Enough for every application planned over its life, with headroom - because adding one later means re-encoding cards that are already issued.

Access control alone needs very little. Each additional application - payment, print, transport, logical login - claims its own protected area.

Cards are sold in a range of capacities and the price difference is modest compared with the cost of reissuing a population.

Re-encoding in the field is possible but requires either collecting the cards or putting encoders where people are, and neither is quick.

List the applications the organisation might plausibly add within the card's life, not just the ones funded now.

Confirm that the file structure can be extended by a different application owner later without disturbing the access application.

The organisation that owns the system - not the installer - under a documented custody arrangement with a named owner and a rotation plan.

The master key is what makes the cards secure. Whoever holds it can produce valid credentials.

It is common for the master key to exist only in an integrator's laptop or in an email attachment, which is a serious exposure and usually discovered during an audit.

Custody should be split where possible, so that no single individual can produce credentials unilaterally.

Diversification - deriving each card's key from the master and the card's own identifier - limits the damage if one card is attacked.

Write down the rotation procedure before it is needed. A key that cannot be changed is a key that will eventually be the wrong one.

With an encoder that writes the site's keys and data onto the card, usually combined with the printer so printing and encoding happen in one pass.

A blank secure card carries factory keys and no site data. It has to be personalised before it will work.

Combined print-and-encode units handle both in a single operation, which keeps the printed identity and the encoded identity matched - an important control.

The encoding station needs access to the keys, so it is a sensitive asset and should be sited and secured accordingly.

Batch pre-encoding by the supplier is an option for large orders and removes the on-site equipment, at the cost of sharing keys with the supplier.

Whatever the route, the process needs documenting: who can encode, from where, with what authorisation, and how failures and spoiled cards are destroyed.

Yes - that is usually what justifies the cost. Access, print release, catering payment and computer login can all live on one card.

Each application occupies its own key-protected area, so the catering system cannot read the access application and vice versa.

The user benefit is obvious: one card instead of four, and one thing to lose.

The organisational benefit is a single issuance process and a single revocation, which removes the gaps where a leaver keeps one of their cards.

The difficulty is governance. Each application has a different owner with different requirements, and agreement takes time.

Start with the applications that share an owner, and design the card capacity so the harder ones can be added without reissuing.

On any site where a copied credential would matter, yes - and the difference is a one-time step rather than a recurring penalty.

Smart cards cost more per unit than legacy proximity cards, but they do not fail more often or need replacing more frequently.

Against that, the copy attack that defines the older technology is removed, which is the whole point.

Multi-application use frequently pays the difference back by retiring a separate card and its own issuance process.

The costs that are genuinely new are the encoder and the key management effort, and those are largely one-off.

Where budget forces a phased approach, migrate the highest-consequence areas first rather than moving whole buildings geographically.

Revoke it immediately, exactly as with any credential - the cryptography protects the card's contents, not the doors it opens.

A lost smart card in someone else's hands still presents a valid credential to the readers until the system stops accepting it.

What the cryptography does prevent is the finder producing further copies from it, which is a meaningful difference.

If the card carried payment or logical access applications, those owners need notifying too - revocation in the access system does not necessarily revoke the others.

Diversified keys mean a lost card cannot be used to attack the rest of the population, and that is the argument for insisting on them.

Replacement is a reissue and re-encode. A card reported lost and later found should be destroyed rather than reactivated.

Only if they support the card family and are configured to authenticate rather than to read the serial number.

Many older readers cannot read 13.56 MHz cards at all, and those that can may only read the unauthenticated identifier.

Using the serial number works and discards the security entirely, because that number is transmitted before any authentication and can be reproduced.

Check that the reader supports authenticated reads of the specific card family, and that the site keys can be loaded into it.

Multi-technology readers that accept both the legacy credential and the new smart card are what make a phased migration possible.

Confirm the configuration at commissioning. A smart card system reading serial numbers looks identical in operation and provides none of the protection paid for.