Abstract: An access control system is disclosed comprising a credential reader arranged to gather at least one credential from a person desiring to pass through an access point associated with the access control system, the system being arranged to use the at least one credential to provide an indication about the identity of the person. The system also comprises at least one access control device controlling access through a respective access point such that a person is allowed or denied access dependent on whether the person is positively identified, and a data storage device that stores data indicative of a current security level applicable for each access point associated with the system, the security level defining the criteria required to provide a positive identification of the person. Stored security level data can be modified to change the criteria required for positively identifying a person.