The access control was perfect – the door stood open for six hours

Access control knows who opened the door. It does not know whether the door was closed again. See how alarm sensors, alarm zones and auto-disarm catch forced entries without false alarms and show when a door is standing open.
7 min

A technician opens the door to a plant room at 08:12. Everything is exactly as it should be: valid key, right person, right time window. The log is impeccable.

Then he wedges a fire extinguisher in the door, because he needs to carry things in and out.

At 14:30 he drives home. The fire extinguisher is still there.

The access control did everything right and noticed nothing. It knows who opened the door. It does not know whether anyone closed it.


Four things a lock cannot see

Door left open

The lock was opened legitimately. The door simply never got closed again.

Forced open

The door was opened without a matching unlock. Somebody got in by a route other than the key.

Lock jammed

The lock tried to move and could not. The door may not be locked at all right now.

Low battery

The device is running down. Not yet a problem – but it is going to be.

All four happen after or around the access decision the system made. Which is why they have to be measured at the door itself.

With an alarm sensor on the door, SnapKey records the second as an incident and shows whether the door is standing open and how the sensor's battery is doing. With a SnapGate door contact, SnapKey also reports the first two – a door left open and a forced door – and can raise an alarm; detecting a forced door also needs an exit button on the SnapGate's second input. A jammed lock is not something SnapKey detects.


Alarm zones: the sensor and the lock need to know about each other

The classic reason door sensors end up switched off is false alarms. The sensor shouts every time an employee with valid access walks through. After two weeks it is permanently disarmed, and then it protects nothing.

The answer is to tie the sensor to the locks in the same physical area. That grouping is an alarm zone.

Each alarm sensor is attached to an alarm zone, and the locks belonging to that zone can trigger auto-disarm:

Sensor state: ARMED
   │
   ├─ Legitimate unlock of a lock in the alarm zone
   │      └──► Sensor disarms automatically
   │           (no alarm – this was the point)
   │
   └─ Door opens WITHOUT an unlock in the zone
          └──► Incident: Forced open

With auto-disarm enabled, the sensor disarms automatically when someone with a SnapKey user unlocks a lock in the connected alarm zone. The sensor stays disarmed until it is re-armed – from the app by the person who unlocked, or by a manager – so remember to re-arm it when the area is left. An unlock by a key holder without a SnapKey user – a fob-only holder, for example – does not disarm the sensor. The alarm only fires when someone enters in a way that does not correspond to an access.

That single setting decides whether your sensors are still running in six months.


Armed and disarmed

A sensor can be armed and disarmed manually — for instance when an area is under construction and would otherwise alarm all day.

The system records when the sensor was armed and when it was disarmed. It sounds like a detail, but it is the log that answers the question when something goes wrong: was the monitoring even switched on that evening?

A sensor left disarmed that nobody remembered to re-arm is the most common reason an incident never gets recorded at all.


Forced open without a matching access is the critical signal

Of the four, forced open is the one that changes something immediately.

In general, the others are warnings: a door left open is usually carelessness, a jammed lock is usually wear, a low battery is a job for Friday.

A forced open without a matching key access is different. It means the door was opened and the system cannot account for how. That incident is recorded – as critical when the sensor also reports tampering – and calls for investigation straight away.

It is also the type that becomes a candidate for a regulatory case if the site falls under NIS2 or CER. And because the incident carries a timestamp from the moment the sensor saw it, there is a documented moment of detection from which to count the 24-hour deadline.

Set against purpose sessions, the picture sharpens further: if there was an active session at the location, a forced open is probably a technician who used the wrong door. If there was none, it is something else.


Low battery is prevention, not a fault

It is tempting to treat battery warnings as noise. They are the opposite.

The CER regime requires preventive measures — measures that stop incidents arising. A sensor that runs flat at an unstaffed pumping station leaves a blind spot – and its battery level was on the sensor page before it did. At sites with neither mains power nor a network the sensors run wirelessly on batteries — including on top of an existing iLOQ system.

Each sensor shows its battery level and is flagged as low before it runs flat, so the warning is in front of you while there is still time to act.


How to set it up

  1. Define alarm zones by physical area – not by the org chart. A zone is a place, not a department.
  2. Attach each sensor to its zone, and check that the locks people actually use to enter the area belong to that zone.
  3. Enable auto-disarm wherever there is normal traffic. This is the single most important setting.
  4. Leave auto-disarm off in areas where no access is normal – remote sites, emergency exits, sealed rooms.
  5. Review disarmed sensors monthly. A sensor that has been disarmed for four weeks is a blind spot, not a setting.

FAQ

What is an alarm zone?

A physical area that a sensor monitors and that one or more locks belong to. That association is what allows a legitimate unlock to disarm the sensor automatically instead of raising an alarm.

How do we avoid false alarms?

By enabling auto-disarm. When someone with a SnapKey user unlocks a lock in the connected alarm zone, the sensor disarms automatically, so their traffic raises no alarm. A fob-only holder without a SnapKey user does not disarm it.

What is the difference between "forced open" and "door left open"?

Forced open means the door was opened without a matching unlock – someone got in around the access control. Door left open means the opening was legitimate, but the door was not closed again afterwards.

Can we tell whether a sensor was armed when something happened?

Yes. The armed and disarmed timestamps are stored, so it can be established whether monitoring was active at the relevant time.

Does a forced entry have to be reported to the authority?

It depends on whether it amounts to a significant incident under NIS2 or a significant disruption under CER. The assessment is yours – but the incident can be escalated into a regulatory case with the associated deadlines if the answer is yes.


Contact us

Want to see the open door before it has stood open for six hours? Contact SnapKey.