If a lock combination is written down, which action is required?

If a lock combination is written down, which action is required?

• A. Write it on a sticky note and place it on the lock
• B. Share it with all building occupants
• C. Keep it in a secure file shared with other facilities
• D. Protect it in the same manner as the highest level of classified information the combination protects

Answer: (D)

Treat lock combinations as highly sensitive information. When a combination is written down, you must protect it the same way you would protect the highest level of information the combination could unlock. If the combination grants access to critical areas, that means restricting who can see it, storing it securely (for example, in a locked safe or a highly controlled digital file), and keeping careful custody records. This minimizes risk from loss, theft, or unauthorized disclosure. Sticking a note on the lock is easily read by anyone approaching the door, which defeats confidentiality. Sharing the combination with everyone in the building spreads risk unnecessarily. Keeping it in a secure file that’s shared with other facilities is only appropriate if that file’s protections meet the same high standard; otherwise, it exposes the information to more people than necessary. The safest approach is always to elevate protection to the level of the information the combination protects.

Treat lock combinations as highly sensitive information. When a combination is written down, you must protect it the same way you would protect the highest level of information the combination could unlock. If the combination grants access to critical areas, that means restricting who can see it, storing it securely (for example, in a locked safe or a highly controlled digital file), and keeping careful custody records. This minimizes risk from loss, theft, or unauthorized disclosure.

Sticking a note on the lock is easily read by anyone approaching the door, which defeats confidentiality. Sharing the combination with everyone in the building spreads risk unnecessarily. Keeping it in a secure file that’s shared with other facilities is only appropriate if that file’s protections meet the same high standard; otherwise, it exposes the information to more people than necessary. The safest approach is always to elevate protection to the level of the information the combination protects.