Key Control

Managing a facility keying system

What is key control?

Key control is an organized and formal security system which addresses control of master keys within a building or facility. Key control prevents unauthorized access using documentation management and status reporting of critical elements in the master key system.

The critical elements of facilities security are:

• Physical keys (either issued keys or stored keys)
• Key holders
• Physical locations
• Information on the products used in a location

Important key control questions you should know the answers to:

• What is your keying systems?
• What keys do you have?
• What keys have you issued?
• What keys are not accounted for?
• Where are the keys?
• Who has them?
• Where did they go?
• Can I account for all my keys?

Common problems in controlling the key system

Can you answer these questions about your system?

Do you know all the buildings/locations at your facility?

• What are they?
• Where are they?

Can you identity the door openings and door hardware used in these buildings?

• Where are they?
• What hardware and keys operate them?
• who has key access through them?

Can you identify all the key holders?

• Who are they?
• What keys do they have?
• What doors do they access?

Can you account for all the keys in the key system(s):

• What are the key identities?
• How many are there?
• Where are they?
• Who has them?
• What doors do they access?
• What are they and where do they go

Common problems with a building’s mechanical master key system:

The following is a list of weaknesses that undermine your mechanical master keying system(s) — the system protecting your facility.

• Indiscriminate loaning of keys between personnel
• Poor records
• Insufficient administration backup for key control
• Too many master keys issued
• Lost or stolen keys
• Ineffective or no return key policy and procedures
• Failing to issue the proper level key to individuals
• Key system not adequate or improperly designed for actual usage
• Issuing keys by desire, not need
• Doors not properly secured when not in use
• Ineffective or lack of following proper maintenance procedures for cylinders
• Ineffective or no key control management program
• Lack of or ineffective on-site personnel to provide services for cylinders and keys
• Multiple non-related master key systems for the facility
• Variety of manufacturers’ master keying system(s) being used in the facility
• Security not properly planned out
• Introducing key control and administration practices were none existed before

Keying system(s) risks:

Your facility is at risk if you have...

• No overall facility plan for keying system(s)
• Established system(s) that don’t match usage
• Multiple non-related keying systems
• Key systems from different manufacturers

Key system management and control risks:

Your facility is at risk if you have...

• No introduction/program of effective keying management
• No administration backup for keying management
• No record keeping policies
• Poor record keeping procedures
• No overall approved key management policy
• Inaccurate documentation on lost/ stolen keys

Record keeping and policy risks:

Your facility is at risk if you have...

• Too many master level keys issued
• Failed to issue the proper level keys
• Issued keys by desire instead of need
• No effective issue/ return key policy
• Indiscrimate loaning of keys by key holders
• Unauthorized key duplication***
• Unlocked dorrs — the most common casue of unauthorized entry!!!

Developing a key control plan

Security starts with a key control plan. Use the outline below to develop and implement your key control system.

Developing a plan: Gain Support and Approval

• Examine your facility’s approach to key systems control:
  • Is key control understood by all?
  • Senior administration must support the system.
  • Define policies on issue and collection of keys.
  • Define the current level of record keeping.
  • Who’s responsible for key control?
  • Who’s accountable?
• Organize documentation and gather information:
  • Document existing keying system(s) data.
  • Determine the accuracy of keys inventory.
  • Perform a site survey:
    • identify buildings, floors
    • door/opening
    • hardware
    • keying identity
  • Identify current key holders and their keys.
• Develop policies on controlling the keying systems:
  • Who or what area will be responsible?
  • Formalize policies governing the key systems.
  • What level and amount of information is needed?
  • Signatures authorization procedures
  • Issuing keys
  • Collecting keys

Select a key control method: Computer Control vs. Managed Control

Computer Key Control:

• Level of detail
• Depth of information
• Cost
• Equipment
• Software selection

Managed key control systems:

• The types of managed control systems are:
  • Informal manual record keeping
  • Manual file card systems
  • Computer supported software
• What a managed control system accomplishes:
  • Institutes responsibility
  • Develops accountability
  • Creates documented control

Summary

• Successful key control is accomplished by:
  • Adopting a formal key control policy
  • Developing formal monitoring and reporting
  • Addressing key control as a long-term commitment
• Key control systems fail due to:
  • Lack of dedicated effort
  • Viewed as an overwhelming task
  • No formal written/approved policy
  • Lack of senior administrative support
  • Lack of discipline in maintaining information
  • Inconsistent input of information
  • Lack of dedication to maintaining the system
  • Lack of enforceable authority