Wiegand is the legacy reader-to-controller protocol — open, unencrypted, vulnerable to spoofing and limited to short cable runs. OSDP (Open Supervised Device Protocol) is the modern replacement: encrypted, bidirectional, supports tamper detection and firmware updates, and runs reliably over longer distances. SIA SP1/SP2 designations indicate OSDP Secure Channel support. New deployments should specify OSDP everywhere unless legacy infrastructure forces Wiegand.

Most modern IP-based controllers can manage geographically distributed doors as long as network connectivity to the head-end is reliable. However, doors at remote sites lose access decision capability if WAN goes down unless the controller supports offline mode and caches valid credentials locally. For multi-site deployments, choose controllers with documented offline operation and consider redundant head-ends for compliance-sensitive industries.

Entry-level controllers hold 5,000-10,000 credentials. Mid-range hold 50,000-100,000. Enterprise platforms scale to millions through the head-end software with the controller acting as a cached decision point. Card-to-reader presentation time matters more than raw capacity once you're above 10,000 — confirm the read time at the maximum cardholder count, not the controller's spec-sheet headline number.

PoE simplifies installation — one cable per door — and is the dominant approach for single-door IP controllers. Multi-door panels typically need a dedicated 12VDC or 24VAC power supply with battery backup sized to drive electrified locks and accessories. Egress doors often require code-mandated battery backup regardless of controller power source. Confirm local fire code requirements before finalizing the power architecture.

Hardware lifespan is 10-15 years for well-built panels (Mercury, Lenel, Kantech, HID Aero). The platform software typically forces a refresh sooner — 5-8 years — through driver deprecation, mobile credential support gaps, or end-of-life of the head-end version. Plan for software-driven refresh ahead of hardware failure. Migration projects always run longer than planned; start scoping a replacement in year 5 of a 10-year hardware horizon.