• A company should invest in a facility-wide key control system for all keys and codes.

The best locks in the world don’t provide much protection against someone who has a key. First and foremost, entrance security depends on key control. All companies should have a facility-wide key control system that ensures the security of keys, access cards, combinations, key-making equipment, key codes, etc.

The security office or another secure location should be used to store all spare keys, access cards, and other lock-related equipment or information. Personnel who work in those areas should have limited access to equipment and information. Do not store combinations or other lock information on a computer. Conduct periodic inventories and inspections to make sure nothing has been stolen or misplaced.

Other security measures include:

• Only provide lock combinations or keys when necessary to those who must have them. Keep the number of copies to a minimum.
• When not in use or under personal control, extra keys should be stored in a locked container. Keys to sensitive areas should be signed out to supervisors on an as-needed basis and turned in at the end of each day. Keep accurate records of who signed out which keys, when, for how long, and who authorized signing out the keys. Account for all keys at the end of each day.
• If employees can retain certain facility keys, access rights should be restricted. In other words, don’t allow employees to retain keys to areas containing valuable equipment or hazardous materials unless necessary.
• If keys are given to contractors temporarily, make sure the keys are returned once work is complete, or render the keys useless by changing the locks.
• Do not use a master key system where a single key can open multiple locks. If a master key system is necessary, limit its use to non-sensitive areas and limit the ability to copy keys.
• Use pick-resistant locks whenever possible.
• Consult with a locksmith or security professional to get options for key and lock systems that best suit the company’s needs.
• Pay particular attention to hazardous materials storage areas. Consider using some form of electronic key or badge that will allow the company to control and monitor access to these areas.
• If combination locks are used, change the combinations periodically or whenever a combination code is lost or misplaced (even temporarily), or an employee who knows the combination(s) leaves the company or is transferred.
• Designate one person to oversee the key control system. The person should maintain records, know who has which keys, investigate the loss of keys, conduct lock and key inventories and inspections, oversee company policies related to keys and access rights, and purchase keys and locks as needed.
• Make sure personnel responding to an emergency will have access to the necessary keys.
• Re-key all door locks periodically, at least once every other year.