Response When a Master Key System Is Found Compromised

Purpose

A lost master key does not compromise one door, it compromises every door under it, and the property manager who calls in a panic usually cannot say how far that reaches because nobody but the bitting list can. This procedure exists so the shop answers that question from the record rather than from habit, contains the exposure the same day rather than waiting for the full fix, and gives the building's owner a real, tiered decision instead of a single expensive option delivered as the only one.

Without it a shop either underreacts, rekeying the one door someone complained about while the same lost key still opens a dozen others under it, or overreacts, quoting a full building redesign when the exposure was actually one small branch, either of which costs the customer's trust the next time something goes wrong.

Scope

Covers discovery that a key on an already-commissioned commercial master key system is lost, stolen, unreturned by a departed keyholder, or found to open more than its assigned door. Does not cover the design, pinning, or interchange math of a new or expanding system, owned by the Commercial Master Key System Setup SOP, which this procedure cross-references rather than repeats. Does not cover the shop's own internal blank-cabinet custody, owned by the Key Blank and Key Control Inventory SOP, a different subject entirely, the customer's system exposure here, the shop's own cabinet there.

Roles and responsibilities

Procedure

Step 1: Contain the knowledge of the compromise before doing anything physical. Discuss which doors a compromised key opens only with the named authorized signer, by phone or in person, never on an open channel like a group text or a building-wide email distribution. Naming the exposure broadly is itself an amplification of it. Acceptance: the initial report and scoping conversation stay between the signer and the shop. Wrong looks like an office assistant emailing the whole property management list "we think someone found a master key." Stop rule: if a broad notice already went out before the shop was looped in, that cannot be unsent; log it as a factor raising the urgency of the physical fix rather than treating it as something this step can still fix.

Step 2: Pull the archived bitting list and state exactly which level and doors are affected. A key at a given level opens every door at that level and every change key beneath it in that branch, by definition of the design. Acceptance: a written list of every affected opening pulled from the archived list, not reconstructed from what the property manager thinks the key opens. Wrong looks like scoping from habit, "it's probably just the office doors," rather than the design record. Stop rule: if the archived list cannot be located, or a spot check of a couple of field cylinders does not match what the archive says is pinned there, that mismatch is the worse finding, because the shop cannot state the true exposure at all, and the response widens to verifying the whole affected branch physically, door by door, before any containment tier is chosen.

Step 3: Present the signer with tiered containment options in labor and time, and let them choose. Tier 1, rekey only the compromised level and everything beneath it in that branch. Tier 2, rekey that level and issue new change keys at every door under it, assuming a finder could also have duplicated a change key off it. Tier 3, a full redesign from a fresh bitting list, needed when step 2's mismatch fires and the prior design's integrity cannot be trusted. Acceptance: the signer's choice recorded in writing with the doors-affected count for that tier. Wrong looks like the shop picking a tier unilaterally, even an obviously correct one; it is the signer's building and their sign-off. Stop rule: no signer reachable inside the same business day for a master or grand-master report defaults to a shop-recommended interim measure if the signer has a standing instruction on file authorizing one generically; otherwise the affected doors get the physical containment in step 4 until the signer is reached, never a unilateral rekey without sign-off.

Step 4: Apply a named interim compensating measure to every affected door that cannot be rekeyed the same day, with a stated end date, not a hope. A temporary padlock hasp on a door left on the old, compromised bitting is a real control; asking staff to keep an eye on it is not. Acceptance: every affected opening carries either a completed rekey or a named interim measure tied to the tier's scheduled completion date. Wrong looks like an affected door left on its original bitting with nothing between the report and an eventual rekey appointment days out. Stop rule: an opening with neither a completed rekey nor a working interim measure is treated as an active exposure requiring the signer's immediate decision on temporarily closing that space, not left sitting on the schedule.

Step 5: Execute the approved tier top-down, never bottom-up, and re-run the interchange check for the new bitting. Re-pinning a change key first while its compromised master is still live can leave a mismatched cylinder the old master still opens if the new bitting was not chosen with the same discipline as the original design. Re-run the setup SOP's phantom-key interchange check for the new or adjusted bitting before pinning anything, not just trust that the original design still holds. Acceptance: interchange check passing for the new bitting, top-down pinning order logged. Wrong looks like re-pinning the most-complained-about door first for convenience, leaving the compromised master live over untouched cylinders the longest. Stop rule: a new interchange check that fails stops that group exactly as the setup SOP requires; it does not get pinned on the assumption that the old design "should still be fine."

Step 6: Test every re-pinned cylinder against the old compromised key specifically, and remove the interim measure only once that test is logged for that opening. Use the original key if recovered, or a duplicate cut to its known bitting from the archived list if it was never recovered. Acceptance: the old key confirmed not to turn, logged door by door, and the interim measure from step 4 removed only after that specific opening's negative test is on record. Wrong looks like confirming only that the new keys work, which says nothing about whether the old compromised key still does. Stop rule: any cylinder where the old key still turns is not closed out; it is pulled and re-pinned again, with the interchange check re-run for that cylinder in isolation to find what was missed, before its interim measure comes down.

Step 7: Update and re-archive the bitting list the same day physical work closes, with the compromise on its own change history line. Date, what was compromised, who authorized which tier, which openings were touched. Acceptance: updated list filed the same day as the last cylinder closes out. Wrong looks like "we'll update the paperwork next week," which is how the next technician years from now inherits a list that lies. Stop rule: physical work is not complete until the archive update is filed; do not move to the next job with the old list still standing as the record of record.

The record this produces

The bitting-list-based exposure scope, the signer's tiered decision in writing, the interim-measure log with end dates and removal timestamps, the top-down execution log with its interchange re-check, the old-key negative-test log per opening, and the updated archived list with its change-history entry. Readers later: the next technician working that system, the property's insurer, and the signer defending the decision to a tenant who asks why it took as long as it did.

Worked pass: a departed facilities director's sub-master

An office building's property manager reports that a facilities director who managed the mechanical rooms left the company three weeks ago and his sub-master key was never returned. Step 1 passes: reported directly to the shop owner by phone, not broadcast.

Step 2: the archived bitting list shows the sub-master, Group M, sits below the grand master and above six change keys covering mechanical and utility doors. A spot check of two field cylinders against the archive turns up a mismatch: one utility closet's cylinder does not test to the bitting the archive records for it. Step 2's stop rule fires. The archive cannot be trusted alone for Group M, so all six doors get physically verified against a working key before any tier is chosen. That verification takes about an hour and a half on site: five of six match the archive, and the building's own maintenance log confirms the sixth cylinder was swapped by another vendor during an unrelated repair roughly two years ago, off the books.

Step 3: given the confirmed mismatch, the lead recommends and the property manager approves a Group M rekey with a refreshed sub-branch bitting, Tier 3 scoped to that group only, since the grand master and parallel branches are untouched by either the compromise or the mismatch. Step 4: all six doors get a temporary padlock hasp the same afternoon, since even the five matching doors remain on the compromised sub-master's bitting until rekeyed, with a next-morning rekey appointment as the stated end date.

Step 5: the next morning, the sub-master is re-pinned first, then the six change keys, interchange check re-run and passing, including the previously mismatched cylinder, which gets a genuinely fresh bitting rather than an assumed one. Step 6: the recut sub-master, since the departed employee's original was never recovered, is tested against all six doors and confirmed dead on every one; hasps come down door by door as each negative test logs. Step 7: the bitting list is updated that same day, with the change history entry naming the departure, the field mismatch discovered during scoping, the Tier 3 decision, all six doors touched, and the property manager as the approving signer.

References

• Commercial Master Key System Setup SOP (owns the bitting list, progression, and the interchange check re-run in step 5)
• Key Blank and Key Control Inventory SOP (owns the shop's own cabinet custody, a distinct subject from the customer's system exposure covered here)
• ALOA Security Professionals Association master keying terminology and instruction