| 1 | User and Permission Management | Check whether the system supports multiple users, administrator roles, temporary credentials, scheduled access, and immediate permission removal. | Look for role-based access control, unique user accounts, time-limited guest codes, and an audit trail showing who granted or changed access. | Request a live demonstration of adding, editing, suspending, and deleting users. Confirm that former employees and service providers can be deactivated without replacing the lock. |
| 2 | Data Protection and Encryption | Review how credentials, identity data, event logs, mobile communication, and cloud traffic are encrypted and stored. | Prefer TLS 1.2 or newer for data in transit, strong encryption such as AES-256 for stored data, salted password hashing, and separate storage of encryption keys. | Ask for a data-flow diagram, retention policy, vulnerability disclosure process, and evidence of independent security testing. Confirm whether biometric data is stored locally or remotely. |
| 3 | Remote Control and Connectivity | Evaluate remote locking, unlocking, status checks, notifications, gateway requirements, internet dependency, and recovery after an outage. | The lock should continue operating locally when the internet is unavailable, while remote commands should use authenticated, encrypted channels and provide clear success or failure status. | Test remote access over both Wi-Fi and cellular networks. Verify offline credentials, manual override, low-battery alerts, and a documented process for lost phones or compromised accounts. |
| 4 | Authentication Options | Compare PIN codes, mobile credentials, RFID or NFC cards, fingerprints, mechanical keys, and multi-factor authentication. | Use unique credentials per user, configurable PIN length, lockout or throttling after repeated failures, and at least one non-digital backup method. | Test failed-attempt handling, credential revocation, fingerprint enrollment and deletion, emergency access, and operation with gloves or in low-light conditions. |
| 5 | Physical Security and Compatibility | Check cylinder design, anti-tamper features, door thickness, lock-backset compatibility, weather exposure, and local building requirements. | Confirm the product fits the target door type and dimensions. For exposed installations, require a clearly stated environmental rating and operating-temperature range rather than relying on marketing language. | Measure sample doors before ordering. Request mechanical durability, fire-door, ingress-protection, and regional conformity documentation where applicable. |
| 6 | Power, Reliability, and Fail-Safe Planning | Assess battery type, expected endurance, low-power behavior, emergency power, motor performance, and the consequences of electronic or mechanical failure. | Require test conditions for battery-life claims. A dependable solution should provide advance low-battery warnings, a physical override, and an external emergency-power option when appropriate. | Run repeated lock and unlock cycles on the actual door. Document battery replacement intervals, spare-part availability, warranty coverage, and the emergency opening procedure. |
| 7 | Compliance, Integration, and Total Cost | Review privacy obligations, regional radio requirements, software updates, API or access-control integration, support coverage, and lifecycle costs. | Select solutions with documented update support, exportable event logs, defined data-controller responsibilities, transparent subscription terms, and a clear end-of-service data deletion process. | Calculate hardware, gateways, installation, batteries, connectivity, software, training, maintenance, and replacement costs over the planned service life. Obtain written compliance and support commitments. |