Why These Terms Matter

Physical security engineering sits at the intersection of construction, IT networking, and life safety code — and each of those disciplines brings its own vocabulary into the specification. A security consultant writing a basis-of-design document, an integrator bidding a project, and an AHJ reviewing egress hardware submittals all need to be using the same words to mean the same things. Confusing a "credential" with a "reader," or "fail-safe" with "fail-secure," is not a minor semantic slip — it is the kind of mistake that gets a door installed backwards and fails a life safety inspection, or leaves a data closet unlocked during a fire alarm event.

This glossary covers 55 of the terms most frequently encountered in access control, video surveillance, intrusion detection, and integrated security system design, organized alphabetically with the standards bodies (UL, NFPA, ONVIF, BICSI, ASIS International, IEC) that define or govern each concept where applicable.

A

Access Control System (ACS) — general industry term
An electronic system that regulates who may pass through a controlled opening (door, gate, turnstile) and when, typically composed of credentials, readers, controllers, electrified locking hardware, and management software. Modern ACS platforms log every access event, enabling audit trails for compliance and incident investigation.
Analytics (Video Analytics) — see also VMS
Software, running either on the camera (edge analytics) or on a central server, that automatically interprets video content — detecting motion, counting people, recognizing license plates, flagging loitering, or triggering alarms on line-crossing. Modern deep-learning-based analytics dramatically reduce false-alarm rates compared to first-generation motion detection.
ANSI/BHMA — American National Standards Institute / Builders Hardware Manufacturers Association
The body that grades door hardware (locks, exit devices, closers) by durability and function, e.g., ANSI/BHMA A156.4 for door closers or A156.3 for exit devices. Grade 1 hardware is the highest commercial-grade rating and is typically specified for security-critical openings.
Anti-Passback (APB) — access control logic
A rule enforced by the access control system that prevents a credential from being used to enter an area a second time without first exiting, blocking "tailgating with a borrowed badge" schemes where one credential is passed back to let a second person in.
ASIS International — professional/standards body
The leading professional organization for security management, publishing widely referenced guidelines including facility physical security standards and the Certified Protection Professional (CPP) credential.
Aspect Ratio — video imaging
The ratio of image width to height, typically 16:9 for modern IP cameras or 4:3 for legacy analog. Corridor-format cameras use a rotated (9:16) aspect ratio to better cover long, narrow spaces like hallways and aisles.

B

Bit Format — credential technology
The data structure encoded on an access card, most commonly 26-bit Wiegand (the original HID open format, limited to ~137,000 unique cardholder/facility code combinations) or proprietary formats offering greater security against card cloning. Bit format compatibility must match between card, reader, and controller.
Bitrate — video/VMS
The amount of data a video stream produces per unit time (kbps/Mbps), directly driving both network bandwidth consumption and storage capacity requirements. Constant bitrate (CBR) allocates fixed bandwidth; variable bitrate (VBR) allocates bandwidth based on scene complexity, generally producing better image quality per stored byte.
Bollard — perimeter security
A short, sturdy vertical post installed to stop vehicle intrusion while allowing pedestrian passage. Crash-rated bollards are tested and certified to ASTM F2656/F2656M (formerly the DOS K-rating system), specifying the vehicle weight, speed, and penetration distance the bollard can arrest.
Bollard Rating (K-rating / ASTM Rating) — perimeter security
A crash-test classification (e.g., ASTM F2656 M30, M40, M50) describing the kinetic energy a vehicle barrier can stop, based on vehicle mass and impact speed. Higher letters/numbers indicate heavier, faster vehicles arrested with less penetration.

C

CCTV (Closed-Circuit Television) — legacy terminology
The historical term for a video surveillance system whose signal is distributed to a limited, closed set of monitors rather than broadcast. Though most modern systems are IP-based rather than truly "closed circuit," the term persists in code language, contracts, and job titles.
Codec — video compression, see also H.264/H.265
An algorithm (COder/DECoder) used to compress raw video into a manageable file size for transmission and storage, then decompress it for viewing. Codec choice is the single largest driver of storage and bandwidth requirements in a VMS design.
Credential — access control
The physical or digital token a person presents to a reader to prove identity or authorization — a proximity card, smart card, mobile credential (in a smartphone wallet), key fob, or biometric template. Credentials are distinct from readers (which accept them) and controllers (which make the access decision).
CPTED (Crime Prevention Through Environmental Design) — design methodology, pronounced "sep-ted"
A design philosophy using natural surveillance, natural access control, territorial reinforcement, and maintenance to deter crime through the built environment itself, rather than relying solely on electronic systems — e.g., landscaping that preserves sightlines, lighting that eliminates shadowed approach paths, and clear demarcation of public versus private space.

D

Door Position Switch (DPS) — access control hardware
A magnetic contact sensor mounted on a door and frame that reports the door's open/closed state to the access control panel, used to detect "door held open" and "door forced open" alarm conditions independent of the lock status.
Duress Alarm (Panic Button) — safety system
A discreet, manually activated device (often a hidden button or a specific badge sequence) that silently signals a security operations center that a person is under threat, without alerting the aggressor. Common in banks, receptionist desks, and healthcare settings.
Duty Cycle — video recording strategy
The proportion of time a camera actively records versus stands idle, ranging from continuous (24/7) recording to motion-triggered or scheduled recording. Duty cycle is a primary lever for controlling storage cost while meeting retention requirements.

E

Edge Recording — VMS architecture
Storing video directly on the camera (typically via an onboard SD/microSD card) rather than, or in addition to, a centralized NVR/server, providing redundancy if network connectivity to the recording server is lost.
Egress Hardware — life safety, see also Fail-Safe
Door hardware that guarantees free egress from a building regardless of the access control system's state, mandated by IBC/IFC and NFPA 101 — panic hardware, free-egress locksets, and request-to-exit devices all fall under this umbrella. Egress requirements always take precedence over security lockdown logic.
Electric Strike — locking hardware
An electrified replacement for a door's fixed strike plate that releases the latch bolt on command, allowing the door to be pushed open without turning the handle, while the mechanical lock itself remains unchanged. Frequently used with panic hardware since it does not need to be mounted on the door leaf itself.

F

Fail-Safe — locking hardware behavior
A locking device that unlocks automatically when power is removed (e.g., on fire alarm activation or power failure), used on doors along a means of egress path where life safety code requires the door to be freely operable during an emergency, per NFPA 101 and IBC Chapter 10.
Fail-Secure — locking hardware behavior
A locking device that remains locked when power is removed, used on doors where security must be maintained even during a power outage (e.g., a data center or vault) — provided the opening is not on a required means-of-egress path, or a mechanical override/free-egress hardware is also present.
FIPS 201 / PIV — Federal Information Processing Standard, Personal Identity Verification
The federal standard governing smart-card credentials for U.S. government employees and contractors, specifying card format, biometric enrollment, and cryptographic authentication. Commercial systems increasingly support PIV/PIV-I cards for interoperability with federal facilities.
Frame Rate (FPS) — video imaging
The number of individual images captured per second by a camera. Higher frame rates (e.g., 30 fps) smoothly capture fast motion (useful at vehicle gates or high-traffic entries) but increase storage and bandwidth demand; lower frame rates (e.g., 5-10 fps) are common for general-purpose surveillance where smooth motion is not critical.

G

Genetec / Milestone / Avigilon — leading VMS platform examples
Commonly specified commercial video management system (VMS) software platforms that aggregate camera feeds, manage recording, and integrate with access control and analytics. Platform selection drives camera compatibility (via ONVIF or manufacturer SDKs), licensing cost structure, and available analytics.
Global Anti-Passback — access control logic, see also Anti-Passback
An anti-passback rule enforced across an entire facility or campus (rather than a single door), tracking a cardholder's last known zone across all readers to prevent misuse anywhere in the system.

H

H.264 (AVC) — video codec
The most widely deployed video compression standard, balancing image quality against file size well enough to remain the de facto baseline for IP video surveillance even after newer codecs emerged.
H.265 (HEVC) — video codec
A successor codec to H.264 that achieves roughly 40-50% smaller file sizes at equivalent image quality by using more efficient compression algorithms, at the cost of higher encoder/decoder processing overhead. Increasingly the default for new high-resolution camera deployments.
Hardening — cyber-physical convergence, see also OT/IT
The process of reducing a device's or system's attack surface — disabling unused services, changing default credentials, applying firmware patches, and segmenting network access — applied to IP cameras, controllers, and VMS servers that are now full network endpoints and therefore cybersecurity assets, not just physical hardware.
Head-End — system architecture
The centralized equipment room or rack housing servers, network switches, controllers, and recording infrastructure for a security system, analogous to a telecom "head end" — typically requires dedicated power, cooling, and physical access restriction of its own.

I

Intrusion Detection System (IDS) — alarm systems
A system of sensors (door/window contacts, motion detectors, glass-break sensors, vibration sensors) that detects unauthorized entry attempts and signals a local annunciator and/or a central monitoring station, distinct from a fire alarm system though often integrated with the same head-end.
IP Rating (Ingress Protection) — IEC 60529 environmental rating
A two-digit code (e.g., IP66, IP67) specifying a device's resistance to solid particle ingress (first digit) and water ingress (second digit), critical for selecting outdoor cameras and readers that must survive rain, dust, and pressure washing.
IK Rating (Impact Protection) — IEC 62262 environmental rating
A classification (IK00-IK10) of a device's resistance to mechanical impact, used to select vandal-resistant camera domes and readers for high-risk or publicly accessible mounting locations.

L

Layers of Protection — design methodology
A defense-in-depth security design principle organizing countermeasures into concentric rings — deter, detect, delay, and respond — from the site perimeter inward to the asset being protected, ensuring no single point of failure compromises the entire facility.
Lockdown — access control mode
An operational mode, typically triggered manually or by an integrated alarm, that overrides normal access control logic to deny entry facility-wide or in defined zones, used in active-threat response protocols. Lockdown logic must still respect fire/life-safety egress overrides.
Loitering Detection — video analytics
An analytic function that flags when a person or vehicle remains within a defined zone longer than a configured threshold, commonly used for perimeter monitoring and retail loss prevention.
Lux — camera imaging spec
The unit of illuminance a camera's spec sheet uses to describe minimum scene lighting needed to produce a usable image; a lower minimum-lux rating indicates better low-light performance. 0 lux with IR illumination indicates the camera can produce usable (typically monochrome) images in complete darkness using infrared light.

M

Mantrap (Interlock / Sally Port) — access control architecture
A small vestibule with two interlocked doors, only one of which can be open at a time, preventing tailgating and enabling positive single-person verification before granting entry to a secure area — common in data centers, cash-handling rooms, and correctional facilities.
Multi-Factor Authentication (MFA) — access control, credential security
Requiring two or more independent credential types — something you have (a card), something you know (a PIN), or something you are (a biometric) — before granting access, used to harden high-security openings beyond single-factor card-only readers.

N

NVR (Network Video Recorder) — video infrastructure
A dedicated server or appliance that receives, records, and manages video streams from IP cameras over the network, as distinguished from a legacy DVR (Digital Video Recorder) that digitizes analog camera signals locally. Most modern VMS deployments run as NVR software on standard server hardware or purpose-built appliances.

O

ONVIF — Open Network Video Interface Forum
An industry standard defining a common protocol for IP camera discovery, streaming, and control, enabling cameras and VMS software from different manufacturers to interoperate. ONVIF Profile S covers basic streaming; Profile T adds advanced video and analytics metadata; Profile G covers edge storage and retrieval.
OSDP (Open Supervised Device Protocol) — access control communication, ANSI/SIA standard
A modern, encrypted, bidirectional communication protocol between access control readers and controllers, developed by the Security Industry Association to replace the aging, unencrypted Wiegand protocol. OSDP supports supervised wiring (detecting tamper or cable cuts), reader-to-controller encryption, and richer reader capabilities like LED/display control.
OT/IT Convergence — cyber-physical security
The trend of operational technology (physical security devices, building controls) merging onto shared IP networks with traditional information technology, requiring security teams to apply IT-grade cybersecurity practices (network segmentation, patch management, credential hygiene) to physical security devices.

P

PACS (Physical Access Control System) — formal term for ACS
The formal industry and federal-procurement term for what is commonly called an access control system, frequently used in government and FICAM (Federal Identity, Credential, and Access Management) documentation.
PSIM (Physical Security Information Management) — integration platform
A software layer that aggregates and correlates data from multiple, often disparate, security subsystems (video, access control, intrusion, fire, building automation) into a single operator interface with unified situational awareness, workflows, and incident response guidance.
PoE (Power over Ethernet) — IEEE 802.3af/at/bt
A standard allowing electrical power and data to be delivered over the same Ethernet cable, eliminating the need for separate local power runs to cameras, readers, and IP-based door controllers. PoE+ (802.3at) and PoE++/UPoE (802.3bt) provide progressively higher wattage for PTZ cameras and heated enclosures.
PTZ Camera — Pan-Tilt-Zoom
A camera whose field of view can be remotely or automatically steered and zoomed, typically used for active operator monitoring, guard tours, and covering large open areas where a single fixed camera cannot provide adequate detail everywhere at once.

R

RAID — Redundant Array of Independent Disks, storage architecture
A storage configuration that stripes and/or mirrors data across multiple physical drives, used in surveillance storage arrays to protect recorded video against single-drive failure. RAID 5 and RAID 6 are common choices, trading some usable capacity ("parity overhead") for fault tolerance.
Reader — access control hardware
The device mounted at a controlled opening that reads a presented credential (card, mobile, biometric) and passes the identifying data to the controller for an access decision; the reader itself typically does not decide whether to unlock the door.
Request-to-Exit (REX) — access control/egress hardware
A sensor (motion-based PIR or a mechanical push-button) mounted on the secure side of a door that signals the access control system to unlock and suppress a "forced door" alarm when someone is legitimately leaving, without requiring a credential.
Retention Period — video/VMS design
The length of time recorded video must be kept before being overwritten, driven by facility type, insurance requirements, and local ordinance (e.g., 30, 90, or 365 days), and the single largest driver of total storage system cost.

S

SOC (Security Operations Center) — monitoring facility
A centralized facility, staffed continuously or on-call, where security personnel monitor video, alarms, and access events across one or more sites and coordinate incident response.
Supervised Circuit — alarm/intrusion wiring
A wiring configuration (typically using end-of-line resistors) that allows the control panel to continuously verify the wiring integrity of a sensor or reader, detecting a cut, shorted, or tampered cable as a distinct trouble condition rather than a simple open/closed state.

T

Tailgating (Piggybacking) — access control vulnerability
The act of an unauthorized person following an authorized credential holder through a controlled opening without presenting their own credential, one of the most common and hardest-to-eliminate physical security vulnerabilities, mitigated by mantraps, turnstiles, or trained security staff.
Turnstile — physical access control barrier
A mechanical barrier (full-height, waist-high, or optical) that physically enforces one-person-per-credential passage, ranging from simple tripod turnstiles to sophisticated optical turnstiles using infrared beams to detect tailgating attempts without a physical barrier.

U

UL 294 — Underwriters Laboratories standard for Access Control System Units
The UL standard governing the construction and performance of access control system units, covering endurance, environmental resistance, and destructive-attack testing to establish a baseline reliability and security rating for access control equipment.
UL 1076 — Underwriters Laboratories standard for proprietary burglar alarm units
The UL standard covering control units used in proprietary (in-house monitored) burglar alarm systems, establishing performance and construction requirements distinct from central-station-monitored systems.
UL 2050 — Underwriters Laboratories standard for National Industrial Security Systems
A UL standard governing intrusion detection systems installed in facilities that must meet U.S. government National Industrial Security Program (NISPOM) requirements for classified information protection.

V

VMS (Video Management System) — video infrastructure software
The software platform that manages camera configuration, live viewing, recording, retrieval, and analytics across a video surveillance deployment, running on-premises servers, virtualized infrastructure, or increasingly cloud-hosted (VSaaS) platforms.
VSaaS (Video Surveillance as a Service) — cloud deployment model
A delivery model where video recording, storage, and management are hosted in the cloud by a third-party provider rather than on local, owner-maintained servers, shifting capital costs to an operating expense and simplifying multi-site management at the cost of ongoing internet bandwidth dependency.

W

Wiegand — legacy access control communication protocol
The long-standing (originally 1970s-era) unencrypted communication protocol between card readers and access control panels, still widely deployed but increasingly being replaced by OSDP due to its lack of encryption and inability to detect line tampering.

Z

Zone — intrusion detection and access control
A logically grouped area or set of sensors/openings that is armed, disarmed, or reported on as a unit, allowing a facility to be partitioned (e.g., perimeter zone, interior zone, high-security zone) rather than managing every sensor individually.