Top 10 questions to ask an access control installer

We have been installing access control in Orange County since 1984, which means we have also spent four decades fixing other people's installs. The pattern behind almost every mess we inherit is the same: nobody asked the installer hard questions before signing, because nobody knew which questions to ask.

So here is the list we would use if we were the ones buying. These are the questions that make a professional relax, because they finally get to talk about the things they do right, and make a corner-cutter squirm. For each one we will tell you why it matters, what a good answer sounds like, and the red flags to walk away from.

1. What California licenses do you hold, and can I verify them?

In California, access control installation is licensed work. The wiring side falls under the Contractors State License Board: a C-10 Electrical classification, or a C-7 Low Voltage Systems classification for energy-limited systems under 91 volts. If the company also sells, installs, or monitors alarm systems, it additionally needs an Alarm Company Operator (ACO) license from the Bureau of Security and Investigative Services. Unlicensed contracting on jobs over $500 is illegal, and it also usually voids any recourse you would have when things go wrong.

A good answer: the license number is on the truck, the proposal, and the website, and the estimator says "look us up on cslb.ca.gov" before you can ask. Ours is on every quote we send.

Red flags: "we work under a partner's license," "you don't need a license for low voltage" (you do, above the handyman threshold), or a license number that comes back inactive, suspended, or belonging to a different company name. Any of these ends the conversation.

2. Are you insured, and will you send me the certificate?

Access control work means ladders, ceilings, drilling into door frames, and technicians inside your building for days. If someone gets hurt or a wall gets flooded from a drilled pipe, the installer's general liability and workers' compensation coverage is what stands between that accident and your own policy. California requires contractors with employees to carry workers' comp, and the CSLB lookup shows whether it is on file.

A good answer: "we'll have our carrier send a certificate of insurance naming you as the certificate holder." That request takes an insurance agent ten minutes, and any legitimate contractor handles it constantly for property managers and general contractors.

Red flags: a photocopied certificate that is a year old, hedging about whether the people on site are employees or "guys we bring in," or irritation at the request. The companies that resist paperwork before the job are the same ones you cannot reach after it.

3. Will the readers be wired with OSDP or Wiegand?

This one question tells you more about an installer's technical currency than anything else on the list. Wiegand is the legacy wiring protocol between the reader and the controller. It is one-way, unencrypted, and unsupervised, which means the card data crosses that wire in the clear and the system cannot tell if someone has tampered with the reader. Devices that skim Wiegand data at the reader are cheap and well documented. OSDP, the newer SIA standard, runs supervised two-way communication over RS-485 and supports encryption between reader and controller, so the reader can be monitored for tampering and the credential data is not readable off the wire.

A good answer: "OSDP by default, with secure channel enabled, and here's why." Bonus points if they explain what your existing wiring can support, since OSDP's cabling requirements differ from old Wiegand runs and an honest installer will tell you when reuse is possible and when it is not.

Red flags: a blank look at the word OSDP, or "Wiegand is fine, everyone still uses it." Plenty of legacy Wiegand is still in service, and it is defensible on an interior storage room. Proposing it in 2026 for your exterior doors without even raising the alternative is not.

4. Fail-safe or fail-secure, door by door, and how does this meet fire code?

Every electrified door fails one of two ways when power drops. Fail-safe hardware unlocks on power loss; fail-secure hardware stays locked from the outside while still allowing free exit from the inside. Getting this wrong in one direction leaves your building unlocked in every outage. Getting it wrong in the other direction can trap people, and that is where fire code stops being abstract. The California Building and Fire Codes require free egress: occupants must be able to exit without keys, tools, or special knowledge. Electromagnetic locks in particular come with strict conditions, including release on fire alarm activation and on power loss, and specific sensor or push-to-exit release hardware on the egress side.

A good answer: a door-by-door walk of your building. "This stairwell door gets a fail-safe electrified lever because it's on the exit path. This server room gets fail-secure with a request-to-exit sensor and free mechanical egress. The lobby mag lock ties into your fire alarm panel, and that interface work is in the quote." Egress direction and locking direction are different questions, and a professional talks about both.

Red flags: one blanket answer for the whole building, a mag lock proposal with no mention of the fire alarm tie-in, or "we can skip the fire marshal on this one." An installer casual about egress is gambling with your occupants and your occupancy permit at the same time.

5. Who owns the software account and the data in it?

Cloud access control runs on an account somewhere: pdk.io, Brivo Access, Verkada Command. Someone is the owner of that account, and if it is the installer rather than you, then your user list, your door schedules, and your event history live under their login. We have taken over buildings where the previous provider held the account hostage during a billing dispute, and the customer could not add an employee badge to their own front door.

A good answer: "the account is created in your name, you hold owner-level admin, and we're added as a service integrator you can remove whenever you like." That is how we set up every system we install, because a customer who stays with us out of satisfaction is worth more than one who stays out of captivity.

Red flags: "we manage all that for you" with no straight answer on ownership, or a contract clause that ties account access to an ongoing service agreement. Ask the question in writing and keep the reply.

6. What are the monthly and annual fees, exactly, and what happens if I stop paying?

Cloud platforms carry recurring licensing, and the structures vary a lot: Brivo publishes per-door monthly tiers, Verkada sells multi-year door licenses, and PDK is quoted per project through the installer. None of that is a problem. The problem is a quote that buries the recurring cost, or a salesperson who quotes the entry tier while the features you actually asked for live two tiers up. We compared the three platforms' pricing shapes in our PDK vs. Brivo vs. Verkada guide if you want the details.

A good answer: a line-item breakdown showing hardware, labor, and recurring software separately, the tier named, the features in that tier listed, and a plain statement of what happens at non-renewal. On most platforms the doors keep working locally but you lose remote management; you should hear that from the bidder, not discover it.

Red flags: "the software is included" with no term stated, first-year fees waived to hide the ongoing number, or an answer about lapsed licensing that amounts to "that never happens." Everything recurring belongs on paper before you sign.

7. When something breaks, how fast do you show up, and what does it cost?

The install is a week. The service relationship is a decade. A stuck-open exterior door or a failed controller is not a next-month problem, and this is where big national outfits and one-truck operations both tend to disappoint: the national firm routes you through a call center to whichever subcontractor is available, and the one-truck shop is on a job in another county. Ask for the actual mechanics: who answers the phone, what the target response time is for an emergency versus a routine call, whether remote diagnosis happens first, and what a service visit costs after warranty.

A good answer: specific numbers and a local address. Same-day or next-day emergency response from technicians based in the county, a stated warranty period on labor and hardware, and published service rates. Being based in Dana Point with our own techs is exactly why we can say same-day for South Orange County, and an installer near you should be able to make an equivalent commitment.

Red flags: "we'll get someone out as soon as we can," no stated warranty, or a service department that is really the owner's cell phone. Also ask who did the last three service calls; if the answer is a rotating cast of 1099 subs, the person fixing your system will not be the person who installed it.

8. Can I talk to customers with buildings like mine?

References are only useful when they match your situation. A glowing review from a two-door dental office says little about how the installer will handle your six-building industrial park, and vice versa. Access control for a medical suite, a warehouse, and a multi-tenant office are different jobs with different failure modes, and you want evidence the bidder has done yours before.

A good answer: two or three named customers with a similar building type and door count who agreed to take a call, plus photos of comparable completed work. When you call, skip past "were they nice" and ask what went wrong during the job and how it was handled. Something always goes wrong; the recovery is what you are buying.

Red flags: "our references are confidential," references who all turn out to be residential jobs, or online reviews that only mention lockouts and rekeys. A shop that is mostly a commercial locksmith can be excellent at that trade, and we run one ourselves, but door hardware skill does not automatically translate to networked access control design.

9. Who pulls the permits?

Electrified hardware on exit doors, mag locks, delayed egress, and fire alarm interface work typically require permits and inspection, and Orange County cities each have their own quirks about low-voltage and fire-related permits. Unpermitted work has a way of surfacing at the worst time: a fire inspection, an insurance claim after an incident, or escrow when you sell the building. At that point the fix costs more than the permit ever would have.

A good answer: "we pull the permits, the cost is in the quote, and we meet the inspector." The installer should know your city's process from experience, and scheduling the fire marshal walk-through is their job, not yours.

Red flags: "permits are the owner's responsibility" (an installer offloading their own work), "this doesn't need a permit" said before anyone has looked at your egress doors, or a price that undercuts every other bid by exactly the cost of doing it right. Unpermitted bids look cheaper because they are incomplete.

10. What do I get at handoff, and who trains my people?

The day the installer leaves, somebody in your office becomes the system administrator: adding new hires, deleting departed ones, changing holiday schedules, running a report when something goes missing. If that person was never trained, one of two things happens. Either every small change becomes a paid service call, or nobody removes anyone and three years later two dozen ex-employees still have working credentials. We see the second one constantly during takeovers, and it is quietly the biggest security hole in most buildings.

A good answer: a scheduled training session for your admins on your live system, a documentation package with door schedules, wiring notes, and panel locations, admin credentials handed to you (see question 5), and a phone number for the questions that come up in week two. Labeled wiring and a documented panel are also what make the next service call fast and cheap, whoever performs it.

Red flags: "it's really intuitive, you'll figure it out," no as-built documentation, or training sold as an add-on after the contract is signed. An installer who keeps you dependent for every badge change did not build you a system; they built themselves an annuity.

How to use this list

Do not turn the meeting into an interrogation. Pick the questions that matter most for your building, weave them into the site walk, and pay attention to how the answers arrive as much as what they contain. A professional has answered all ten a hundred times and enjoys the chance; the specifics come out fast, unprompted, and in plain English. Evasion, annoyance, or a pivot back to the discount that expires Friday tells you the rest.

And get the answers that matter in writing: the license number, the insurance certificate, the account ownership terms, the recurring fees, and the warranty. A bidder who will say it but not write it has told you which parts were true. Then compare quotes on the same scope, using our cost guide as the baseline, and pick the company you can picture answering the phone in year five.