Good vendor access control comes down to six practices: know exactly who has access, issue credentials to individuals rather than companies, keep a log of every key, fob and code, verify lock-up at the end of each visit, respond immediately to lost credentials, and recover access when people or vendors change. These steps apply to any after-hours vendor, especially cleaning crews, who are often the only outside party in a building at night.
Why vendor access is a common security gap
Organizations spend heavily on locks, cameras and alarms, then hand a ring of keys and a shared alarm code to a cleaning company and never think about it again. Over time the keys get copied, the code gets shared with new hires, nobody knows how many people can enter, and departed workers may still have access.
Security frameworks treat this seriously. CISA's physical security resources emphasize controlling who can enter facilities. NIST's SP 800-53 physical and environmental protection controls include authorizing physical access, maintaining access lists and logging entry. Federal rules for national banks in 12 CFR Part 21 require security programs covering opening and closing procedures. The principles scale down to any office, clinic or warehouse.
Practice 1: Know who has access
Ask your vendor for a list of every person who will enter your building, by name. Require notice before anyone new is added. A vendor that cannot tell you who has your keys does not control them.
Practice 2: Issue credentials to individuals
- Fobs and cards: issue one per person, so entries can be traced
- Alarm codes: individual codes where your system allows, never one shared vendor code
- Keys: if you must use metal keys, issue a limited number, numbered, signed out to named people
Individual credentials make every arm, disarm and entry traceable, and let you revoke one person without changing everything.
Practice 3: Keep a credential log
| Field | Example |
|---|---|
| Credential ID | Key #4, Fob 1182, Alarm user 7 |
| Issued to | Named person and company |
| Date issued | 2026-10-01 |
| Access scope | Main entrance, suite 200, not records room |
| Date returned | — |
| Notes | Replaced lost fob 1175 on 2026-09-28 |
Both you and the vendor should keep this log. Review it quarterly.
Practice 4: Tag keys anonymously
Keys should be tagged with a code, not your company name or address. A lost key with an anonymous tag is a much smaller risk than one labeled "ABC Clinic, back door."
Practice 5: Verify lock-up every visit
Require a written lock-up checklist specific to your building:
- Exterior doors latched and locked
- Designated interior doors locked
- Windows closed
- Lights set as you specify
- Alarm armed
Ask what the vendor does if a door will not latch or the alarm will not arm. The answer should be your escalation procedure, not "we leave and tell them tomorrow."
Practice 6: Respond immediately to lost credentials
Agree in writing that lost keys, fobs or code exposures are reported to you immediately. Decide in advance whether a lost key triggers rekeying, and who pays. Deactivate lost fobs right away.
Practice 7: Offboard properly
When a vendor's employee leaves your account, or the vendor relationship ends:
- Recover physical keys and fobs and record their return
- Delete individual alarm codes and fob credentials
- Consider changing shared codes
- Confirm the vendor's internal records match yours
Contract termination clauses should require prompt return of all credentials. See janitorial contract terms.
Restricted areas
Decide which rooms vendors should never enter, such as records rooms, cash rooms, server closets, medication storage and executive offices, and either keep them locked with keys the vendor does not hold or set specific conditions for entry. Write the list into the vendor's scope.
Screening the people behind the credentials
Credential control works best when the people holding credentials have been screened. See janitorial background checks for what to require.
A quick vendor access audit
- Can your vendor name everyone with access today?
- Are alarm codes individual?
- Do you have a current credential log?
- Are keys anonymously tagged?
- Is lock-up documented every visit?
- Did you recover credentials from the last person who left?
If you answered no to two or more, your vendor access needs attention.
How Northmark handles access
Northmark builds these practices into every account: background-checked, assigned staff, credentials logged to individuals, anonymous key tags, lock-up checks every visit and immediate reporting of lost credentials. See security and access control and after-hours janitorial.
Frequently asked questions
Should cleaning crews share one alarm code?
No. Individual codes make every arm and disarm traceable and let you revoke one person without changing the code for everyone.
What should happen if a cleaner loses our key?
You should be told immediately, the credential should be deactivated if electronic, and you decide whether to rekey based on risk.
How often should we review vendor access?
Quarterly, and whenever a vendor employee joins or leaves your account.
Should keys be labeled with our business name?
No. Use anonymous codes so a lost key cannot be traced to your building.
Sources
Published · Northmark Facility Services.