Physical security
A physical key and access-card register for a small office
A simple register that records every key and access card, who holds it, when it was issued, and how a lost credential is disabled before it becomes an incident.
Start with repeatable IT work that has a clear owner, clear access limits, and a review cadence. Keep risky technical decisions with the manager or provider who owns the system.
Delegation playbook
On this pageJump to section
A small office often knows exactly who has a laptop but has no idea who holds the spare key to the server cupboard. Keys and access cards move between staff, cleaners, contractors, and former employees without a written trail. A physical access register records each credential, the person who holds it, and the date it must come back. The register is a simple control that closes a gap alarms and cameras cannot cover.
List every key and card
Walk the office and write down every lock, door, cabinet, and card reader that grants access. Include the server room, the network cupboard, storage areas, and any cabinet that holds backup media or signed contracts. Record the lock type and whether it can be rekeyed or must be replaced. A register that covers only the front door leaves the important doors unmanaged.
Give each credential a unique number and tie it to the door or system it opens. For cards, record the printed number and the system identifier if they differ. For keys, note the stamp or a tag added by the office. Keep the list in a controlled document rather than a note on someone's phone. The numbering is what lets you trace a lost item back to a specific lock.
Assign custody to a person
Record the name, role, and department of the person who holds each credential. A shared key with no named holder cannot be recovered when the team changes. For a key that must be shared, name a custodian who signs it in and out. The custodian is accountable for the key even when someone else is using it.
Separate the master key from the working keys and limit the master to the smallest possible group. Record the reason each person needs access rather than granting a key because it is convenient. For contractors, tie the issue to the engagement end date. A register with a named holder turns an anonymous key into a traceable permission.
Record issue and return
At issue, record the credential number, the holder, the date, and the signature or ticket confirmation. Note any deposit or agreement that applies and where it is stored. Give the holder a short explanation of the return rule and the lost-key process. The conversation matters because a key handed over silently is a key that will be forgotten.
At return, record the date and the condition of the key or card. Confirm that the credential still opens the right door and has not been copied or damaged. Update the register immediately rather than waiting for the monthly review. A return that is not recorded is indistinguishable from a key that is still out.
Control the spare keys
Keep spare keys in a locked cabinet with its own access list and a sign-out sheet. Record who opens the cabinet and when, even if the answer is the office manager every morning. Limit the spare set to the number needed for emergencies and lost-key replacement. A large spare set multiplies the exposure without adding real resilience.
Check the spare set during the quarterly reconciliation and confirm that each key still matches its lock. Replace the cabinet lock when a holder leaves or when the spare set cannot be accounted for. Do not hide a spare key outside the building, because an exterior hiding place is the first thing an intruder checks. The spare set should be easier to audit than to improvise.
Reconcile the register each quarter
Compare the register with the physical keys and the card system report on the same day. Mark every credential that cannot be matched and investigate it before closing the review. Confirm that departed staff and ended contractors have returned their items. A quarterly reconciliation catches the quiet drift that a busy month hides.
Record the result, the date, and the person who performed the check. Note any credential that was replaced and why. Report the number of outstanding items to the office manager and the IT owner. The report does not need to be long, but it should show that the register matches the doors.
Handle a lost key quickly
Ask the holder to report the loss as soon as they notice it, without waiting to see whether the key turns up. Record the time, the location, and the doors the credential opens. Decide whether the lock can be rekeyed or the card disabled immediately. The decision should follow the sensitivity of the door rather than the cost of the lock.
For a card, disable it in the access system and issue a replacement with a new number. For a key, rekey the affected lock or move the valuable items behind a second lock. Record the action and the date in the register. Tell the other holders if their key is affected, because a rekey changes their access too.
Keep the register usable
Use a format that one person can update in a few minutes and another person can read without training. Keep the columns consistent and avoid free-text notes that hide the important fact. Store the register where the office manager and the IT owner can both reach it. A register that is hard to update will not be updated.
Review the register whenever a person joins, leaves, or changes role. Add a short field for the reason access is needed so the next review has context. Remove entries for locks that no longer exist rather than leaving them for history. The register is a living control, and its value depends on staying current.
Sources and next step
Use the CISA Cross-Sector Cybersecurity Performance Goals and the NIST Cybersecurity Framework 2.0 as primary references for the asset, endpoint, change, physical access, and identity practices discussed in this guide. The NIST patch management planning guidance supports the change handover steps, and NIST digital identity guidance supports the contractor authentication checks. Apply your own policies, contracts, and system documentation to the workflow. Compare this guide with the MFA enrollment review and the spare laptop loaner log before changing a live process.
Keep decisions, approvals, and evidence in systems the business already controls. If the coordination is recurring and your technical owner can define the boundaries, review the IT virtual assistant service areas and contact ITVirtualAssistant to discuss a limited pilot.
Operating brief
What this guide should help you decide
Routine intake, status updates, records, screenshots, and documentation upkeep.
Approvals, risky system changes, security decisions, and final technical judgment.
How to use this guide
Use this page to decide what an IT virtual assistant should handle first. If the task is recurring, documented, and easy to review, it is usually a better first delegation candidate than work that requires live technical judgment.
Treat the article as an operating brief, not just a topic overview. The goal is to turn loose IT work into a named workflow with inputs, outputs, permissions, review cadence, and a handoff rule that protects the business while reducing manager load.
Workflow
Recommended operating workflow
Define the request
Write what a physical key and access-card register for a small office means in your company, where requests enter, and what finished work looks like.
Limit the access
Give the assistant only the tool permissions needed for intake, records, status updates, or documentation.
Run a pilot
Use a two-week sample period so the manager can review accuracy before expanding the workflow.
Review patterns
Summarize repeat issues, blocked requests, and escalation volume so the technical owner can improve the process.
Decision rules
| Question | VA fit signal | Escalate when |
|---|---|---|
| Is the work repeatable? | The same request appears weekly and can be described in steps. | The request changes business policy or system design. |
| Can quality be reviewed? | The manager can inspect the output without redoing the work. | Only a senior technical person can judge correctness. |
| Is access contained? | The assistant can work with read-only or role-limited access. | Admin rights, customer data, or security settings are involved. |
Delegation checklist
- Write the intake source, expected output, and manager review cadence.
- Confirm the assistant has only the permissions needed for the workflow.
- List the events that require escalation before work continues.
- Track examples for two weeks before changing the workflow.
- Save examples of good and bad outputs so the assistant has concrete references.
- Review the workflow monthly and remove permissions that are no longer needed.
Example first-week agenda
Day one should cover the workflow owner, tools, allowed actions, forbidden actions, and escalation language. By the end of week one, the assistant should have produced a small sample of completed work, a list of unclear requests, and a manager-reviewed improvement note.
What to review before delegating
Confirm the owner, access level, review cadence, and escalation path before assigning any recurring IT workflow to a remote assistant.
What should an IT virtual assistant handle first?
Start with repeatable, reviewable work such as ticket summaries, account records, documentation updates, and checklist follow up.
Get free IT support review