Operational and cybersecurity guidance for credentials, readers, controllers, doors, integrations, and access platforms.
Operational and cybersecurity guidance for credentials, readers, controllers, doors, integrations, and access platforms.
CISA Update A revises critical guidance for Johnson Controls C-CURE 9000 and victor. Review CVE-2026-21655, adjacent-network exposure on port 8999, affected versions, fixed releases, and temporary mitigations.
Read the briefing
A cardholder export shows what the system grants, not what a person still needs. Have accountable role and area owners affirm required access, challenge exceptions, remove stale grants, and verify the controller received the change.
Read the playbook
Door behavior during loss of server, network, controller communication, reader, lock power, or fire-interface state must be designed—not discovered. Test each distinct door safely against approved life-safety and security requirements.
Read the checklist
A mechanical key can bypass identity, schedules, revocation, alarms, and audit trails. Govern high-impact keys with named ownership, least privilege, controlled issue, inventory, return, loss response, and periodic proof of custody.
Read the playbook
A call button that rings once is not a commissioned entry workflow. Verify intelligible two-way audio, visual and identity context, correct release, network and power loss, unanswered-call escalation, accessibility, privacy, and operator action.
Read the checklist
Biometric matching has false matches and false non-matches, while spoofing, environment, enrollment, demographics, privacy, and fallback shape real risk. Pilot the actual population and workflow before treating a biometric as trusted access.
Read the guide
Water can disable power, communications, access control, video, servers, cabling, and safe building entry at once. Map exposure, protect critical equipment, define isolation and life-safety procedures, preserve evidence, and rehearse recovery.
Read the checklist
A perimeter fails at transitions: washed-out grade, loose fabric, a culvert, utility opening, wall junction, temporary repair, unsecured gate edge, climbable object, corrosion, or vegetation that hides damage.
Read the checklist
Security personnel should protect life, summon authorities, establish a controlled boundary, prevent avoidable disturbance, identify witnesses, and document their own actions without attempting an untrained crime-scene examination.
Read the playbook
A visitor badge is only one moment in a longer control. Tie every non-public visit to an approved sponsor, defined destination and time window, appropriate escort, visible credential, confirmed departure, and reviewable record.
Read the playbook