Standalone access control keeps every credential, user record, and decision inside the reader or battery-powered lock at each door, while a networked system centralizes those decisions on a server or cloud platform reachable by Ethernet, Wi-Fi, or a wireless gateway [S2][S5].
That single architectural split drives every downstream trade: install cost, admin time per staff change, cyber exposure, integration with cameras and alarms, and the point at which a small business is forced to rip out yesterday's "cheap" solution and re-cable the building [S2][S3].
What Each System Actually Contains
A standalone lock is an "all-in-one" package: the reader (keypad, proximity, or Bluetooth), the controller, the lock mechanism, and the credential database live inside one device, typically powered by replaceable alkaline or lithium cells, with no extra wiring, routers, or sensors [S1][S5]. Proximity and fob variants program each credential individually at the reader, while battery-powered smart locks add a smartphone app over Bluetooth or Wi-Fi for basic management without making the system truly networked [S5].
A networked system splits those roles: a reader at the door, an intelligent controller (or "panel") in the IT closet, a server or cloud tenant holding the credential database, and credentials that travel over Wiegand, OSDP, or pure IP to the controller [S3][S4]. Multi-site deployments ride the corporate LAN/VPN or a vendor cloud, which is why a single revocation in HR can simultaneously kill access on eight doors across two buildings instead of requiring eight separate walk-ups with a programming card [S2].
Decision Criteria: Door Count, Change Rate, Wiring Reality
The 2026 small-business guidance from NGT Eco is explicit: standalone fits 1–3 doors in a single location with infrequent staff changes; networked takes over once you cross roughly 4 doors, run more than a couple of role changes per month, or need integrations with video or alarms [S2]. FlyLock's installer roundup draws the same three-way line, sorting offerings into cloud-mobile, network, and standalone "physical security lock" categories, with install difficulty driven mainly by whether power and data cabling already exist at the door [S3].
Credential-change rate is the silent cost driver. Every standalone lock requires a physical visit with a programming card or a shared PIN rotation; on a networked panel the same change is one database edit. Past a handful of doors, that per-door admin overhead is the actual reason businesses migrate, not the hardware price [S5]. A typical small-site illustration: 8 doors across 2 sites with 3 role changes per month turns into 8 separate door edits on standalone versus one centralized update on networked, and the missed-revocation risk is concentrated in the standalone workflow [S2].
Options Compared: Standalone Keypad, Standalone Smart Lock, Wired Networked, Wireless Networked
Standalone keypad locks are the cheapest and simplest option: PIN entry, no app, no network, and they are typical on storage rooms and back offices. The known weakness is shared codes, which erase individual accountability the moment the PIN circulates [S5].
Standalone battery-powered smart locks (Bluetooth or Wi-Fi to a phone app) keep the install simple but add per-user convenience; admin still happens at the lock, and battery life, typically 12–24 months on alkaline cells for a low-traffic door, becomes a maintenance variable to track [S1][S5].
Wired networked panels are the robust choice for retrofit-hostile buildings: a single home-run of twisted pair or Cat-6 to each door, a controller in the IT closet, and a software head-end. Wireless networked locks (Wi-Fi or 900 MHz / proprietary wireless to a gateway) trade that cable plant for careful network planning, gateway placement, and battery management, but they install faster in finished spaces and are easier to expand door by door [S2][S4].
Who Each Option Is For, and Who Should Skip It
Standalone wins for a 3,000 sq ft workshop with two exterior doors and a parts cage, where daily admin stays in the low-single-digit minutes and staff changes are rare; it also wins for high-security isolation use cases, such as a server closet or evidence cabinet, where a network connection is a liability rather than an asset [S2]. Skip standalone the moment you need entry logs for an incident, want a single badge across multiple doors, or face any audit regime that asks "who opened this door at 02:14?" [S5].
Networked wins for multi-site retailers, clinics with HIPAA-style record-room logging, and any tenant with three or more role changes per month; it also wins where you want a forced link between an access event and the nearest camera or intrusion panel [S2][S4]. Skip fully wired networked if the building is finished drywall with no plenum path, because the cabling labor will swamp the hardware savings; in that case a wireless-to-gateway networked panel keeps most of the centralized benefits [S2].
Failure Modes and Limits You Will Hit on Day One
Standalone limits are mechanical and procedural: no entry log, no real-time monitoring, and no central revocation, so a fired employee with a still-programmed fob is a walking vulnerability until someone physically visits that reader [S5]. Shared PINs on keypad locks make "who opened this" unanswerable by design [S5].
Networked limits are electrical and cyber: every networked reader is now an IP-attached device on the corporate network, so firmware hygiene, network segmentation, and credential encryption (OSDP Secure Channel, rather than legacy Wiegand) become part of the spec, not an afterthought [S3][S4]. Wireless networked locks trade cable risk for battery and RF risk: a gateway in a metal IT closet will not reach a far door, and a smart lock with depleted cells reverts to mechanical-key fallback that you have to plan for [S2]. For readers integrated with doors subject to fire rating, the door-leaf hardware must still meet the fire door listing, and access-controlled egress doors have to release on fire alarm; a networked panel makes that integration easier, but only if the spec is written that way from day one.
Wiring, Power, and Integration Constraints
Standalone installs on existing doors with no cabling, which is why Kisi and the installer guides both flag it as the path of least resistance for retrofits, especially in older buildings without conduit to the door [S3][S5]. The trade is that you lose every integration: no camera linkage, no alarm relay, no central log [S5].
Networked installs need either a home-run cable (typically Cat-6 plus 12–24 VDC power, or PoE+) to each door or a wireless gateway with good RF coverage. Maglocks and electric strikes on those doors draw continuous current, so the power supply sizing and battery-backed operation during outages are real engineering items, not afterthoughts [S1]. For high-traffic exterior doors, the access control hardware choice (maglock vs. electric strike vs. smart lock) interacts with the door frame and the lock nut hardware on the cylinder side, and that mechanical spec should be settled before the network topology is drawn.
Procurement Checklist Before You Sign a PO
Count doors today and 12 months out, then estimate monthly adds and removes; that single spreadsheet decides standalone vs. networked more reliably than any vendor pitch [S2]. Decide whether remote management is a must-have, and confirm whether your facility team can support wired pulls or whether a wireless-to-gateway topology is more realistic for the building [S2]. Validate that the credential format (26-bit Wiegand, OSDP, mobile BLE, or 13.56 MHz smart cards) is compatible with existing badges if you are adding to, not replacing, the system. Confirm the fire-egress release path on any door you electrify, and that the hardware package is listed for use on the rated system window door assembly, not just the lock body alone. For mobile-heavy workforces, review the per-door price math in the card vs biometric access control 2026 comparison so the credential reader choice does not blow up the operating budget.
Track two signals over the next quarter: (1) how many reader firmware CVEs are published for the networked vendors on your shortlist, which is a leading indicator of cyber exposure on every networked lock you specify, and (2) the local distributor's stock of replacement battery packs and credential cards, which is a leading indicator of how much downtime a standalone fleet will absorb when a lock eats cells at 3 a.m.