Commission intercoms as audio, identity, network, and escalation systems

Source facts: remote entry combines communication with an access decision

A General Services Administration Solicitation for Offers template includes entry-security provisions for intercoms and for systems that allow employees to view and communicate remotely with visitors before permitting access. It also places visitor control and screening in the context of a building security assessment. This is a dated federal leasing template, not a current universal design standard; its value here is the explicit connection between communication, visual context, and release.

CISA’s Facility Access Control: An Interagency Security Committee Best Practice treats visitor entry as a risk-based process involving identification, screening, authorization, escort, and the PACS. An intercom can support that process, but it does not establish identity merely because someone answers a question.

Applicable accessibility, privacy, recording, telecommunications, building, fire, and licensing rules vary. The approved design and authority having jurisdiction govern door release and egress. Manufacturer and platform documentation govern supported audio, video, SIP, mobile, encryption, failover, and integration features. Commissioning must not create a claim that an intercom alone authenticates a person.

DSE recommendation: test the decision from both sides of the opening

Write the approved workflow for every call station: who may call, who answers by time of day, what visual or business context appears, what questions or sponsor verification are allowed, which opening can be released, how long it releases, what is recorded, and what happens when nobody answers. Include delivery entrances, vehicle gates, accessible routes, after-hours calls, and emergency requests.

1. Verify caller experience. From normal approach positions, test labels, lighting, reach, tactile or visual indications where required, call progress, microphone and speaker, wind and traffic noise, feedback, rain protection, and instructions. Use qualified accessibility review rather than assuming mounting height or a video screen is sufficient.
2. Verify operator context. Confirm the correct station name, camera, door, site, call priority, directory, and procedure appear on every authorized desktop, master station, or mobile client. Similar labels such as “front door” across sites invite the wrong release.
3. Test intelligibility and delay. Speak naturally in both directions with doors closed, ordinary background noise, headsets, remote networks, and representative mobile coverage. Record packet loss, clipping, echo, delay, or one-way audio. A tone and moving level meter do not prove conversation.
4. Exercise the release safely. Under approved life-safety conditions, verify the operator releases only the intended opening, receives position feedback, observes held or forced conditions, and cannot accidentally activate another site. Confirm the door relatches and the event is logged.
5. Test no-answer and failure paths. Leave calls unanswered; fail one answering client, network path, server, and normal power through approved methods; and observe overflow, local indication, alarms, degraded release, and recovery. Protect egress and provide compensating control throughout.
6. Verify security and privacy. Review accounts, least privilege, default credentials, firmware, certificates or encryption where supported, exposed services, call and video retention, notices, exports, and remote access. Limit who can listen, view, release, administer, or retrieve recordings.

Run scenario tests: an expected visitor, an unknown delivery, a caller who cannot be understood, tailgating after release, a sponsor who does not answer, an operator handling two calls, and a false call intended to distract. Grade the procedure and the technology separately so training does not hide an integration defect.

Retain station and client versions, network and power conditions, call recordings only when authorized, results, exceptions, witnesses, and restoration evidence. Retest after routing, directory, staffing, network, firmware, door hardware, or client changes. Commission the full human decision path—not simply the button.

Official references

• U.S. General Services Administration, Solicitation for Offers template, entry-security provisions.
• Cybersecurity and Infrastructure Security Agency, Interagency Security Committee, Facility Access Control: An ISC Best Practice.