A cleaner access policy is a written set of rules that controls how cleaning staff enter a property, who authorized that entry, and how it gets logged. The one rule that matters above all others: every point of access must be authorized, recorded, and revocable within minutes, not days. Property managers who can’t answer “who has a key right now” don’t have a policy, they have a liability.
TL;DR:
- Staff must be issued keys or codes with unique asset IDs, signed acknowledgment of issuance, and logged check-in and check-out times to ensure accountability.
- Smart lock codes should be individual, regularly rotated, and immediately changed upon suspicion of compromise to maintain security and traceability.
- Background checks must match the risk level of the contract, with written consent and adherence to FCRA procedures to prevent automatic exclusions and ensure consistency across all hires.
- Physical keys and codes need secure storage in locked cabinets, with prompt collection and deactivation upon employee departure, and missing items reported the same day to reduce exposure.
- Quarterly reconciliation of access logs, inventory, and audit signs by a designated owner helps prevent drift and maintains ongoing control over property access.
Table of Contents
- Common access methods and when to use each
- Issuing and tracking keys and codes
- Smart locks, codes, and technical controls
- Vetting and background checks for cleaners
- Custody, storage, and offboarding procedures
- Audit, logs, and insurance
- How to write a cleaner access policy: concise checklist and minimum clauses
- Implementation checklist and verification questions
- Balancing security and operational efficiency
- How Neat and Tidy Pros implements cleaner access policies
- Sources
- FAQ
Common access methods and when to use each
Cleaning crews typically get into a property through one of six methods, and each carries its own failure mode. Physical keys are cheap and simple, but impossible to track once copied, and a lost key on a master-keyed building can force a full rekey. Fobs offer better tracking through electronic logs but fail when a system loses power or a database isn’t synced. Key cabinets centralize storage on-site but only work if someone actually logs the checkout. Lockboxes are convenient for vacant units and short-term turnovers but the code often gets shared informally and never rotated. Smart locks give the most granular control, letting a manager see exactly who entered and when, but they depend on connectivity and battery life. Escorting, where a staff member or resident lets the crew in and stays present, removes almost all access risk but costs the most in labor time.
- Physical keys: lowest cost, highest loss risk, hard to trace once duplicated.
- Fobs: good audit trail, but only as reliable as the system logging them.
- Key cabinets: centralize storage, useless without disciplined logging.
- Lockboxes: fast for turnovers, prone to code leakage if not rotated.
- Smart locks: strongest audit capability, dependent on power and connectivity.
- Escorting: near-zero access risk, highest labor cost.
Restricted areas, medical facilities, and high-value commercial suites generally warrant escorting or single-use codes rather than standing keys. Everyday residential turnovers can usually rely on a lockbox or smart lock as long as codes are managed centrally rather than passed around by text.
Issuing and tracking keys and codes
A policy is only as strong as its recordkeeping, and the mechanics come down to three habits. First, every key, fob, or code needs a unique asset ID rather than a label tied to the property address: a key marked “412 Oak St” that gets lost tells a stranger exactly where to go, while an asset ID tells nothing without the matching log. Second, issuance and return need signatures, not verbal confirmation, both when an employee is hired and when they leave. Third, access notes belong on the customer’s record inside a CRM or field service app, never scattered across group texts or personal spreadsheets where they can’t be audited later.
Industry playbooks recommend building this around six core elements: unique IDs, chain-of-custody logs, a single source of truth, signed acknowledgments, scheduled audits, and clear offboarding steps, and they recommend running the reconciliation on a quarterly basis.
- Assign a unique asset ID to every key, fob, and code before it leaves the office.
- Require a signed acknowledgment at issuance and another at return.
- Log every checkout and check-in with a date, time, and employee name.
- Store all access notes on the customer’s CRM record, not in texts or spreadsheets.
- Reconcile the full inventory against the log on a fixed schedule.
Pro Tip: Treat every issued key like a piece of equipment with a serial number: if you wouldn’t hand out a company laptop without a signature, don’t hand out a master key either.
Smart locks, codes, and technical controls
Smart locks solve the tracing problem that physical keys create, but only when configured correctly. Each employee should get an individual code rather than a shared one, so the system logs exactly who opened a door and when. Codes need rotation whenever staffing changes and regularly at appropriate intervals. Suspected compromise, such as a code shared outside the crew or a phone with saved credentials going missing, should trigger immediate rotation rather than waiting for the next scheduled cycle.
- Issue one code per employee, never a shared team code.
- Rotate codes on any staffing change and at least once a quarter.
- Rotate immediately on suspected compromise, no exceptions.
- Plan for dead batteries and app lockouts with a documented backup entry method.
- Clarify in writing whether the client or the vendor owns and controls the smart lock account.
Trade sources note that smart locks cut key-handling risk but shift it toward account control, which makes documenting the account owner and backup access as important as the lock itself.
Vetting and background checks for cleaners
Screening depth should match the contract, not follow a single default. A recurring residential client might only need a county-level check, while a commercial account with after-hours access or a government facility may require a national or fingerprint-based FBI check. Background-check best practices call for matching check depth to risk level, getting written candidate permission, and following the Fair Credit Reporting Act’s adverse-action process before denying or terminating someone based on a report.
- Match check depth to contract risk: county, national, or fingerprint/FBI for high-access roles.
- Get signed candidate authorization before running any check.
- Follow FCRA’s adverse-action notice and response window if a report affects a hiring decision.
- Use an adjudication matrix so a single old offense doesn’t trigger an automatic, blanket exclusion.
One in-practice standard worth noting: background-check guidance for cleaning businesses recommends standardizing checks across every hire, including part-time and subcontracted staff, rather than screening only full-time employees. Skipping subcontractors is one of the more common gaps that shows up during commercial vendor audits.
An adjudication matrix, a simple table matching offense type and age to a hire or no-hire decision, keeps screening consistent and helps avoid the kind of blanket exclusions that draw scrutiny under EEOC guidelines.
Custody, storage, and offboarding procedures
Keys and codes need one home, and it isn’t a vehicle glove box or an employee’s kitchen drawer; they should be stored following secure handling of house keys best practices for safety. A locked cabinet inside a supervised office is the baseline, with sign-out sheets for every removal.
- Store all physical keys and code sheets in a locked office cabinet, never in vehicles or personal residences.
- When an employee leaves, collect every issued asset the same day and deactivate their digital credentials immediately.
- Rotate any smart lock code that employee could access, even ones they weren’t formally issued.
- Update the customer record to reflect the change before the next scheduled cleaning.
- If a key or code goes missing, report it the same day, decide on a rekey within 48 hours, and notify the affected client promptly.
This sequence matters more for move-in and move-out cleaning, where a vendor often holds keys for days between tenants and a delayed offboarding step leaves a vacant unit exposed.
Audit, logs, and insurance
Visitor and access logs should capture five things at minimum: who entered, what asset they used, the date and time, the purpose of the visit, and who authorized it. GSA’s federal facility guidance sets a useful benchmark here, requiring verification of individual access authorizations, maintained audit logs, and annual inventories of access devices with combinations changed at least yearly or immediately after any suspected compromise.
- Log entry, asset used, timestamp, purpose, and authorizing manager for every access event.
- Run a quarterly reconciliation comparing issued keys, fobs, and smart-lock user lists against the master log.
- Review and sign off on the reconciliation with a named audit owner, not left informal.
- Confirm insurance coverage for holding client keys before taking on a contract.
Holding client keys creates what insurers call care, custody, and control exposure, and standard general-liability policies sometimes exclude it. A key-replacement endorsement paired with a janitorial or employee-dishonesty bond typically costs less than a single rekey event and is increasingly requested in commercial bid requirements.
Pro Tip: Ask your insurance agent to confirm key-related coverage in writing rather than assuming a general-liability policy already includes it.
How to write a cleaner access policy: concise checklist and minimum clauses
A usable policy fits on one or two pages and covers six minimum clauses: scope of the property and units covered, the authorized-access list by name, issuance and return rules, vetting standards, incident response steps for a lost key or code, and the audit schedule. Everything else is detail that supports these six.
- Define the scope: which units, doors, or areas the policy covers.
- List authorized personnel by name, updated every time staffing changes.
- Spell out issuance and return rules, including who signs off.
- State the minimum vetting standard for anyone on the access list.
- Set the incident response steps for a lost or compromised credential.
- Fix the audit schedule and name who owns it.
| Template item | Purpose |
|---|---|
| Asset ID table | Tracks every key, fob, and code issued |
| Signature block | Confirms issuance and return at hire and offboarding |
| Offboarding checklist | Guarantees credentials are pulled the same day someone leaves |
| Audit log | Records every access event for later review |
The policy should be signed by both the property manager and a vendor representative, with one named person owning the quarterly audit so it doesn’t quietly lapse.
Implementation checklist and verification questions
Before signing a vendor, run a short verification pass rather than taking claims at face value.
- Ask how SDS access works for mobile crews and whether it includes an offline backup.
- Ask whether the vendor follows CIMS or an equivalent operational standard.
- Request proof of insurance, including any key-replacement endorsement.
- Ask how key and code handoffs are logged, and who reviews the log.
- Confirm how quickly credentials get pulled after an employee departs.
A short list of questions worth asking any cleaning company covers most of this ground in one conversation. On-site checks matter too: watch whether the crew signs in, whether they use an assigned code rather than a shared one, and whether supervisors can explain who has access without checking a phone. How a cleaning appointment typically runs from arrival to sign-off gives a useful baseline for what compliant access should look like in practice.
Balancing security and operational efficiency
The tension in any access policy is real: tighter controls mean more friction for the crew, and looser controls mean more risk for the property. Written policies with signed acknowledgments settle disputes before they start, because a signature answers the “who knew what” question that verbal agreements never can. A quarterly reconciliation catches the slow drift, an ex-employee’s code that never got pulled, a key nobody remembers issuing, before it becomes an incident. If you manage more than a handful of units, block time this month for one reconciliation pass. It’s the single habit that keeps a policy from decaying into paperwork nobody checks.
— Neat
How Neat and Tidy Pros implements cleaner access policies
Recurring accounts, commercial contracts, move-in and move-out turnovers, and post-construction jobs each create a different access pattern, and Neat and Tidy Pros builds its service around that reality rather than a one-size approach. Basic Cleaning and Deep Cleaning work on standing schedules where key custody stays consistent, while Commercial Cleaning accounts often need the kind of formal vendor credentialing outlined above.
Move In/Out Clean and Construction Cleaning jobs involve temporary custody that has to close out cleanly between tenants or contractors. Every team works from written procedures, with staff screened before assignment and equipped to meet eco-friendly standards. If your property needs a documented access process in place, request an on-site audit or a policy-implementation checklist through the Neat and Tidy Pros services page to get started.
Sources
For legal or technical verification, consult GSA’s physical access guidance, OSHA’s mobile-worksite SDS interpretation, and industry key-management playbooks for operational detail beyond this article’s scope.
- GSA CIO-IT Security-12-64: Physical and Environmental Protection (PE) — Rev. 5
- Cleaning Business Key Management: The Practical Playbook
- Best background checks to protect your cleaning business | Certn
FAQ
What is the 5-5-5 rule for cleaning?
The 5-5-5 rule is a general cleaning-speed guideline, not an access or security standard, and it doesn’t appear in any of the access-policy sources cited here. If you’re looking for cleaning pace benchmarks rather than access rules, that’s a separate topic from the security practices covered in this guide.
Can you provide an example of an access control policy?
A working policy names authorized personnel, requires signed issuance and return records for every key or code, sets a screening standard tied to contract risk, and fixes a quarterly audit with a named owner. The minimum-clauses checklist above (scope, authorized list, issuance rules, vetting, incident response, audit schedule) is a practical template you can adapt directly.
What is the 20/10 rule for cleaning?
Like the 5-5-5 rule, the 20/10 rule refers to cleaning technique or time management, not physical or data access control, and it isn’t addressed by the access-policy sources used in this guide. It’s worth researching separately if that’s what you’re after.
What is an access policy?
An access policy is a written document that defines who can enter a property or system, how that access is authorized, and how it’s logged and revoked. For cleaning vendors, GSA’s physical access framework offers a useful model: verified authorization, maintained logs, and periodic review of who still needs access.