A keying schedule for a master key system is the planning document that lists every lock in a building, assigns each one a key symbol, and places that symbol inside a master key hierarchy so the locksmith knows exactly which keys to cut and how to pin every cylinder. It usually looks like a spreadsheet tied to the architectural floor plans, with one row per door and columns for the hardware set, cylinder type, assigned key symbol, and any cross-keying notes. Done well at the start of a project, it governs every rekey, employee turnover, and tenant change that follows. Done poorly, it quietly lets keys open doors they shouldn’t.
The Key Hierarchy the Schedule Documents
A master key system is organized in levels, and the schedule’s job is to show which level each lock belongs to and which keys reach it.
At the bottom is the change key, which opens one lock or a group of locks keyed alike. One step up is the master key, which opens every lock in a defined group while each lock in that group keeps its own change key. Above that is the grand master key, which operates two or more groups that are each controlled by a different master key. The highest level is the great grand master key, which opens groups controlled by different grand master keys.
The hierarchy looks tidy on paper, but there is a tradeoff. Each additional master level requires extra shear-line combinations inside the cylinder, which means more possible key cuts could accidentally operate that lock. A three-level system in an office building is common and manageable. A five-level system across a university campus has to be engineered carefully to avoid cross-keying problems where a change key from one department accidentally opens a door in another.
What Goes on the Schedule
Each row on the schedule represents a single door, identified by the door number from the architectural drawings. The columns record the hardware set number, the cylinder type (such as a mortise cylinder, rim cylinder, or small-format interchangeable core), the assigned key symbol, and any cross-keying instructions.
Three abbreviations show up on nearly every schedule, and the document usually combines all three:
- Keyed Different (KD): each lock has its own unique key that doesn’t open any other lock in the system.
- Keyed Alike (KA): a group of locks all open with the same key, which is convenient for storage rooms or utility closets where one person needs quick access to several doors.
- Master Keyed (MK): each lock has its own individual change key, but a master key also opens every lock in the group. This is the foundation of virtually every commercial keying schedule.
Exterior doors might be keyed alike under the building manager’s master key, individual offices keyed different with their own change keys, and the whole system placed under a grand master key held by the security director.
Key symbols tie everything together. A key symbol is an alphanumeric code (like “A,” “AA,” or “1AA”) that identifies the correct key combination for a door or group of doors. When a lock has to be operated by keys from outside its normal group, the schedule uses cross-keying notation, typically prefixed with “X” followed by the symbols of every key authorized to operate that cylinder. Visual key control stamping places the key symbol directly on the bow of the key, limited to six characters using only letters and numbers, so anyone holding a key can immediately identify which group it belongs to.1Allegion. What Is Visual Key Control (VKC) on Keys?
The industry standard governing how these systems are designed is ANSI/BHMA A156.28, “Recommended Practices for Mechanical Keying Systems,” which covers system design, keying conferences, and ongoing key management.2ANSI Webstore. ANSI/BHMA A156.28-2023 – Recommended Practices for Mechanical Keying Systems
Decisions You Make Before Drafting
Before anyone types key symbols into a spreadsheet, the building owner or facility manager should sit down with the locksmith or security consultant for a keying conference. ANSI/BHMA A156.28 treats this meeting as an essential step. The purpose is to establish the levels of keying, decide who carries keys at each level, plan for future expansion, and identify unusual access requirements like after-hours zones or shared tenant corridors.2ANSI Webstore. ANSI/BHMA A156.28-2023 – Recommended Practices for Mechanical Keying Systems
Three questions drive the conversation. Who, if anyone, is authorized to carry the top-level master key? Who carries master keys versus change keys? Does every employee receive a key, or do some areas rely on other access methods? A building where only the owner holds a grand master key and department heads hold master keys is a fundamentally different system than one where every employee carries a change key to the front door.
Keyway Choice
The keyway, the specific profile of the key blade that slides into the cylinder, is one of the most consequential decisions the schedule records. A standard keyway means anyone with access to a key-cutting machine and the right blank can duplicate a key in minutes. A restricted keyway uses a unique profile that limits duplication to authorized locksmiths, with the building owner holding an authorization card that must be presented before copies are made. A patented keyway adds legal protection on top of that: only the patent holder’s authorized dealers can cut keys, and only the verified property owner can request duplicates.
Restricted and patented keyways don’t make the locks themselves harder to pick, but they sharply reduce the risk of unauthorized key duplication, which is how most building security systems are actually compromised in practice.
High-Security Cylinders
Some doors on the schedule may call for high-security cylinders rather than standard commercial hardware. These cylinders are tested to resist drilling, picking, and bumping, and carry UL 437 certification along with BHMA high-security test standards.3Medeco. Medeco3 They typically use patented keyways, which means they come with duplication restrictions built in. The schedule should clearly flag which doors require high-security hardware so the manufacturer can plan the bitting accordingly.
Construction Master Keying
Contractors often need access to doors that are hung and fitted with cylinders before the owner takes possession. A construction master key provides temporary access that is voided once the permanent system is activated. If construction master keying is needed, the schedule has to say so, because it affects how the cylinders are combinated at the factory. Once the building is turned over, the construction key stops working and only the permanent keys operate.
Inputs You Need to Draft It
Three documents go into drafting the schedule: current architectural floor plans, a hardware specification, and an access list.
The floor plans provide the official door numbering system. Every lock on the schedule must correspond to a specific door number on the plans, so using outdated drawings is a recipe for mismatched hardware. The hardware specification comes from the lock manufacturer and identifies which cylinder type goes in each opening.4SARGENT. SARGENT – Commercial Locks and Architectural Door Hardware Different manufacturers use different bitting systems, and a schedule written for one manufacturer’s cylinders will not translate directly to another’s.
The access list is where most of the real planning happens. It is a roster of every person or role that needs a key, matched to the specific doors they need to open. The locksmith uses this list to assign key symbols, build the master key groups, and identify cross-keying requirements. Forgetting that the cleaning crew needs access to every floor, or that the IT department needs into the server room on the maintenance master, means rekeying after installation.
After You Submit the Schedule
The completed schedule goes to the locksmith or manufacturer for production. Because the document contains the complete security blueprint for the building, it should move through secure channels rather than unencrypted email. The locksmith uses it to generate a bitting list, which translates the key symbols and hierarchy into the actual mechanical cuts for every key and the pin combinations for every cylinder.
Turnaround depends on complexity. A straightforward master key system for a small office building might take two weeks. A multi-level system for a hospital or campus with hundreds of doors and cross-keying can take a month or longer. When the cylinders and keys arrive, verify that every cylinder matches its designated door number and every key operates the locks it is supposed to. Catching errors before installation is straightforward. Catching them after every cylinder is set in a door means pulling hardware back out.
Why the Schedule Keeps Mattering After Installation
A keying schedule is not a one-time document. It should be updated every time a lock is rekeyed, a new door is added, an employee is terminated, or a key is reported lost. The current version belongs in a secure location with access limited to the people responsible for building security. If someone who shouldn’t have the bitting codes gets hold of them, they have what they need to cut working keys for the entire building.
Good key control also means tracking every individual key issued. A key log records who received which key, when it was issued, and when it was returned. Periodic audits compare the log against the physical keys in circulation. The University of Wisconsin-Madison’s campus master key policy, for example, requires the access control director to order key control record audits as needed and designates specific staff to participate in those audits.5University of Wisconsin-Madison. Campus Master Key Control Policy Frequency varies by organization; the principle doesn’t. If you cannot account for every key, your security schedule is already compromised.
The schedule also controls how much damage a lost key does. When a change key is lost, only the lock or locks it operates need to be rekeyed. When a master key disappears, every lock in that master group is potentially compromised. When a grand master or great grand master key is lost or stolen, every lock and key in the entire system may need to be replaced. In large systems there often are not enough spare cores and keys on hand to change all compromised locks at once, which means the building operates with reduced security during a phased rekey.
One boundary worth knowing before a loss happens: standard commercial general liability insurance often won’t cover rekeying costs. Most policies contain a “care, custody, or control” exclusion that denies claims for property in the insured’s temporary possession, which can include keys. Some insurers offer a separate lost key coverage endorsement that specifically covers rekeying, new cylinders, and replacement master keys, but it is optional and has to be purchased before the loss. For any building with a sizable master key system, that is worth confirming while the schedule is still just a planning document.