Key Management Cabinet Deployment Across 8 Government Ministry Facilities for Full Asset Accountability

Key management across the ministry's eight facilities operated on a traditional manual system: a physical key board at each facility (a board with numbered hooks and tagged keys) and a paper sign-out ledger managed by the administrative officer on duty. Keys — both vehicle keys and facility/building keys — were signed out by signing a name in the ledger against the key number, and returned by signing back in. The system had been in use for decades and had numerous well-known vulnerabilities that had gradually accumulated into a systemic accountability failure.

The primary problem was vehicle use outside authorized hours. Government vehicles are authorized for official use during stipulated hours and require written authorization for after-hours use from a designated approving authority. The paper sign-out system depended entirely on the administrative officer's diligence in enforcing this requirement. In practice, keys were frequently taken without a complete sign-out entry — particularly by senior officials or drivers who had established relationships with the duty administrative officer — and vehicles were returned without the sign-out being reconciled. The paper ledger for vehicle keys at the headquarters facility had 23 incomplete or unsigned return entries over the six months reviewed during an internal audit.

Vehicle use after hours without proper authorization had resulted in three internal investigation cases in the 18 months preceding this project. In one case, a ministry vehicle was involved in a minor traffic incident at 11pm on a Saturday, and the investigation could not conclusively determine which driver had taken the vehicle or on whose authorization — because the key sign-out ledger for that evening was incomplete. The incident was escalated to the ministry's administrative vigilance unit, which recommended that the vehicle key management system be upgraded to eliminate the manual accountability gap.

Facility key management presented a separate vulnerability. Master keys for building zones — including keys to classified document storage rooms and server rooms — were managed on the same manual system as vehicle keys. The administrative vigilance unit's audit found that at two of the eight locations, the key board was kept in an unlocked desk drawer during business hours — providing any staff member with physical access to the administrative area an opportunity to take and copy a master key without any record.

The audit also identified a ghost key problem: when staff members left the ministry or were transferred, keys issued to them were not consistently collected or recorded as returned. At the headquarters facility, an inventory of named key holders showed 17 currently-issued keys held by persons who had either left the ministry or been transferred to another location — 11 of which had not been documented as recovered.

SSAL designed and deployed Gallagher intelligent key management cabinets at all eight ministry locations, integrated with the ministry's central access management platform.

Gallagher Key Cabinets — 8 Units: One Gallagher intelligent key cabinet was installed at each of the eight ministry locations, sized according to each facility's key inventory:

• Headquarters: 96-key cabinet (vehicle pool keys plus building/security keys)
• Divisional offices: 48-key cabinets (vehicle and facility keys)
• Field facilities: 32-key cabinets (facility and equipment keys)

Each Gallagher key cabinet is a steel-framed wall-mounted unit with electronically controlled key hooks. Each key is fitted with a Gallagher RFID key fob — a small tamper-evident plastic tag that attaches to the key ring and contains an RFID chip. The cabinet continuously monitors which fobs are present on their hooks and which have been removed, enabling real-time tracking of key custody.

RFID Staff Card Authentication: Access to the key cabinet — for any key removal or return — requires the staff member to present their existing Gallagher MIFARE staff ID card to the cabinet reader. The cabinet verifies the card against the authorisation database, confirms that the individual is authorised to access the specific key they are requesting, checks whether the request is within the permitted time schedule for that key (vehicle keys: Monday-Friday 08:00-17:00 only, unless after-hours authorization has been granted by an approving manager via the management software), and then releases only the specific authorised key hook. Unauthorized key hooks remain locked even after cabinet access is granted — a driver authorized to access Vehicle 12's key cannot access Vehicle 7's key from the same cabinet during the same session.

Real-Time Audit Trail: Every key transaction — removal (staff card ID, key ID, timestamp) and return (same data) — is recorded in real time and transmitted to the ministry security office's central Gallagher Command Centre server. The security office maintains a live dashboard showing which keys are currently out, who has them, how long they have been out, and whether any key access is outside its authorised schedule. A key that has been out for more than 4 hours (vehicle keys) or more than 2 hours (facility keys) without a return triggers an automatic alert to the security office duty officer and to the key holder's line manager via SMS.

After-Hours Access Authorization: The Gallagher system provides a digital approval workflow for after-hours vehicle use. A driver requiring a vehicle after hours submits a request via a web portal, which routes to the designated approving officer. The approving officer authorises the specific vehicle key for a specified time window, which is entered into the Gallagher system. The driver can then access the vehicle key from the cabinet during that authorised window only — outside that window, the key hook remains locked. The entire process is documented with a digital audit trail: request, approval, key release time, and return time.

Integration with Ministry Security Office: The Gallagher Command Centre at the ministry headquarters security office provides a centralised view across all eight facilities. The duty security officer can see the real-time key status at any facility, retrieve the complete access history for any key or any staff member, and generate reports for the administrative vigilance unit. Monthly key utilisation reports are automatically generated and submitted to the ministry's administrative audit team in PDF format.

Ghost Key Remediation: Before system go-live, SSAL conducted a physical key inventory exercise at all eight locations, reconciling all keys against the current authorised holder list. Unaccounted keys were identified and reported to the administrative vigilance unit. New key fobs were issued to all keys entering the electronic system, and all keys held by former or transferred staff were formally decommissioned through a key recovery process coordinated with the ministry's HR department.