Access Control has become


Information Technology


Change control is another shared responsibility that needs a clear decision maker. A routine network change, certificate renewal or software upgrade can interrupt badge processing, camera recording or alarm delivery even when no device has physically failed. Before a significant change, teams should identify the affected security functions, agree a maintenance window, confirm a rollback plan and test the service from the operator's point of view. A technically successful change is not successful if guards cannot receive alarms or staff cannot enter the building.


These responsibilities should be agreed before commissioning. Trying to establish ownership after an alarm platform or access control service has failed wastes the time needed for containment and recovery.


A career opportunity


The regulatory direction makes this more concrete. The Terrorism (Protection of Premises) Act 2025, commonly known as Martyn's Law, received Royal Assent on 3 April 2025.


Duty holders will need accurate procedures, clear responsibilities and controlled records. Enhanced duty premises and qualifying events will have additional documentation requirements. Keeping that material current and protected is an information management responsibility as well as a protective security responsibility.


Separately, the Cyber Security and Resilience (Network and Information Systems) Bill has completed its Commons stages and is being considered by the House of Lords. Among other measures, it would bring certain managed service providers within the regulatory framework. Suppliers that remotely manage security


technology should therefore examine whether their particular services could fall within scope rather than assume that all remote maintenance is treated in the same way.


Client due-diligence questions are already moving in this direction. Security providers may be asked how they manage privileged credentials, control supplier access, protect operational records and escalate suspected compromise. Clear, evidence- based answers can strengthen a provider's position during procurement and contract review.


The licensing regime has accepted the broader principle that competence requires renewal. Refresher training became mandatory for door supervisor and security guard licence renewals on 1 April 2025 and for close protection renewals on 1 April 2026. Terror threat awareness forms part of that training.


Cyber literacy belongs in the same continuing-development cycle. For anyone developing a career in security, this creates a practical opportunity.


Professionals who can understand what an integration does, identify the operational consequences of a technical failure and translate between an IT director, an installer and an operations team are likely to become increasingly valuable.


Choosing useful training


Favour courses that teach principles that can be applied across manufacturers. Vendor certification has a place, but it generally teaches one supplier's platform rather than the thinking behind secure administration. Recognised foundation material provides a better starting point.


The National Cyber Security Centre publishes free introductory training and guidance, while the Cyber Essentials


© CITY SECURITY MAGAZINE – AUTUMN 2026 www.citysecuritymagazine.com >


control set offers a short framework and shared vocabulary for discussions with IT colleagues. NPSA and ProtectUK also provide protective security guidance without charge, and professional bodies can support structured continuing professional development.


Treat any course marketed as making somebody cyber qualified in one day with suspicion. It is equally mistaken to assume that every physical security professional needs a full cyber security qualification. The realistic goal is enough knowledge to ask useful questions, recognise a poor answer and escalate to the right specialist. That can be developed through a few months of deliberate learning reinforced by involvement in real system reviews.


In conclusion


None of this requires a new department. It extends the same habits of ownership, documentation and rehearsal that the profession already applies to keys, patrols and incident response to the connected systems sitting behind them. The lock on the door has not changed much. Almost everything behind it has.


Vishnu Gatla


Senior Application Security and Infrastructure Consultant


www.f5.com


26


Page 1  |  Page 2  |  Page 3  |  Page 4  |  Page 5  |  Page 6  |  Page 7  |  Page 8  |  Page 9  |  Page 10  |  Page 11  |  Page 12  |  Page 13  |  Page 14  |  Page 15  |  Page 16  |  Page 17  |  Page 18  |  Page 19  |  Page 20  |  Page 21  |  Page 22  |  Page 23  |  Page 24  |  Page 25  |  Page 26  |  Page 27  |  Page 28  |  Page 29  |  Page 30  |  Page 31  |  Page 32  |  Page 33  |  Page 34  |  Page 35  |  Page 36