Security keys and combinations
Article 13
1. The LSO shall have overall responsibility for ensuring the proper handling and storage of keys and combinations used in or to access Secured Areas. Keys and combinations shall be stored in a security container and shall be protected to at least the same level as the material to which they give access. 2. The LSO shall maintain a register of security containers and strong rooms, together with an up-to-date list of all staff members who have unescorted access to them. 3. The LSO shall maintain a register of keys for security containers and strong rooms, including the staff members to whom they are allocated. A receipt shall be kept for each key that is issued, including the key identification, recipient, date and time. 4. Keys and combinations shall only be issued to staff who have a need to know and who have been granted the appropriate authorisation to access EUCI. The LSO shall retrieve any key when those conditions are no longer met. 5. The LSO shall keep spare keys and a written record of each combination setting in individual sealed, opaque, signed and dated envelopes to be provided by the staff member responsible for the keys. Those envelopes shall be kept in a security container that is rated for the highest classification of material that is stored in the relevant container or strong room. 6. If, upon a change of combination or key rotation, an envelope shows evidence of tampering or damage, the LSO shall treat that as a security incident and immediately inform the CSA. 7. Changes to the combination settings of security containers in Secured Areas shall be performed under the supervision of the LSO. Combinations shall be reset at least every 12 months and whenever: (a) a new container is received or a new lock is installed (in particular, default combinations shall be changed immediately); (b) a compromise is suspected or has occurred; (c) access is no longer required by a person possessing a combination. 8. The LSO shall keep a record of the dates of the combination changes referred to in paragraph 7.