There is a wire behind the card reader on your wall, and it has a language.
Almost nobody who buys an access control system knows this. The reader is the part you can see and touch, so it is the part you assume is doing the work. It is not. The reader reads a credential, turns it into a number, and passes that number down a wire to a controller — usually a metal box in an electrical or communications room somewhere else in the building. The controller holds the list of who is allowed through which door at what hour. The controller decides. The controller releases the lock.
The reader is a sensor. That is the whole of its job.
This matters because the wire between the two is where a design decision was made on your behalf, probably without being mentioned in the quote, and probably in favour of a protocol that predates the building.
Wiegand: the default that never left
The legacy interface in access control is called Wiegand. It long predates the systems most buildings now run on it, and it is still a common default on installations going in today. That is the genuinely surprising part of this subject — not that old buildings run it, but that new ones do.
Wiegand is a one-way signalling scheme. The reader talks; the controller listens. Nothing comes back the other way. It carries no encryption and no supervision — no continuous conversation between the two ends that would let either one notice the other has gone quiet. That characterisation comes from the industry body itself: SIA describes the protocols OSDP replaced as low-security, and says OSDP was created in 2008 precisely because the industry recognized the need for something that could support bidirectional communication and continuously supervise device status.
It persists for an unglamorous reason: it works well enough, every installer knows it, and nearly every reader speaks it. A default that everybody already knows how to wire does not get displaced by being merely better. It gets displaced when someone specifies the replacement.
We are not going to describe how any of Wiegand's weaknesses are exploited, and you should be wary of any vendor who does. The point for an owner is structural: an unencrypted, unsupervised, one-way link is a weaker link than an encrypted, supervised, two-way one, and there is now a standardized alternative.
OSDP: what replaced it
The alternative is OSDP — the Open Supervised Device Protocol. The Security Industry Association describes it plainly: "The Open Supervised Device Protocol (OSDP) is an open communications standard used between access-control panels and peripheral devices such as card readers. It was designed to improve interoperability, cybersecurity and device management while providing a more capable alternative to the legacy Wiegand interface."
Its history is worth two sentences, because the history is the reason you can specify it without being locked to anybody. The first version was created in 2008 by HID Global, Mercury Security and Lenel Systems International. The specification was transferred to the Security Industry Association in 2012, approved by the IEC in May 2020, and published as IEC 60839-11-5:2020. SIA released OSDP Version 2.2.2 in October 2024.
So it started as an industry effort, became an association standard, and is now an international one. It is not a proprietary product feature. Asking for it does not commit you to a manufacturer — which is exactly the argument for putting it in a specification rather than leaving the choice to whoever is holding the drill.
The part everyone talks about: encryption
OSDP includes a mode called Secure Channel, which supports AES-128 encryption. Under Secure Channel, what travels down the wire between reader and controller is protected rather than sent in the clear.
One clarification, because this is where the topic is most often oversold. AES-128 is required in certain United States federal government applications — that is a statement about an encryption algorithm, not about OSDP. There is no government mandate, federal or otherwise, requiring you to use OSDP. Nobody is going to fine you for running Wiegand. If a proposal you are reading implies that OSDP is legally required, that proposal is wrong on the facts, and you should discount the rest of it accordingly.
The part nobody talks about, which is the one you will feel
Here is the underrated half, and for most owners it is worth more than the encryption.
OSDP is supervised. The "S" in the name is the feature. Because communication runs in both directions and continuously, the controller knows whether each reader is still answering. A supervised connection can indicate that a reader has malfunctioned.
Think about what the absence of that means on a legacy link. A reader stops working — it fails, it loses power, it is damaged, it comes off the wall. Nothing announces this. The controller is not expecting to hear anything, so silence is indistinguishable from normal. You find out when someone tries to badge in at that door, and then tells somebody, and then that somebody opens a ticket. On a secondary door — a loading bay, a stairwell, a parkade level, a service corridor used twice a week — that gap can be days or weeks.
With supervision, the door tells you. The reader stops answering, the system raises it, and it lands in front of a person who can act on it. That is a benefit you notice month after month, whereas encryption is one you notice only on the day it saves you, and probably never learn about.
For a strata or a property manager running multiple sites with no one watching a screen full-time, this is the strongest single reason to care about the protocol on the wire.
The retrofit argument: two wires instead of twelve
The practical objection to any upgrade is the cost of getting into the walls. OSDP substantially reduces that objection: it uses two wires instead of 12 or more.
The consequences are direct. It supports multi-drop installation — several devices sharing one run rather than each needing its own run back to the panel. Fewer conductors, more devices per run, better scalability when you add doors later. It also carries bidirectional communication, smart card applications, and text and audio-visual feedback to the person at the door — capabilities SIA contrasts with the legacy interface it was designed to replace.
If you have ever been quoted an unpleasant number to add three doors to an existing system, the conductor count and the cable pathway are a large part of why.