A physical key management policy must guarantee who may hold which keys, how keys are issued and stored, how losses are handled, and how the entire system is audited. Without that guarantee in writing, a single lost master key can expose an entire building or campus to uncontrolled access.

Start here — actions for the first 24–72 hours:

• Appoint a Key Control Authority (KCA) to own the policy immediately.
• Locate or create a key register covering every key currently in circulation.
• Secure all keys in a locked cabinet; suspend any unaccounted master keys from use.
• Verify that key storage is monitored by CCTV and that access to the cabinet is logged.

The ASD Information Security Manual requires that keys to server rooms, communications rooms and security containers be appropriately controlled and auditable. The ANU campus security policy demonstrates how delegated key custodianship works at scale. Abcosecurity can assist with policy design, cabinet selection and integration across all of these controls.

Key takeaways

A physical key management policy is only effective when it combines a complete key register, strict master-key limits, certified storage, regular audits and a tested lost-key response procedure.

Table of Contents

• Why does your site need a key management policy?
• Who does what: key control authority, delegated officers and line managers
• What fields should your key register record?
• How should you issue keys and control master keys?
• What happens when a key is lost or stolen?
• How does the key policy work with CCTV, alarms and contractor access?
• How do you keep the policy current and staff trained?
• Step-by-step implementation checklist and sample policy outline
• Abcosecurity’s approach to key management for clients
• How Abcosecurity can implement your key management policy
• Sources
• FAQ

Why does your site need a key management policy?

A key management policy protects people, assets and operations by defining exactly which keys exist, who may hold them and under what conditions. Without a documented policy, access creep is almost inevitable: contractors retain keys after a job ends, staff accumulate keys beyond their role, and no one can confirm how many copies of a master key are in circulation.

Typical policy scope includes single buildings, multi-site campuses, construction sites, healthcare precincts and event footprints. Each setting has its own risk profile. A hospital ward has different exposure than a corporate office, and a construction site with rotating subcontractors has a different exposure again.

Good practice requires every policy to include, at minimum:

• A key register with unique identifiers for every key.
• Defined roles and delegations (who authorises issuance, who holds the register).
• Issuance and return rules with signed receipts.
• Secure storage with CCTV monitoring of key containers.
• An audit schedule and documented rekeying thresholds.
• A lost-key incident response procedure.

Industry guidance for Australian properties recommends grouping keys by sensitivity — high, medium and general — and applying stricter check-out rules and shorter durations for high-security keys. That tiering simplifies audits and makes reconciliation faster when something goes missing.

Who does what: key control authority, delegated officers and line managers

Clear delegations make accountability auditable. The table below maps the core roles.

The Key Control Design Guide requires authoriser signatures and photo ID at every issuance point. The ANU policy limits master-key issuance to no more than two permanent master keys per area unless formally justified, with an area master key held centrally for extraordinary use only. That limit is worth adopting as a default: the fewer master keys in circulation, the smaller the rekeying bill after a loss.

Contractor and tenant delegations need their own documented authorisation chain. Record each authorisation with a date, the authoriser’s name and the scope of access granted.

What fields should your key register record?

The register is the single source of truth for every key on site. Each entry should capture:

Keep the register in a protected electronic system or a locked paper register stored separately from the keys themselves. Holder personal data (name, photo ID reference) must be handled consistently with the Privacy Act 1988 and the Australian Privacy Principles.

Electronic key cabinets that log every removal and return can replace or complement a manual register. The Key Control Design Guide notes these cabinets integrate with electronic access control systems (EACS) for consolidated incident investigation, which cuts investigation time considerably.

Pro Tip: Run a reconciliation spot check on your highest-security keys every week, not just at the scheduled annual audit. Discrepancies caught early rarely require a full rekey.

How should you issue keys and control master keys?

Issue keys only on demonstrated need and with formal authorisation. The Key Control Design Guide specifies photo ID verification and a signed keyholder agreement at every issuance. Set the return date based on the actual need — a contractor working for two weeks gets a two-week key, not an open-ended one.

For secure storage, the South Australian protective security guidance recommends locating key cabinets within the same security zone the keys protect, and advises SCEC-approved Class B or C cabinets for higher-security zones. Commercial-grade cabinets vary widely in quality and may offer little real protection for sensitive keys.

Master-key controls deserve particular attention:

• Limit permanent master keys to a small number per area; require written justification for any additional copies.
• Hold extraordinary-use master keys centrally under KCA custody with a controlled-release log.
• Permit duplication only through the KCA or an authorised locksmith; maintain bitting lists under separate, restricted access.
• Monitor key cabinet access with CCTV and integrate cabinet logs with your EACS.

The ASD physical security guidelines endorse this layered approach, recommending that key storage be placed within appropriate security zones and integrated with CCTV and access logs as part of a defence-in-depth strategy.

What happens when a key is lost or stolen?

Audit cadence should match key sensitivity. Daily checks suit high-security keys (server rooms, safes, medication stores); weekly reconciliations work for medium-sensitivity keys; monthly checks cover general access keys. A full system audit annually covers the entire inventory.

When a key goes missing, follow these steps:

1. Report immediately to the KCA and log the incident with time, date and last known location.
2. Conduct a physical search and pull CCTV footage covering the key cabinet and the areas the key opens.
3. Apply temporary access restrictions to affected areas while the search is underway.
4. Complete a risk assessment: what does the key open, who had access, and what is the realistic threat?
5. Decide whether to rekey based on the table below.

The ISM is explicit that keys to server and communications rooms must remain auditable at all times; a missing key for those spaces triggers an immediate rekey, not a wait-and-see.

How does the key policy work with CCTV, alarms and contractor access?

Key management works best as one layer in a broader integrated security system, not as a standalone control. The ASD guidelines describe this as defence-in-depth: overlapping controls that each catch what the others miss.

Practical integration points:

• Align cabinet audit logs with EACS event records so that a key removal and a door access event can be cross-referenced during an investigation.
• Mount CCTV to cover key cabinet access points; retain footage for at least 30 days or in line with your site’s retention policy.
• Connect key cabinet tamper sensors to your alarm monitoring system so that forced or after-hours access triggers an immediate alert.

For contractors and visitors, apply time-limited electronic permissions alongside any physical key issued. Require a supervised escort for first access, a signed key receipt on handover, and a verified return before the contractor leaves site. Construction site key management adds another layer of complexity because subcontractor rosters change frequently; a short-duration key with a hard expiry date reduces the risk of keys walking off site.

Smart facility sensors can further strengthen these integration points. Resources on smart facility integration for facility managers outline how sensor data and access logs can be combined for faster incident response.

How do you keep the policy current and staff trained?

Review the policy every three to five years, or immediately after a major security incident, a significant change in tenancy, or a rekeying event. Key security compliance factors worth tracking include audit pass rate, lost-key incident rate and average time to resolve a missing key.

Training requirements:

• New staff: induction briefing covering their keyholder obligations before keys are issued.
• Annual refresher: all keyholders confirm they understand the policy and their current key holdings.
• Contractors: site-specific briefing before first key issuance; record attendance.

Retain training records in personnel or site files. Insurers and auditors increasingly ask for evidence of training as part of security compliance reviews.

Step-by-step implementation checklist and sample policy outline

Follow these steps to move from no policy to a functioning key management programme:

1. Appoint the KCA and document their authority in writing.
2. Audit all existing keys: collect, serialise and record every key on site.
3. Select key storage: choose between manual locked cabinets and electronic key cabinets based on volume, security zone and budget.
4. Build the key register: populate all fields from the template above; destroy or decommission unneeded keys.
5. Roll out issuance procedures: brief all keyholders, collect signed agreements and photo ID.
6. Conduct the first reconciliation audit within 30 days of go-live.
7. Train all staff and record attendance.
8. Set the review calendar: schedule audits and the next policy review date.

Sample policy outline (copy and adapt):

For contractor onboarding, issue a temporary key with a hard expiry date, record the contractor’s name, company and photo ID, and confirm return in writing before site clearance.

Abcosecurity’s approach to key management for clients

Abcosecurity integrates physical key management policy design with electronic key cabinet supply, access control systems, CCTV and 24/7 alarm monitoring across construction sites, healthcare facilities and corporate campuses. The approach is not to treat key control as a paperwork exercise but as a live security layer that feeds into the broader monitoring picture.

On construction sites, where subcontractor rosters shift weekly, Abcosecurity’s mobile patrol and monitoring teams can verify key returns and flag overdue temporary keys before they become a rekeying liability. In healthcare settings, where medication room and server room access must remain auditable at all times, the integration of electronic key cabinets with EACS event logs gives administrators a single audit trail rather than two separate records to reconcile.

Working with existing locksmith partners and tenants, Abcosecurity can bring a fragmented estate onto a single controlled keying platform, reducing the number of master keys in circulation and the cost exposure when one goes missing.

How Abcosecurity can implement your key management policy

A documented policy is only as strong as the systems behind it. Abcosecurity delivers end-to-end key management implementation: site assessment, policy drafting, electronic key cabinet supply and integration, staff training, and ongoing monitoring through integrated security solutions that connect key custody to CCTV, access control and alarm monitoring.

For construction, healthcare and corporate clients across Australia, the process starts with a no-obligation site assessment that maps your current key inventory, identifies gaps against Australian good practice, and recommends the right cabinet and integration solution for your risk profile. Contact Abcosecurity to book your site assessment and get a tailored key management implementation plan.

Sources

• Information Security Manual (September 2024)
• Security – buildings and site | ANU policy (ANUP_000463)
• Security
• Key Control Design Guide (Lockweb)
• Building Key Management: Best Practices for Australian Properties | ComtyLink Blog

FAQ

What must a physical key management policy include?

A policy must define scope, roles, a key register, issuance and return rules, secure storage requirements, an audit schedule and a lost-key incident response procedure. The Key Control Design Guide sets these out as the minimum controls for any keying platform.

How many master keys should a site issue?

No more than two permanent master keys per area is the standard guidance, with any extraordinary-use master key held centrally by the KCA. The ANU policy applies this limit across a large campus to reduce the cost and disruption of a full rekey after a single loss.

When should you rekey after a lost key?

Rekey immediately if a grand master or master key is lost; rekey the affected cylinder if a change key is lost and the risk assessment indicates exposure. The ISM requires an immediate rekey for any key providing access to server or communications rooms.

Do electronic key cabinets replace a paper register?

They can replace or complement a paper register by logging every removal and return automatically. Selection should account for cabinet certification, integration with your EACS and CCTV, and whether the cabinet meets the security zone requirements for the keys it stores.

How often should a key management policy be reviewed?

Review the policy every three to five years, or immediately after a major security incident, a significant rekeying event or a material change in site tenancy or operations.

Recommended

• A Guide to Risk Security Management
• Security for government buildings: a decision-maker’s guide
• Hospital access control systems: the Australian guide
• Vacant property security: a guide for facility managers