Key management

Only a small number of organisations in our region have an existing unified key management system, whose purpose is the elimination of the maximum of possible security risks arising from the following risk elements:

• Physical keys (issued and not issued)
• Key holders
• Information about specific products on specific locations
  

If you already have an existing key management system, you should know the answers to at the minimum the following questions:

• What key system do you use?
• What keys do you have?
• Which keys have you issued?
• Which keys have you not issued?
• Where are specific keys located?
• Who has the keys?
• Can I track all the keys?

Common problems in key management:

Can you identify all the lockable locations within the orgainsation?

• Which ones are they?
• Where exactly are they located?

Can you identify the hardware for door opening and other door accessories in your organisation?

• Where is it located?
• Exactly what hardware and what keys are used on specific doors?
• Who has the keys to the individual doors?

Can you identify the persons in possession of the keys?

• Which persons specifically?
• Which keys specifically are they in possession of?
• Which doors do they have access through?
  

Can you track all the keys within the key mode?

• What are the identities of the keys?
• How many keys are there to the site?
• Where are the keys?
• Which persons are in the possession of the keys?
• Which doors do the keys open?
• Can you track the keys?
  

The situation within an organisation can be improved by establishing a system with a general key, either to selected areas or to all the areas. However, there is still a number of shortcomings associated with this measure:

• Borrowing and lending of keys between members of staff
• Inadequate records
• Inadequate administration of key management
• A large number of general keys
• Lost and stolen keys
• Ineffective systems and processes within the key management system
• Errors in the issue of keys with correct access rights for specific persons
• The system involving a general key is inadequate or incorrectly designed for the current situation
• Key issue based on goodwill rather than on need
• The door is not sufficiently secured when not in use
• Ineffective or inadequate maintenance of cylinders
• Absent or ineffective system of a posteriori inspection of issued keys
• Absent or ineffectively secured maintenance of the door hardware
• Multiple inadequate general key systems within a large organisation
• Use of multiple incompatible general key systems from different manufacturers within a single organisation
• Inadequatly designed security
• Insufficient introduction of managerial and administrative procedures
  

The organisation is expose to a security risk in the following cases:

• There is no key management system
• The existing system does not satisfy the requirements of the organisation
• There are multiple systems that are not linked together
• There is no existing system for effective key management
• There is no administration of the backup of key management data
• There is no existing policy on record keeping
• Recording procedures carried out inadequately
• Insufficient documentation of lost and stolen keys
• More general keys issued than needed
• Inadequate general key system
• Unauthorised duplicates of the keys
• Unlocked doors - most frequent cause of unauthorised entry
  

Effective key management requires a system consisting of clear policies on key management associated with the door hardware, keeping and issuing of keys linked with a documentation procedure, preferably using a specialised software and hardware linked to electronic security systems.