Lesson 3 – Key Control Management

Specification

• All keys shall remain the property of the issuing facility or department.
• A key should be issued only to individuals, who have a legitimate and official requirement for the key.
• A requirement for access alone, when access can be accomplished by other means (such as unlocked doors, request for entry etc. shall not convey automatic entitlement to a key.
• All keys shall be returned and accounted for.
• Employees issued with a key must ensure that that key/s are safeguarded and properly used.

Enforcement

• All keys remain the property of the specific facility/department.
• Keys that are no longer required for authorised purposes shall be returned to the person appointed by the HOD, GES or GEF
• No person or department shall knowingly receive, borrow or possess any key for any space without receiving permission from a person duly authorised to give permission to possess such key
• No person shall knowingly alter, duplicate, copy or make a facsimile of any key to a lock of a facility building, store, cabinet, property etc. without receiving permission from the KCA (Key Control Authority)
• To enforce effective key control, the KCA may choose to impose a deposit for each key issued.
• Key holders shall use assigned keys for access to authorised locks only.
• Key holders shall take measures to protect and safeguard any facility keys issued to them or in their name.
• Key holders shall not loan out their keys.
• Key holders shall not use their key/s to grant access to non-authorised individuals.
• Key holders shall attempt in any manner to duplicate or alter keys in their possession.
• Key holders shall immediately report any lost, missing, stolen or damaged keys
• Authorised key holders entering locked buildings, stores or open any object whereby access are needed should ensure that such item is closed and locked afterwards .
• Keys shall not be stored in desk drawers or any unsecured areas.
• Violations of any of this enforcement procedure may result in disciplinary action up to and including dismissal.

Elements of a key control procedure (kca)

Each department will appoint a Key Control Authority (KCA) with power and authority to:

• Develop all the policies and procedures related to their key management system.

Appoint or become a Key Control Manager to:

• Implement, execute and enforce the key control policies and procedures.
• Issue and return keys with proper documentation, authorisation and transaction receipts.
• Supervise, authorise and control the security of keys and spares storage and the cutting or buying process.

Issuing Keys

• All key orders should be properly authorized by an authorized signer, in addition to the key holder, before issuing

–Each key have its own appropriate level of authorization

–Higher level keys may require higher levels of authorization

• Issue the proper level key to each individual granting only appropriate level of access Issue keys by need, not desire
• Require signature/s on key holder agreement:

–Signature of key holder

–Signature of authorizer Require ID Photo (where applicable)

• Keys should be issued by duration of need, not by term of employment. Signature required by key holder and authorizer.

Issuing Keys

• Keys must be personally picked up, not mailed
• If necessary keys may be delivered by courier or other return-receipt-required certified carrier.
• Keys shall be individually serialized or numbered
• Keys shall be identified by blind code numbers and serialized numbers Individuals may be issued only one copy of each keyset
• Exception for approval multiple key holders.
• The KCA shall establish key issuance authorization levels determined by the type of key. The general rule shall be that an authorizer may only approve keys for spaces directly under his/her control. In some cases more than one authorizers may be required

–Type of keys

–Change keys

–Master Keys

–Grand Master Keys

–Top Masters Keys

–Entrance Key

–Control Keys

–Mechanical/Maintenance Keys

–Security Keys

• Each department shall use standardized key deposits should greater than that of a change key (Where applicable). For example, the deposit for a master key should be greater than that of a change (new) key
• Keys may not be duplicated or issued except through the KCA or authorized facility locksmith.
• Keys shall only be issued by a designated individual
• Exception: electronic key cabinets with audit control or sequence locks.
• All keys should be tracked with a return due date and time, especially temporary issue keys. Shift keys or rings shall be returned at the end of every work shift.
• Shift key or rings shall be sealed and tamper evident.

Returning Keys

• All keys shall be returned to the issuing department by the authorized key holder.
• When keys are returned, any key deposit will be refunded and a key return receipt shall be issued to the key holder (Where applicable)
• Found keys must be turned into the KCA
• Final paychecks, records and/or transcripts may be held pending return of key/s (where applicable)

Non-returned key policy (where applicable)

• A fee for lost or stolen keys shall be established
• All re-keying charges must be paid by the department, individual or company responsible for losing the key
• Re-keying charges shall be determined by the number of locks operated by the lost or stolen key/s
• If any individual has two or more separate incidents of lost, stolen or non-returned key violations within one year period, key privileges may be revoked.

Administration of the Master Key System

• Keep the key register updated
• Cross keyed conditions should be minimized or avoided
• When cross keying is unavoidable, all cross keyed conditions should be fully recorded

Audits

Key Holder:

• On at least an annual basis, the responsible department will determine that the proper accountability of keys are maintained by conducting random key checks that sample the keys being carried by at least 25% of all departmental key holders

Key System:

• It is recommended that under normal circumstances, all keys should be changed at intervals not exceeding five years.
• Reports shall be periodically generated and distributed by department with a written response.

Forms

• Key request form
• Key return form
• Lost or stolen key report form
• Basic information required
• 12. SERVICING

Cutting Keys:

• It is advisable that when a facility want to cut keys they make use of an approved locksmith or vendor to cut such keys
• It is advisable that facility keys shall be cut on factory approved code cutting machines, not on duplicating machines that trace from one key to another. Duplicating machines are less accurate and can transfer wear or inaccuracy that worsens through generations of keys.