Access Control Policy

General

This document pertains to access control of buildings and property owned or occupied by Northern Illinois University (NIU) and will serve as the framework by which keys to university buildings will be issued, monitored, and maintained. The Key Control Office within the Facilities Management and Campus Services and the NIU Department of Police and Public Safety shall implement and oversee the procedures set forth herein.

The Key Control Office and Department of Police and Public Safety shall work closely with the campus community to ensure that all university access needs are met. The dual responsibility of the two organizations will ensure checks and balances to a critical, high-risk university program. Key issuance and control for Housing and Residential Services is governed by the NIU Housing Handbook.

The issuing of keys, maintenance of physical security devices, and other arrangements concerning security for leased properties are covered by the specific lease agreement for the property in question.

Definitions

Pin

A numeric or alpha-numeric password used in the process of authenticating a user accessing a biometric lock or other system designed for this method of entry.

Key Control Authorizer (KCA)

An individual assigned by to manage physical keys and access rights for a university department.

Access Request Form (ARF)

An online form for university key control authorizers to request building access for university employees from the Key Control Office.

Objectives

• To achieve maximum physical security with minimum logistics.
• To establish control of the campus keying system including key duplication and distribution.
• To establish a recorded chain of accountability for all keys issued.
• To establish control of the campus card access.
• To restore physical security in a timely manner whenever access has been compromised.

Applicability

This policy applies to any individual who is granted authorized access to any and to all keys, access cards and devices that control access to NIU property.

Access Control Guidelines

• The duplication of university keys, access cards or key fobs is strictly prohibited.
• No person shall knowingly possess an unauthorized key, access card or key fob to property owned by the State of Illinois through The Key Control Office and Department of Police and Public Safety are the only authorized vendors for university access.
• All keys, access cards and key fobs remain the property of NIU. Keys that are no longer needed shall be promptly returned to the departmental Key Control Authorizer or the Key Control Office.
• All members of the university community are responsible for keys, access cards, key fobs and access code pins assigned to them.
• Lost and/or stolen keys, access card, or key fobs must be reported immediately to the appropriate Department Head, the Key Control Office, and to the Department of Police and Public Safety.
• Lost and/or stolen access cards must be deactivated by logging into MyOneCard account.
• The installation, changing, or removal of locks shall be performed only by an authorized Key Control Office designate.
• Installation of electronic card access readers and biometric locks require the approval of the Key Control Office prior to purchase. All new or replacement card reader installations must use the NIU One Card integrated system or receive a written exemption from the Chief of the Department of Police and Public Safety.
• Keys and/or access cards should at no time be left unattended (i.e., hanging in a door lock, lying on a desk, etc.).
• Department of Police and Public Safety will maintain master keys in a secure box at the Police Department for emergency purposes.

Departmental Responsibility

• Deans, Directors, or Department Heads or their Key Control Authorizer shall be the only personnel authorized to request keys or lock changes within their respective departments. Departmental Key Control Authorizers shall have their authority delegated in writing by their respective Department Head by completing the Key Control Authorizer form (Appendix A).
• Each department shall establish and implement a key control record-keeping system that will ensure accountability for all departmental keys. All records will be considered high security and confidential and shall always be kept current. The Key Control Office will assist each department in developing a workable key control system using the latest information available. Whenever a key audit is requested, each department shall be required to allow examination of all key control records and departmental file keys. The Key Control Office will issue a list of assigned keys to each department on an annual basis for inventory and audit purposes.
• Keys are not to be transferred from their assigned carrier to another without first properly filling out the online Access Request Form (Appendix B).
• Each department is responsible for developing and enforcing a key return policy. All students, faculty, and staff members must promptly surrender all university keys assigned to them upon termination or transfer to another department. Upon termination of an employee, the Key Control Authorizer must comply with the Human Resources Employee Exit Checklist regarding the return off all keys and subsequently complete the Access Request Form to update the Key Control Office.
• Each department is responsible for collecting university keys from students, faculty, or staff members if they are absent for more than four weeks through phased retirement absences, FMLA leave or other reasons. Departments should also make sure to contact the Key Control Office to deactivate electronic access during the leave period.
• Each department is responsible for the total cost of lock changes and new keys to secure areas compromised by lost or stolen keys.

Enforcement

The university regards any violation of this document as a serious threat to security, including security compromises caused by failure to retrieve keys from departing users. Individuals who violate this policy are subject to disciplinary action. Employees departing the university may have a hold placed on their final distribution of benefits and paycheck until all keys are returned.

Procedures

Requests for keys should be completed through the online Access Request Form for processing. For assistance in proper completion, please contact the Key Control Office. The department requesting keys will then be notified by the Key Control Office when the request has been completed. Departmental Key Control Authorizer will sign for completed key orders after they have been delivered by the Key Control Office.

• Keys or card access to areas with special security or potentially hazardous areas such as electrical switch vaults, and labs designated by Laboratory Safety as having other specific hazards, will not normally be issued by the Key Control Office without prior notification to the responsible party occupying the space and Laboratory Safety. If an urgent concern that needs to be immediately addressed exists and the responsible party cannot be contacted, the Key Control Office will utilize resources such as the NIU Department of Police and Public Safety, Environmental Health and Safety, Office of Research Compliance, Integrity and Safety (Lab Safety), and Facilities Management and Campus Services in order to evaluate the potential benefits and hazards of providing Certain areas will require an FBI and Laboratory security clearance prior to providing access unless other arrangements have been made to secure access to these materials prior to entry.
• Parties desiring to limit access to their spaces must contact the Key Control Office for assistance. The Key Control Office will evaluate the request and may seek the assistance of the Department of Police and Public Safety, Lab Safety, and Facilities Management and Campus Services in arriving at a During the evaluation process, the potential risks associated with delayed or restricted access in an emergency situation will be considered. Parties requesting limited access to spaces must have a plan in place to ensure that a responsible person is available on a 24-hour basis in case a situation requiring urgent access should arise. Costs associated with approved limited access requests will be the responsibility of the requesting department.
• When outside contractors need access to NIU facilities, contractors must complete a Contractor Key Authorization & Request form (Appendix C) that will be routed to the Key Control Office, who will require a financial deposit for any and all key distribution.
• The issuing of keys, maintenance of access control devices, and other matters pertaining to physical security for rental properties are covered by the appropriate lease agreement for the property in The university’s proprietary key system will not normally be used in these locations due to the need to maintain the security of the system. Questions concerning physical security for rental properties should refer to the lease agreement and possible discussion with the appropriate landlord.

Insert Key Control Authorizer Form

Insert Access Request Form