This Manual Chapter establishes policy and defines procedures for (1) requesting and reassigning keys (door keys, desk keys, file cabinet keys, study carrels, etc.); (2) changing locks and cylinders; (3) changing safe combinations; (4) locking sensitive areas; and (5) securing equipment.

This policy provides the guidelines for authorized personnel to obtain keys and other locking devices to secure rooms and other items on the National Institutes of Health (NIH) campuses in Bethesda, Maryland, Poolesville, Maryland, and Frederick, Maryland. NIH leased facilities at 6001 Executive Boulevard and 301 North Stonestreet in Rockville, Maryland are also covered by this chapter. This chapter does not apply to the NIH campuses in North Carolina or Hamilton, Montana.

Federal regulations state that the National Institutes of Health (NIH) campus is officially open to the public during normal working and visiting hours, and for approved public events. The NIH is closed at all other times at the direction of the NIH Director. Federal, Department of Health and Human Services (HHS), and NIH physical security policies and guidelines identify requirements for securing facilities against threats and risks.

Major buildings on the NIH Bethesda campus are secured by electronically controlled locking systems.  Entrance and corridor room doors in other buildings are mechanically controlled.

Electronically controlled systems are administered by the Office of Research Services (ORS), Division of Personnel Security and Access Control (DPSAC), in compliance with NIH Policy Manual 1405 – NIH Physical Access Control.  The ORS, Division of Physical Security Management (DPSM), Security and Emergency Response (SER), approves the use and installation of electronic locking systems.

Mechanical locking systems are the responsibility of the Office of Research Facilities Development and Operations (ORFDO).

Due to the overriding security concerns for the protection and safeguarding of employees, visitors, property, and compliance with federally mandated, NIH and the HHS Inspector General Security policies, standards and guidelines, NIH policy is to close and lock building perimeter doors and rooms outside normal business hours and for special events, unless specified otherwise.

The Privacy Act of 1974 requires agencies to establish appropriate administrative, technical, and physical safeguards to ensure the security and confidentiality of Privacy Act records.

Key and cylinder locks are the approved locking mechanism for rooms in NIH facilities except when an electronic access control system is required to comply with regulatory or other requirements.  Use of other than standard locking devices must be approved by the Director, DPSM in writing, prior to its use.

Employees will only be issued one key and one replacement of a lost key for the room they occupy.  If a key is lost, the cylinder may need to be changed and new keys issued. The decision to rekey will be determined by ORFDO/Division of Facilities Operations and Maintenance (DFOM)/Technical Support Team (TST)/Security/Locksmith in collaboration with ORS DPSAC.  

Master keys and/or grand master keys will be issued only to NIH police, fire department officials and the ORFDO/ DFOM/TST/Security/ Locksmith Section.

Keys will not be issued to participants in the Student Temporary Employment Program, summer appointees, special volunteers, guest researchers, etc. Exceptions to this policy must be submitted in writing by the Institute, Center and Office (ICO) supervisor and/or Administrative Officer (AO) to the Director, DPSAC for approval.

1. Director, NIH: Has delegated authority for the protection of NIH facilities and grounds to the Associate Director for Security and Emergency Response (ADSER), ORS, who is the Deputy Chief Security Officer for NIH. The ADSER plans, directs, and coordinates all security functions to ensure a comprehensive protection and security program for NIH. Policies for the key and lock services program are established by the ADSER.
2. ORFDO Division of Facilities Operations and Maintenance (DFOM), Technical Support Team (TST)/Security/Locksmith:  Responsible for the management, operation, and maintenance of the key and lock services systems and components consistent with NIH Physical Security Design Guidelines (available on a need to know basis). The DFOM/TST/Security/Locksmith is also responsible for the maintenance and repair of the access control system.
3. ORS Division of Personnel Security and Access Control (DPSAC): Responsible for management of the electronic access control system, e.g., the issuance of electronic identification cards, programming of access levels, etc.  Additionally, DPSAC is responsible for reviewing all key requests to ensure the requestor has the appropriate clearance/suitability level and access privileges for the areas requiring key access.
4. Institute/Center/Office (ICO) Administrative Officer (AO): The administrative and/or delegated program staff are responsible for requesting and/or approving locksmith services using the NIH Facility Information Management System (FIMS). ICO’s are also responsible for the controlling the use, return of keys, and reporting lost or stolen keys.
5. ICO Executive Officer (EO):  Responsible for ICO compliance with this policy.
6. NIH Employees:  Responsible for complying with the policies stated in this chapter and for the safekeeping of all NIH issued keys and combinations to locks, Sensitive Compartmented Information Facility (SCIF), secured file cabinets, etc.
7. ORS Division of Physical Security Management (DPSM): Ensures that physical and engineering security initiatives at all owned and leased NIH facilities work in concert with the NIH operational security programs and comply with Federal security standards. This includes electronic access control security, Closed-Circuit Television (CCTV) surveillance, and electric door locking systems.

1. Keys or locks for rooms, desks or file cabinets
   1. To request locksmith services, i.e., door key issuance; door cylinder change; door key reassignment, return, or loss; desk/file cabinet key issuance; or emergency key/lock services, a request must be entered into the NIH FIMS  by an individual identified in the FIMS database through assignment of a user ID and approved by the ICO AO.  Requests for Key Management – Locksmith User Manual must be submitted thru the authorized AO. 
   2. ICO’s are only permitted to request keys and locks for space assigned to them by FIMS.
   3. Employees and contractors assigned keys are responsible for presenting an NIH photo identification with the key receipt Signature Form to the Locksmith Section at the location designated for picking up keys, within 30 days of receipt of the notification from the FIMS system that a key is available. A Record of Receipt must be signed when the key is issued. The ORFDO Locksmith will deliver keys to staff with disabilities as well as ICO Directors.
   4. Key reassignments and transfers can only be made by an ICO using FIMS. 
   5. Room keys are limited to one per person for issuance to federal employees.  Construction or Service contractors will not be issued door keys unless authorization is received from a federal employee, who will act as the Key Owner. The ORFDO Locksmith will issue the key to the contractor (Key Holder) who will be responsible for returning the key upon completion of the services provided.  If a key is no longer needed, the Locksmith will return the key in FIMS, update the employee’s records, and destroy the key.
   6. For emergencies involving key or lock failures, e.g., broken locks, keys, door knobs, etc., during normal working hours, Monday through Friday, 7:30 a.m. to 4:00 p.m., call the Locksmith Section, 301-496-3507. For emergencies during non-working hours or for lockouts occurring anytime, i.e., staff locked out of their workplace, call the NIH Police Emergency Communications Center at 301-496-5685. The dispatcher(s) will take the necessary steps to ensure that the door lock or key problem is resolved.
   7. NIH First responders must have access to all facilities and rooms within facilities unless directed otherwise by the ADSER.  The ORFDO Locksmith in coordination with the NIH Division of Police (DP) Police Operations Branch must conduct an annual review of all rooms which DP is not authorized to access.  All other spaces must be accessible to police and fire department personnel.
2. Clearance Procedures – The ICO AO is responsible for ensuring the return of door keys that are no longer needed and/or prior to an employee’s separation in accordance with Manual Chapter 2300-940. Keys must be returned to the ORFDO Locksmith where designated.  If a key is no longer needed, the Locksmith will return the key in FIMS, update the employee’s records, and destroy the key.
3. Safe Lock Servicing and Combination Changes – The ICO AO must contact the ORFDO Locksmith Section on 301-496-3507 immediately upon receipt of a safe, or whenever an employee with knowledge of a safe’s combination leaves an organization. The combination of the security containers must be changed at least once every 12 months or at the relocation, reassignment, or termination of any person familiar with the combination. 
4. Special Locking Requirements or Devices
   1. An area’s sensitivity depends on the type, value and vulnerability of the property to be protected or controlled. When a high degree of protection is justified by security needs, security of the area will be accomplished with the installation of a high security mechanical or electronic lock and card reader. Requests for electronic controlled locks and card reader access should be submitted to [email protected].  DPSM Security Specialist will perform an evaluation of the area for an approval decision.
   2. Requests for high security mechanical locks, along with justification for special security requirements for high risk/sensitive areas, should be submitted to DPSAC and DPSM for evaluation and collaboration with ORFDO ASU Locksmith Section. 
5. Securing Equipment
   1. Theft deterrent devices are available for securing office and laboratory equipment. These devices are available on NIH-wide Blanket Purchase Agreements (BPAs).  On an “as needed basis”, the ORS DPSM may provide consultation service to assist in selecting and ordering anchoring devices to secure office or laboratory equipment.
   2. Keys to specially-installed security equipment such as cables, chains, anchor pads and other security devices may be retained by the ICO AO so that equipment can be repaired, serviced or moved from location to location as necessary. In such cases, the ICOs are responsible for re-securing the equipment. If keys are not available, the security equipment provider must be contacted to unlock the anchoring devices. In emergencies, the ORFDO Locksmith Section may be contacted.  With written authorization from the IC, the Locksmith completes a work sheet to address issue as a trouble call.
   3. Keys to study carrels for temporary storage requirements may be issued and retained by the ICO AO.  In such cases, the ICOs are responsible for maintaining a custody log of who keys were issued to and receipt for keys returned.

1. 45 Code of Federal Regulations, Subpart C, § 3.41 Admission to facilities and grounds
2. NIH Manual Chapter 1381, Physical Security Project Requirements for NIH Owned and Leased Facilities
3. NIH Manual Chapter 1405, NIH Physical Access Control
4. NIH Manual Chapter 1743, Keeping and Destroying Records
5. NIH Manual 2300-940, Clearance of Personnel for Separation or Transfer
6. NIH Privacy Act Systems of Record Notice 09-25-0054, Administration: Property Accounting (Card Key System) HHS/NIH/ORS
7. HHS Privacy Act Systems of Record Notice 09-90-0777, Facility and Resource Access Control Records, HHS