Control and use of key locks

  • Knowledge Level: All Levels
  • Protection Stage: All Stages
  • Time to read:

Guidance on selecting, purchasing, using and decommissioning mechanical and electro-mechanical key locks, covering master key systems, secure key control procedures and risk mitigation for protecting UK national infrastructure

Last Updated: 21 August 2026
Share this article:

Foreword

This guidance document has been prepared and published by the National Protective Security Authority (NPSA) which has the remit of providing protective security advice on behalf of the government of the United Kingdom (UK).  

NPSA acknowledges the support of Callard Security Limited in producing this guide.

Audience

This guide is intended for all types of organisation forming part of the UK national infrastructure, including commercial enterprises, government agencies and not-for-profit organisations using key locks.  

The principles discussed here are intended to be applied where the assets requiring protection are crucial to your business or have been assigned a government security classification (defined by the UK Cabinet Office) or the commercial equivalent. 

Introduction

What is a mechanical key lock?  

A mechanical key lock is a device used to protect a door or space where the construction and use of the mechanism relies solely on non-electronic components. 

Figure 1: Example of a mechanical cylinder and key

What guidance does this document provide?  

This document focusses on control of high security key locks.  It should be read in conjunction with NPSA’s guidance document entitled “Door Security - A guide to security doorsets and associated locking hardware”.  

As best practice, it is advisable to adopt the measures stated in this document regardless if you use high or low security key locks.  

This document aims to inform users about: 

  • the most secure means to purchase;
  • the use of keys; and
  • decommissioning mechanical locks and keys.

Why is key control important?

Keys should be audited as their control is an important factor in retaining an installation’s security and also the integrity of the key and lock.  

A lock will only achieve its maximum protection when fitted to a security product of equivalent worth and it is by this careful partnering that the highest levels of protection are achieved. If you require a lock to be fitted to a high security doorset and want to achieve maximum protection for the key lock, please refer to NPSA’s Door Security guidance document.  

How do I achieve effective lock and key control?

It is important to control the provenance of locks and keys as they are most vulnerable at the point of supply, in transit or when being stored prior to fitting.   

Commonly, suites of locks, such as those going into large establishments, will be specified with some features which for that application may seem important, but may weaken the overall security of the system, for example a master-key system. 

A master key system is a feature of the lock, which allows varying levels of access to authorised users. It is a type of access control function. For example, Acme Co Ltd has 50 people in its employment. Every member of staff has a key for the front door and their own individual office areas. Only the Managers have a key that opens every door on a dedicated floor in the building (known as sub master keys). The managing director has a grand master key that opens every door in the building. 

Allowing an attacker access to either the grand master key itself, or a cylinder that contains the grand master pattern will undermine the entire system. NPSA recommend that a professional locksmith or security practitioner designs the key system for your organisation. 

A typical master system is shown below, comprising a Grand Master, which unlocks all doors, two Sub Masters for the first and second floors and then 5 individual room keys, each only opening their individual door. 

Diagram of a typical master system

High security cylinders are tested for their resistance to numerous types of manipulation. They are invariably expensive, so with careful planning of the installation they may not need to be fitted to every door. Before fitting a high security lock onto a door it will be important to consider access to the space.  It would be pointless, for example, to fit a high security lock if the room can be accessed from an adjacent room via a shared false ceiling or raised computer flooring. 

Choosing a mechanical key lock

When choosing a mechanical key lock, use the following guide to determine the risks and mitigations most suitable for your installation (Figures 2 and 3 illustrate options of high security key locks): 

  • Do you have trained security personnel who can design a system or should you bring in specialist advice?
  • Conduct a requirement capture exercise with your security controller or specialist to identify what security features are needed for your organisation;
  • It may not be appropriate to install high security locks in every area. Certain areas, such as a store cupboard, may only require low-level security locks;
  • Ensure the lock and the security furniture it is housed within are commensurate;
  • Always use the official dealer for the lock you have chosen; 

Figure 2: Cutaway diagram of features of a high security cylinder

 

Figure 3: Cam lock which can be used in security containers (fixed or transportable)

 

What measures can I adopt to mitigate the risks?

  • Manufacturers may keep a record of the key pattern for your organisation (this is also known as a pinning list).  NPSA recommend you discuss the security of the records to ensure adversaries cannot access them;
  • A lock with a master key system installed is made to work on several different patterns and will be intrinsically less secure and is not recommended where the highest security is required;
  • Where the risk dictates, consider sending the keys and the locks through different routes. On receipt, locks and keys should be stored in a secure location;
  • Several lock suppliers are known to operate a secure wrapping programme and will be able to supply their products in tamper evident containment where appropriate;
  • Locks and keys should be sent and stored in tamper evident packaging and via a trusted courier;
  • Doors left open and unlocked are more vulnerable to covert attack;
  • The boxes and wrappings the locks came in should be disposed of securely;
  • High security keys should never leave the building they are intended to protect;
  • Keys should only be released to an approved user;

What procedures should I adopt for good key and lock control?

  • Set policy for the control and distribution of keys and locks so that access is limited to approved individuals;
  • The security officer should know the location and issue of any key at all times and a record of keys being issued should be up to date. Only the minimum number of keys should be issued. In both scenarios key logs or datasheets should be used;
  • Unissued keys should be under the security officer’s control and stored appropriately, possibly in a key keeper cabinet if the risk dictates;
  • Users must be instructed never to lend keys to any person who is not authorised to have access, nor to leave them on public display;
  • Random musters of all keys should take place (preferably every 6-12 months);
  • In a new build, use low level cylinders until the building is in your complete control, then install your high level system, starting with the external doors;
  • Develop a policy and a process for dealing with lost keys – as an example, should the front door key be lost, a spare cylinder with sufficient keys for all authorised users should either be immediately available on site or can be supplied immediately upon instruction;
  • Instruct staff on the proper use and care of keys;
  • If emergency key boxes must be used, choose an approved device;

What happens at end of a key and locks use?

When no longer required, locks and keys should be disposed of securely. (see NPSA Secure Destruction of Sensitive Items Standard).

What is an electro-mechanical key lock?

An electro-mechanical key lock will provide all of the facilities of a mechanical key lock, but will have some added form of electronic control mechanism, using elements in both the key and the cylinder to give assurance that the correct key is being used. It will also contain some audit function. If an individual key is lost, its details can be removed from the system; thus not having to replace all the suite of locks on the site. They also allow timed or one-off access for visitors, which do not compromise the entire installation. 

Choosing an Electro-Mechanical key lock 

  • Use only locks from the CSE; some commercial makers have put ease of use above absolute security.
  • Always use a reputable supplier or manufacturer, if buying direct;
  • Remember that a key lock and doorset pairing will take the CLASS of the lower rated product
  • Do not use a master-keyed system where the highest security is required. A lock with a master key system installed is made to work on several different patterns and will be intrinsically less secure;
  • Where the risk dictates, consider sending the keys and the locks through different routes. On receipt, locks should be stored in a secure location;
  • Locks should be sent and stored in tamper evident packaging and via a trusted courier;
  • When no longer required, locks and keys should be disposed. (see NPSA Secure Destruction of Sensitive Items Standard);
  • Protect the computer which monitors and controls the system and ensure that access to it is limited to properly trained and cleared personnel. It must be stored in an appropriately locked location;
  • Where audit has been a feature of accreditation, proper audit logs must be kept and used;
  • Instruct staff on the proper use and care of electro-mechanical keys;
  • Develop a policy for dealing with lost keys. This is easier with electro-mechanical locks since it will usually be a simple act of reprogramming.

In all cases, your security advisor will have access to the most up to date information their advice should be sought before locks or installations are planned.  

Where high physical strength is the most desired quality for an installation, ensure that the locks chosen are partnered with the appropriate security product, furniture (i.e. door handles, escutcheons), which will have been tested for their attack resistance. 

Freedom of Information Act (FOIA) 
This information is supplied in confidence and may not be disclosed other than to the agreed readership, without prior reference to NPSA. Within the UK, this material is exempt from disclosure under the relevant Freedom of Information Acts and may be subject to exemption under the Environmental Information Regulations and the Data Protection Act 1998.   

Disclaimer 
This document has been prepared by the National Protective Security Authority (NPSA). This document is provided on an information basis only, and whilst NPSA has used all reasonable care in producing it, NPSA provides no warranty as to its accuracy or completeness. To the fullest extent permitted by law, NPSA accepts no liability whatsoever for any expense, liability, loss, damage, claim, or proceedings incurred or arising as a result of any error or omission in the document or arising from any person acting, refraining from acting, relying upon or otherwise using the document. You should make your own judgment with regard to the use of this document and seek independent professional advice on your particular circumstances.   
 

© Crown Copyright 2015 

Did you find this page useful?
helpfulness rating