's life-cycle costs. PLANATEL® helps you avoid these pitfalls and create a tender based on best practices that secures the success of the project.

Project management and quality assurance after the award

The process is not complete once the contract has been awarded; rather, the decisive phase of implementation and quality assurance begins. Effective project management is essential here, to ensure that the access control system is delivered on time, within budget, and in accordance with the tendered specifications. This includes continuous monitoring of project progress, coordination between all parties involved, from the installer through the IT department to the end users, and the management of potential risks and changes.

Quality assurance includes regular checks during the installation phase and a final, comprehensive acceptance of the system. Here, it is checked whether all functions were implemented as described in the specification of requirements, whether system performance meets expectations, and whether all legal and normative requirements are met. Detailed documentation of the system, including circuit diagrams, configurations, and maintenance instructions, is of great importance for later operation and servicing. PLANATEL® also accompanies you during this phase as an independent partner, monitors implementation, carries out operational-principle tests, and ensures that acceptance of the system takes place objectively and in the client's interest. We also plan maintenance concepts and support you in selecting certified installers, to guarantee the long-term, trouble-free operation of your access control system.

Article image: Zutrittskontrolle Ausschreibung erstellen - bottom

Next step

Contact us for a non-binding initial consultation.

PLANATEL®: Independent planning and consulting since 1992
Tel: 040 / 23 73 02-30
Email: info@planatel.de

Frequently asked questions

Why is independent consulting so important when tendering access control?

Independent consulting ensures that the selection of the access control system is based exclusively on your company's specific requirements and objectives. Without ties to manufacturers or commission interests, an independent consultant can objectively identify the best solutions on the market, formulate technical specifications neutrally, and avoid manufacturer dependency. This leads to a future-proof, cost-efficient solution, optimally tailored to your needs, that will last in the long term and avoid unnecessary follow-up costs. PLANATEL® has offered this kind of independent expertise for more than 34 years.

What cost factors must be taken into account when planning an access control tender?

The costs for an access control system are made up of various factors. These include the acquisition costs for hardware (readers, control panels, identification media) and software licences, installation costs (including electrical work and door conversions), as well as ongoing costs for maintenance, support, software updates, and, where applicable, training. The costs for integration into existing systems and adaptation to new legal requirements should also be factored in from the outset. A detailed cost analysis as part of the tender is decisive for planning the overall budget realistically.

How can a tender ensure the scalability and future-proofing of an access control system?

To ensure scalability and future-proofing, the tender should explicitly formulate requirements for open interfaces, modular system architectures, and compatibility with future technologies. The possibility of easily extending the system with additional access points, users, or functions must be taken into account, as must the system's ability to adapt to new security standards and legal requirements. Forward-looking planning that anticipates technological developments and potential business expansions is decisive here. PLANATEL® helps you anchor these aspects precisely in the specification of services.

What role do biometric methods play in modern access control systems, and how are they to be assessed under data-protection law?

Biometric methods such as fingerprint or facial recognition offer a high degree of security and convenience, as they are based on unique physical characteristics. They can increase security, but are also associated with heightened data-protection requirements, since biometric data is considered especially sensitive personal data. The GDPR requires a particularly careful review of necessity and proportionality here, as well as compliance with strict technical and organisational measures to protect this data. A data-protection impact assessment is generally required.

How does PLANATEL® support companies in creating a tender for access control?

PLANATEL® offers comprehensive support in creating tenders for access control systems. Our services include a detailed needs analysis, the preparation of a precise specification of requirements and specification of services, consideration of all relevant legal frameworks and technical standards, as well as the definition of objective evaluation criteria. We always act in a manufacturer-independent and financially independent way, in order to find the best possible solution for your company. We also accompany the entire tender process through to the award, and support the quality assurance of the implementation. Our more than 34 years of experience guarantees you sound, future-proof planning.

Which standards are relevant for access control systems?

For access control systems, DIN EN 60839-11-1 (requirements for systems and equipment), DIN EN 60839-11-2 (application rules), and VdS 2358 (guidelines for access control systems) are particularly relevant. In addition, the requirements of the GDPR must be observed, since personal data is processed.

What is the difference between access control and access rights management?

Access control (Zutrittskontrolle) refers to the physical control of access to buildings or rooms, in order to prevent unauthorised entry. Access rights management (Zugangskontrolle), on the other hand, governs digital access to IT systems and data, in order to keep out unauthorised users or computers. Both are important components of a comprehensive security concept.

How long may data from access control systems be stored?

In accordance with the principles of the GDPR, personal data from access control systems may only be stored for as long as is necessary for the specified purpose (e.g. duration of employment for access permissions, or for emergency management). Automated deletion mechanisms must be established, to guarantee data minimisation.

What role does the works council play in introducing access control?

The works council has a co-determination right under section 87(1) no. 6 of the Works Constitution Act (BetrVG) when access control systems that can monitor employee behaviour or performance are introduced or designed. Early involvement and coordination are decisive, to avoid employment-law conflicts and to promote acceptance of the system.

Sources and further information