How owners record who holds every way into their customers’ buildings and systems, and when it last changed, whether they ever sell or not.
Of all the vendors a commercial customer hires, few hold as many of its keys as its security company. In 2026, the question of who holds them has started to show up in writing.
Some of them are metal: the gate, the telecom room, the fire panel cabinet. The rest live in software and on panels. The installer code on the intrusion panel. The administrator login on the video system. The remote connection into the access control server, set up so a door schedule could be fixed at nine at night without a truck roll. The dealer login on the cloud platform where the customer’s cameras live. The customer handed each of them over for one reason: they trusted the company to hold it.
In an established company those keys arrived one job at a time over twenty years, each one set up the way the work was done then, so a technician on call could answer the page and whoever was nearest could pull footage for a customer the same afternoon. Every one of those choices was a service decision, made to reach the customer faster, and it did.
In the companies we know, the ring exists in pieces. What it rarely has is one place: every way into every customer’s building and systems, who at the company holds each one, and when it last changed. It gets written a customer at a time, on visits already on the schedule, and it pays off whether you ever sell the company or not.
What is on the key ring?
One page per customer, held the same way for every customer. It records who holds each way in and when it last changed, never the codes or passwords themselves, which stay where they are kept today. The plain version has six lines:
- Physical keys: which keys and lockboxes the company holds for the site, where they are stored, and who can sign them out.
- Panel codes: which installer and master codes exist on the intrusion and fire panels, who holds each one, and whether any code is shared with another site.
- Software logins: the administrator logins on the video and access control systems, and whether each one belongs to a named person or is shared.
- Remote connections: every way the company reaches the site from the office, the tool that does it, and whether it asks for a second step at sign-in.
- Cloud platforms: the services where the customer’s cameras, doors, or panels live, and which of your people hold rights on each.
- The customer’s side: who at the customer holds their own administrator login, and the date they were last told which of your people can reach their systems.
Every line carries one more entry: the date it last changed.
Most of it already exists, in pieces: in the site notes in the service software, in the manufacturer portals, in the lockbox log, and in the memory of the technicians who set the systems up. The senior technician who knows a site fills in its page on the next visit, the same visit that writes its site record, and the service manager keeps the pages where only the people who need them can open them. Start with the fifty largest customers, the same fifty the site record starts with. The site record says what is on the customer’s wall. The key ring says who can reach it.
Who is asking now
The question is being put in writing by people customers and their IT departments listen to.
Verizon’s 2026 Data Breach Investigations Report, published in May, found a third party involved in 48 percent of the breaches it examined, up from 30 percent in the prior year’s report. The finding covers vendors of every kind, and an IT department that reads it has a reason to ask each of its vendors how they reach its systems.
In August 2026 the Cybersecurity and Infrastructure Security Agency, CISA, updated its guidance on reducing what organizations leave reachable from the internet, and it lists integrators by name among the third parties to check. It tells organizations to find out which integrators and vendors have remote access to their systems, whether through VPN logins, cellular modems, or other tools, and to ask for the addresses of anything an integrator set up. The guidance is written for critical infrastructure, and the question in it is one any facilities manager can ask.
On September 23, 2026, the FBI and CISA published a fact sheet for organizations that hire integrators to install industrial control systems. It suggests contracts that describe remote access, confirm that default passwords were changed, and list the authorized personnel with access to the systems. Written for industrial control systems, it describes the same list the key ring keeps.
Manufacturers are saying it to integrators in the trade press. In an SDM Magazine article on cybersecure access control in February 2026, one manufacturer’s executive asked integrators to move technicians away from shared passwords across multiple client systems. Another recommended avoiding shared general administrator logins and requiring a second step at sign-in for administrators and remote service.
Your company’s own insurance may ask a related question about your own systems. One major cyber insurer states on its website that it requires multifactor authentication for remote access, email access, and administrative access on the systems of the companies it insures.
On the fire side, NFPA 72 has changed as well. Its 2025 edition moved the cybersecurity guidance that sat in an annex into the chapter itself as requirements, which apply wherever a jurisdiction adopts that edition.
Federal agencies, manufacturers, insurers, and NFPA 72 keep circling one question: who holds the keys, and how do you know?
Reading your own ring
Four questions test a first draft of the ring, and none of them needs outside help to answer.
Is each login a person?
When eight technicians sign in under one name, the system’s activity log shows what changed but not whose work it was. A named login puts each technician’s name on their own work, which protects the technician first. The monitoring side of the industry already keeps this kind of count: UL 827, the standard for listed central stations, requires the station’s own staff to create and assign the logins that dealer and technician personnel use, and dealers cannot create their own. The key ring carries that habit into the rest of the company.
What changes when someone moves on?
People retire, change roles, and take new jobs. On the day they do, the ring answers what changes: which named logins close, which lockbox codes reset, which keys come back to the cabinet. Federal password guidance finalized in July 2025 advises against forcing password changes on a calendar and calls for a change when there is evidence a password has been compromised. The same logic works for a company: a code changes when the list of people who should hold it changes, or when there is reason to think it has traveled, on top of any schedule the customer’s own policy sets.
Does the remote way in ask for a second step?
Remote connections reach the customer without anyone standing in the building, which is why they were set up and why the guidance above keeps returning to them. A connection that asks for a second step, such as an app on a phone, as well as a password is much harder for anyone else to use. On many remote tools, adding that step is a matter of settings. The ring also shows which connections are still doing a job, and a connection that is no longer needed is the simplest line on the page to retire.
Could the customer read it?
If a customer’s IT director asked tomorrow which of your people can reach their systems, and how, the answer should be a page you can send that afternoon. The strongest version gives the customer their own administrator login on their own system and each of your technicians a named login beside it, so the customer never depends on you to get into their own system.
The page the customer keeps
The ring produces one page per customer, and it is worth handing over before anyone asks for it: who at your company can reach the customer’s systems, by what route, and the date each line last changed. Codes, passwords, and settings stay off it, and it goes to the person at the customer who owns the system.
For a longtime customer, the page answers the question before their IT department writes it into a vendor review. For a customer with a new facilities manager, it is one of the first things the new manager learns about you, and it says the company holding their keys keeps count of them. That is a conversation about trust, and nothing on the page asks the customer to buy anything.
What a serious reader sees
The customer retention record is still the first thing we ask for when we review a company, and what is installed at the largest accounts comes soon after. How the company holds access to its customers’ systems belongs in the same review, because in this industry that access is where the customer’s trust lives.
The depth chart asked for know-how on paper instead of in one head. The key ring is the same idea applied to access, and it matters most on the days a company changes: a new service manager, a retirement, a new owner. On each of those days a customer’s IT department may ask who holds the keys now. A key that is written down answers in a morning.
We wrote in the five fundamentals that drive the value of a commercial security company that the fourth is paperwork that matches reality. The key ring is that fundamental applied to the most sensitive thing a security company holds, and a company that keeps it can show every customer the trust they extended is being counted.
Where we stand
A company that can say who holds every key to a customer’s building is honoring the day the customer handed them over. We built Halo Service Partners on the conviction that in commercial security, trust is the product, and the key ring is that trust with a date beside it. Continuity is the center of how we partner, because the trusted local company is the thing worth protecting. The name stays, the team stays, and the customer relationships stay. What changes is what stands behind them: resources across the network, technology and finance among them, so an owner taking on work like this has support behind it, and a company can take the step it has been weighing. Founders choose their own path forward: step back, stay on to lead, or take a larger role across the network.
ProTech Security and Verified Security both run under their own names today, with the leaders and teams who built them still serving the customers who know them.
If you’re thinking about the future
If you own a commercial security company and you are thinking about its future, in any direction, we are glad to compare notes: on how companies like yours keep track of access, on the market, and on what your next chapter could look like. Write the ring for your largest customer first. The page stays between you and that customer. What you learn writing it is where the conversation starts.