# Master Keying a Campus: How a 5,000-Opening System Is Structured

> A campus of 5,000 openings is normally keyed in four or five levels: a great grand master (GGMK) for the campus, a grand master (GMK) for each building or zone, masters for departments or floors, and change keys for rooms. At that size the chart is the easy part. What decides whether the system still works in ten years is three decisions around it: which doors move to card access instead of keys, a keyway family that keeps one building's keys out of another building's cylinders, and a key control routine that survives staff turnover. This page sets out the structure with a worked example, how large systems are rekeyed, and what goes on the cylinder order.

Source: https://cantonlock.com/news/master-keying-a-campus-5000-openings/ · HYDE (Canton Hyland Hardware & Building Material Co., Ltd.), door hardware manufacturer, Zhongshan, China · Published 2026-10-25 · Updated 2026-10-26

Most master key advice is written for one building: a few dozen doors, three levels, one facilities manager. A university, a hospital campus or a large school district is a different problem. With 5,000 openings spread over dozens of buildings, the hierarchy itself is the easy part. What decides whether the system still works in ten years is how the campus is divided before the first cylinder is pinned, and how keys are controlled afterward.

The short answer: plan for four or five levels, divide the campus by building first and by department second, take the exterior doors out of the mechanical system wherever card access already covers them, and build on a keyway family rather than a single open keyway. The level names, the chart and what each level costs in capacity are covered in our master key hierarchy guide. This page is about what changes when the system is the size of a campus.

## The hierarchy at campus scale

The levels are the same five used anywhere. What changes is what each level is mapped to. On a campus the natural unit is the building, because buildings are built, renovated and handed over one at a time, and because a lost key is a problem exactly the size of whatever it opens.

| Level | Mapped to | Typical holder | Opens |
| --- | --- | --- | --- |
| GGMK: great grand master | The whole campus | Head of security; a sealed emergency set | Every mechanical lock |
| GMK: grand master | One building, or a zone of small buildings | The building's facilities lead | Every lock in that building |
| MK: master | A department, a floor or a wing | The department administrator | That department's rooms |
| SMK: sub-master | A trade or a room type inside one building | Custodial, IT or plant staff | Cleaners' stores, risers, IT rooms |
| Change key | One room or one suite | The occupant | One door, or one keyed-alike group |

Two rules keep that table workable. A trade key (custodial, IT, maintenance) is usually a sub-master inside each building rather than one key across the campus: a single campus-wide custodial key is a GGMK in all but name, and it gets copied, lent and lost like any working key. And the GGMK is held, not carried. On many campuses it sits in a sealed emergency set and in very few hands, because losing it means rekeying everything.

## A worked example: 5,000 openings in 40 buildings

The figures below are illustrative: a campus invented to show the shape of the system, not a project of ours.

| Group | Buildings | Keyed openings | Levels used |
| --- | --- | --- | --- |
| Teaching and offices | 18 | 2,100 | GGMK, GMK per building, MK per department, change keys |
| Residences | 12 | 1,900 | GGMK, GMK per residence, SMK for housekeeping, change keys |
| Laboratories | 6 | 700 | GGMK, GMK per building, MK per lab group, change keys |
| Plant and support | 4 | 300 | GGMK, GMK, SMK per trade, change keys |

Residences are the case for keeping card access in mind. In this example, 1,900 doors turn over occupants every year, and every lost student key is a rekey. Many campuses put residence entrances, and sometimes the room doors themselves, on electronic credentials for exactly that reason, and keep mechanical keying for the doors behind them: stores, plant rooms, offices.

## Take the perimeter out of the mechanical system

The single biggest lever on a large system is how many doors it has to cover. Exterior doors are opened by the most people, at the most hours, and they are the doors where a lost key matters most. Where a campus already runs card access on its building entrances, those doors keep a mechanical cylinder only as an override, usually keyed to the GMK and the GGMK and to nothing below them.

Every opening moved off the change-key level is combination space the system does not spend. And a lost student or staff key no longer opens a building from the street, which turns the worst lost-key case into an ordinary one.

## Keyway families: keeping one building's keys out of another building's locks

In a single building, every cylinder shares one keyway. On a campus that is a risk: a change key cut for one building physically enters every cylinder on the campus, and only the bitting stops it turning. Large systems are usually built on a keyway family instead: a master section that the top-level keys are cut on, divided into sub-sections. A key cut on one building's sub-section cannot even enter another building's cylinders, while keys cut on the master section enter all of them.

That gives two layers of separation instead of one. The bitting still separates doors inside a building, and the keyway separates buildings from each other. It also stretches capacity, because a bitting used under one sub-section can be used again under another without either key ever operating the other's locks. A keyway family is a property of the cylinder platform, not something added later, so the platform has to be chosen with the whole campus in mind.

## Rekeying at scale: cores or whole cylinders

A campus rekeys constantly: departures, lost keys, renovations, a department moving to another building. How quickly a door can be rekeyed decides how often it actually gets done. In North America many institutional systems use interchangeable cores, in small or large format: the keyed core is removed with a control key and swapped in seconds, and the lock stays on the door. The control key is then a level of its own, and it has to be controlled more tightly than the GGMK, because it removes cores.

Euro-profile systems, the norm in Europe and much of the rest of the world, rekey by replacing the cylinder. That is still quick: one retaining screw through the forend of the lock case, the cam turned to line up, and the cylinder slides out, as our article on fitting a euro cylinder describes. What it needs is a stock of pinned spare cylinders in the right lengths, so the swap does not wait for an order. Either way, keep a few spare cylinders or cores in each building, pinned to unused change keys inside that building's range.

## Key control is the part that fails

Systems this size rarely fail because the chart was wrong. They fail because nobody can say who holds which key. The routine that prevents it is simple, and it has to be written down before the system is handed over:

- Every key is stamped with its symbol and a serial number, and issued against a signature.
- Keys above the change-key level are issued by role, not by name, and come back when the role changes.
- Departures are checked against the issue log, not against memory.
- A lost key triggers a rekey of every door it opens, and the keying schedule shows the size of that job in advance.
- Duplication is controlled by the keyway, not by a "do not duplicate" stamp, which a key-cutting shop is free to ignore.

The documents behind that routine are the keying schedule, with one row per opening, and the bitting list, which says how every key is cut. The schedule can live with facilities. The bitting list cannot: anyone holding it can cut any key in the system, so it is stored offline and in very few hands. Our notes on writing a keying schedule and on why every bitting must be unique cover both documents.

## Growth: leave room for buildings that do not exist yet

A campus adds buildings. Room for them has to be reserved when the system is first laid out: unused GMK positions for future buildings, and unused sub-sections in the keyway family. A system laid out for exactly the 40 buildings that exist today runs out at the 41st, and the fix at that point is rekeying a building that was never on the original chart. The hierarchy guide sets out how an expansion allowance is designed in, and why it cannot be added afterward.

## What the cylinder order looks like

For a supplier of cylinders, a campus is not one order but a series of them, building by building, all on one platform. What has to be fixed before the first one:

- The cylinder profile and the keyway family, the same in every building.
- Lengths and splits door by door, from the door thickness and the trim on each side. A campus uses several lengths, and on our cylinders the length is the leading figure of the model number: 60 CPDK is a 60mm double cylinder.
- The finish, consistent across a building so a replacement cylinder matches its neighbors.
- Quantities per key symbol from the keying schedule, plus the pinned spares.
- Who holds the system and the bitting list, in writing, before anything is pinned.

We confirm the cylinder range, the lengths, splits, finishes and quantities, and what is committed on key control, per order and in writing. The hierarchy itself is designed by whoever holds the system, usually a locksmith, a security consultant or the platform's manufacturer, because it depends on the platform's own mastering rules and on an organization chart we are not part of. Send the opening count, the building list and the door schedule, and we will say which of our euro-profile cylinders fits each door.

## FAQ

### How many levels does a campus master key system need?

Usually four or five: a great grand master for the campus, a grand master per building or zone, masters for departments or floors, sub-masters for trades where they are needed, and change keys for rooms. More levels than that spend combination space without adding control.

### What is a GGMK?

The great grand master key, the top level of the system, which opens every mechanical lock in it. On a campus it is normally kept in a sealed emergency set and held by very few people, because losing it means rekeying the whole campus.

### What is a keyway family in a master key system?

A set of related keyways built on one master section. Keys cut on one building's sub-section cannot enter other buildings' cylinders, while the top-level keys cut on the master section enter all of them, so buildings are separated by the keyway as well as by the bitting.

### Why do universities use interchangeable cores?

Because a campus rekeys constantly. An interchangeable core is removed with a control key and replaced in seconds, and the lock stays on the door. Euro-profile systems get the same result by replacing the whole cylinder, which is quick when pinned spares are kept on site.

### Should exterior doors be on the master key system?

Where card access already controls the entrances, those doors usually keep a mechanical cylinder only as an override, keyed to the top levels. That takes the busiest doors off the change-key level, and a lost room key no longer opens a building.

Related HYDE models: 60 CPDK, 60 SNDK, 70 SNDK, 47BSIK