Four ex-employees know the alarm code to your office. Nobody changed it, because nobody owns it, and it is not written down anywhere authoritative — which is exactly why nobody changed it.
Door codes are the credentials small offices forget they have. They accumulate: a front-door code from the lease signing, a side entrance for the cleaners, the alarm panel, the garage, the server room closet. Each adopted by a different person at a different moment, none of them in the password manager, all of them outliving the people who set them.
Here is the policy that retires them, in the time it takes to walk the building.
1. Inventory before policy. List every keypad and every code: front door, back door, side entrance, garage, gate, alarm panel, server room. Each code goes into the password manager vault — not "door-codes.xlsx" on the shared drive, which is the most commonly leaked credential store in small business. The vault entry per door: location, code, who approved it, last rotation date. A code nobody can name the owner of gets rotated this week, not documented.
2. Two rotation clocks. Shared codes (known by more than two people) rotate quarterly — ten minutes: new value, keypads updated, one log line. And event-triggered rotation, same day: any departure, any contractor end date, any cleaning-company change, any suspected leak. You rotate on departures even for people you trusted — the point is not suspicion, it is that four people knowing the code is the risk regardless of character.
3. The departure nuance. Change the code after the final walk-through, not in front of the person packing their desk. Same control, no insult. And ask the fifteen-second question in the walk-through: "anything you shared access to?" — that catches the courier code and the garage code that were never in the vault.
4. Tier the codes. Least privilege applies to doors: the cleaner needs the side entrance, not the server room. Alarm codes are their own tier — alarm code plus front-door code is the complete burglary kit, and shared alarm codes are a finding in every insurance inspection. The server room door outranks almost every digital credential you own.
5. How codes travel. Through the vault's share, or in person — never chat, never email, never the sticky note inside the alarm cabinet. A code pasted into a group chat lives in phone clouds and lock-screen notifications forever.
6. Keypad realities. Length and lockout beat cleverness: six digits, lockout after repeated wrong entries, no 1234/2580. And test one thing most people never test: pull the power and see whether the keypad reverts to factory defaults. Some cheap units do — meaning the code you rotated is not the code that opens the door after the next outage. That unit goes to the top of the replacement list.
7. The log and the leak runbook. One code-change log, four columns: date, door, rotated, authorized by (values live in the vault, never in the log). And when a code leaks — the visitor who watched it get typed, the driver who overheard it — rotate within the hour, log it, and ask who else might have it. Same play as a leaked API key, just heavier hardware.
The full checklist with the inventory template and change-log columns is free on our ops-notes site:
Door Code Rotation Policy for Small Teams →
Related free guides: the badge and door access control checklist and the physical security checklist for small offices.
If you want the fill-in-the-blank versions, the Ops Starter Kit is $14, and the free one-page First 30 Minutes incident checklist is the place to start.
Top comments (0)