Back to all templates
Physical security & badge access

Key Card Request Form Template

Capture key card and badge access requests with structured intake — employee identity, reason, access level, specific areas, and manager approval. Built for physical security teams managing the onboarding/offboarding lifecycle with audit-grade documentation for SOC 2 physical access controls, ISO 27001 Annex A.7, PCI-DSS Requirement 9.

Free — included in every plan

Key Card Request Form Template

Live preview — try the fields below.

No fields to preview.

Who this template is for

Physical access control is one of those security workflows where the consequences of getting it wrong are large but the workflow gets routine treatment in many organizations. A new employee's first day blocked because the badge isn't ready; a terminated employee retaining building access for days because the deprovisioning didn't trigger; an unauthorized contractor wandering into a restricted area because their badge had broader access than needed; a security audit finding because the access control records don't match the HRIS — these are the predictable failure modes that audit-grade physical access management prevents. This template structures the request itself — employee identity (name + work email + employee ID, the latter being important for the badge-to-employee link in the access control system), reason for the request (New Employee for the onboarding workflow with full provisioning; Lost Card for the replacement with the security implications of the lost card being deactivated; Damaged Card for the replacement without security implications; Additional Access for the access expansion to specific areas; Replacement for the routine renewal), access level required (Standard for office-hours-only access during business hours; Extended for building access outside business hours including evenings and weekends; Full for 24/7 access typically reserved for IT/security/executives/on-call roles; Custom for specific access patterns), specific areas needed (the free-text field for the granular access — server room, executive suite, data center cage, lab area, secure archive, specific floor zones), and manager/approver name (which drives the approval routing). It is the structured intake your physical security and facilities team uses to manage the badge lifecycle — used by physical security teams in mid-to-large companies, facilities ops managers in offices with structured access control, manufacturing and warehouse operations with multiple security zones, healthcare facilities with HIPAA-driven access controls, data centers with PCI-DSS and SOC 2 physical access requirements, regulated industries (financial services, government contractors, defense) with the highest-stakes access controls. Pairs with the modern access control platforms — Kisi (the modern cloud-native platform popular with SMB and mid-market), Brivo (enterprise SMB), Genetec (large enterprise/government with strong unified security), Salto (European-strong, particularly hospitality and healthcare), HID Mercury (the access control infrastructure layer used by many integrators), Lenel S2 (Carrier, enterprise/federal), Honeywell Pro-Watch (Honeywell-owned enterprise), Bosch Access Control, AEOS (Nedap-built strong in EU), Inner Range Integriti (Australian/UK-built), Avigilon Access Control (Motorola-owned), Schlage Access (Allegion), Identiv.

From access request to provisioned badge in one structured flow

Employee or manager submits the request with the employee identity (name + work email + employee ID — the employee ID is the critical foreign key to the HRIS and the access control system), reason for the request (the reason drives the downstream workflow — New Employee triggers the full onboarding sequence with badge issuance, photograph capture for the visual ID, the badge enrollment in the access control system with the appropriate access groups; Lost Card triggers immediate deactivation of the lost card in the access control system to prevent unauthorized use plus the replacement issuance; Damaged Card triggers the simple replacement without security implications; Additional Access triggers the access-expansion workflow with the access-review approval; Replacement triggers the routine renewal), access level required (the four-tier model — Standard / Extended / Full / Custom — corresponds to different access groups in the access control system; the Standard tier is the default for most employees with office-hours-only access during business hours; Extended is for employees needing after-hours access for legitimate work reasons; Full 24/7 is reserved for IT on-call, security, executives, and specific operational roles; Custom is the catch-all for non-standard access patterns), specific areas needed (the granular access detail — server room access requires the security/IT team approval; executive suite access requires the executive admin approval; data center cage access requires the data center manager approval; lab area access requires the lab safety lead approval; specific floor zones may require the floor neighborhood owner approval), and manager/approver name (which drives the primary approval, with the secondary approvals for specific areas as needed). On submission, the workflow auto-routes through the appropriate approval chain. For New Employee requests, the workflow integrates with the HRIS to confirm the active-employee status and the role, then provisions the badge via the access control platform's API. For Lost Card requests, the workflow immediately disables the old card credential and creates the replacement work order with the next available badge ID. For Additional Access requests, the workflow routes to the area owner for the specific approval before the access expansion. For Custom access patterns, the workflow routes to the physical security manager for the custom configuration. The access control platform — Kisi, Brivo, Genetec, Salto, HID Mercury, Lenel S2, Honeywell Pro-Watch, Bosch, AEOS, Inner Range Integriti — handles the credential provisioning via API. For modern mobile credentials (smartphone-based badge replacing the physical card), the workflow provisions the mobile credential via HID Mobile Access, Brivo Mobile Pass, Kisi Mobile, Genetec Mobile Credentials, Salto KS Mobile, OpenPath/Avigilon Alta. The audit trail captures the request, the approval chain, the credential provisioning timestamp, the access groups assigned, and the eventual deprovisioning on termination — which is the documentation that SOC 2 Type II auditors, ISO 27001 certification auditors, PCI-DSS QSA reviewers, and HIPAA compliance reviewers all test.

What's included

Every field exists because some physical security team has been burned by its absence — usually at the SOC 2 Type II audit when the access control records don't match the HRIS and the auditor cites the control deficiency; at the terminated-employee tailgating incident when the deprovisioning workflow had a gap; at the contractor access review when the granular permissions weren't documented and the auditor cited the segregation-of-duties failure.

Companies using key card request forms

  • Tech companies and SaaS with SOC 2 / ISO 27001 certification

    Tech companies and SaaS providers maintaining SOC 2 Type II and ISO 27001 certifications where physical access controls are part of the audit scope. SOC 2 CC6.4 (Logical and Physical Access Controls) requires documented physical access provisioning, periodic access reviews, and termination-driven deprovisioning. ISO 27001 Annex A.7 (Physical Security Controls — under the 2022 version) specifically Annex A.7.2 (Physical entry controls) requires the same. The form's structured intake produces the audit-grade documentation that QSAs and certification auditors test. Pairs with modern cloud-native access control platforms — Kisi (popular with SaaS companies for the modern UX and the strong API integration with HRIS systems like Rippling, Workday, BambooHR), Brivo (enterprise-leaning with strong compliance features), Genetec (larger enterprise with unified physical security), Salto (strong in European tech companies); plus mobile-credential providers HID Mobile Access, Brivo Mobile Pass, Kisi Mobile, OpenPath/Avigilon Alta. The HRIS integration is the critical feature — when an employee is terminated in the HRIS, the access control system must automatically deprovision the badge within hours (most audits require deprovisioning within 24 hours of termination); the structured workflow with the HRIS API integration achieves this.

  • Financial services with regulatory physical access requirements

    Financial services firms (banks, brokerages, insurance, fintech) subject to regulatory physical access requirements. PCI-DSS Requirement 9 (Restrict physical access to cardholder data) applies to any company processing payment card data with specific provisions for physical access control to systems and data; the form's structured intake produces the documentation that PCI QSAs test. NYDFS Part 500 (for New York financial services) Section 500.07 requires access controls including physical access. FFIEC IT Examination Handbook section on physical security covers the physical access expectations for FDIC-insured institutions. For European financial services, the EBA Guidelines on ICT and Security Risk Management require physical access controls. For Spanish financial services, the Banco de España + CNMV oversight frameworks include physical security expectations. For Brazilian financial services, the BCB Resolução 4.658/2018 (Política de Segurança Cibernética) and Resolução 4.893/2021 (Política de Segurança Cibernética para instituições financeiras) include physical access dimensions. Pairs with enterprise-grade access control platforms — Genetec (the dominant choice in financial services for unified physical security), Lenel S2 (Carrier-owned, federal-strong), Honeywell Pro-Watch, AEOS (Nedap, EU-strong), Inner Range Integriti.

  • Healthcare facilities with HIPAA and patient safety

    Healthcare facilities (hospitals, clinics, surgical centers, long-term care, dental practices) with physical access controls driven by HIPAA, patient safety, and accreditation requirements. HIPAA Security Rule 164.310 (Physical Safeguards) requires facility access controls, workstation use policies, workstation security, and device/media controls. For US healthcare, the Joint Commission Environment of Care standards (EC.02.01.01 through EC.02.06.05) include physical security expectations. For Spanish healthcare, the Real Decreto 1277/2003 sobre las condiciones técnicas de los centros sanitarios includes physical security expectations. For Brazilian healthcare, the ANVISA RDC 50/2002 on healthcare facility design + LGPD Art. 11 (dados sensíveis de saúde) include physical access dimensions. The form's access-level field handles the healthcare-specific zones — patient care areas, surgical suite, pharmacy (often the highest-restriction zone with DEA-tracked controlled substances in US, ANVISA-tracked in Brazil), medical records storage, restricted physician/staff areas, after-hours emergency access. Pairs with healthcare-focused access control platforms — Genetec Healthcare, Lenel S2 Healthcare, Salto Healthcare (particularly strong in EU healthcare), Inner Range Integriti Healthcare, plus the integration with the healthcare-specific systems (EMR access tied to physical zone entry, controlled substance dispensing tied to badge-and-PIN dual-factor).

  • Manufacturing and warehouse with operational security zones

    Manufacturing facilities and warehouses with multiple security zones — production floor, finished-goods warehouse, raw-materials storage, secure inventory cages, maintenance bay, executive areas. The form's specific-areas-needed field captures the granular access mapped to the operational zones. For US manufacturing subject to OSHA workplace safety + DoD CMMC if defense contractor + ITAR if export-controlled technology, the physical access controls extend to the work product. For Spanish manufacturing under NR/PRL framework (Ley 31/1995) and Brazilian manufacturing under NR-12 (Segurança no Trabalho em Máquinas e Equipamentos) + NR-22 (mining) + NR-33 (confined spaces), the physical access has occupational safety implications. Pairs with industrial-focused access control — Genetec Industrial, AEOS Industrial (Nedap, strong in European manufacturing), Inner Range Integriti, Lenel S2 with industrial integrations. For Brazilian manufacturing, integration with the eSocial S-2240 (Condições Ambientais do Trabalho) event when access has occupational health implications.

  • Data centers and high-security facilities

    Data centers (colocation facilities, cloud provider regions, enterprise data centers) and high-security facilities with the strictest physical access controls. Tier III/IV data center certification under Uptime Institute requires specific physical security controls. SOC 2 Type II + ISO 27001 + PCI-DSS Req 9 + FedRAMP Moderate/High + HIPAA all converge on the physical access requirements. The form's access-level field captures the dual-factor authentication requirements typical of data centers (badge + PIN; badge + biometric — fingerprint, iris, hand geometry, facial recognition), the mantrap-and-airlock entry protocols, the photo-verification at security desk before badge issuance. For modern data centers, the access control integrates with the DCIM (Data Center Infrastructure Management) platforms — Sunbird DCIM, Schneider EcoStruxure, Vertiv Trellis, Cormant-CS, plus the access control platforms (Genetec, Lenel S2, HID Mercury commonly used at this tier). For Brazilian data centers (Equinix Brasil, Ascenty, Odata, Embratel Data Centers), the LGPD physical safeguard requirements + ANATEL telecom requirements + BCB requirements for financial-sector colocation. For Spanish data centers (Equinix Spain, Interxion Madrid, Nabiax, Adam Data Centers), the LOPDGDD physical safeguard requirements + ENS (Esquema Nacional de Seguridad) for public sector customer workloads.

  • Mobile-credential modernization (smartphone replacing physical card)

    Companies modernizing from physical access cards to mobile credentials — smartphone-based badges that use NFC or Bluetooth Low Energy to authenticate at access control readers. The trend has accelerated significantly since 2020 with workplace transformation. The advantages: no physical card to lose or share; provisioning is faster (the credential delivers to the employee's phone immediately rather than waiting for the physical card production); the integration with mobile-device-management platforms (Microsoft Intune, Jamf, Workspace ONE, Kandji) provides additional security; the cost-of-card-production is eliminated (physical cards are typically $5-10 each + the ongoing replacement costs from loss). The major mobile-credential providers: HID Mobile Access (the dominant provider with broad reader compatibility), Brivo Mobile Pass, Kisi Mobile, Genetec Mobile Credentials, Salto KS Mobile, OpenPath/Avigilon Alta (Motorola-owned, modern UX), Verkada Pass (modern integrated platform). The form's onboarding workflow can issue both physical and mobile credentials based on the employee preference and the policy. The hybrid pattern is the dominant 2024-2026 approach — most companies issue both physical and mobile credentials with the mobile as the primary day-to-day credential and the physical as the backup.

Tailor it to your physical security program

Every physical security program has its own design decisions. Configure the reason options to match your typical scenarios — New Employee / Lost Card / Damaged Card / Additional Access / Replacement are the standard five; some companies add Contractor / Temporary Worker / Vendor / Visitor / Returning Employee as additional categories. Configure the access level tiers to match your actual access groups — Standard (office hours), Extended (24/7 building access), Full (24/7 + restricted areas), Custom (catch-all) is the standard four-tier; some companies use more granular tiers with the specific role-to-access mapping. Configure the specific-areas options as a dropdown of your actual access zones rather than free-text — this reduces the ambiguity and improves the audit-trail quality. Configure the approval routing based on the access level — Standard typically requires only manager approval; Extended requires manager + facilities/security approval; Full and Custom require manager + security director + (for highest-restriction areas) executive approval. Configure the HRIS integration as the source of truth for active-employee status — Workday, BambooHR, Personio, Factorial, Holded, Convenia, Sólides, Senior Sistemas, TOTVS RH — so the access control system automatically deprovisions on termination. Configure the photo-capture workflow for the new-employee badge issuance — typically integrated with the badging station at the office or with a self-service mobile photo capture for hybrid/remote employees with on-demand visits. Configure the badge-format options — physical card (typically ISO/IEC 14443 RFID at 13.56 MHz for HID iCLASS, MIFARE; legacy 125 kHz for older readers like HID Prox), mobile credential (NFC or BLE), biometric (fingerprint, facial recognition with LGPD/LOPDGDD compliance considerations for biometric data processing under GDPR Art. 9). Integrate with the access control platform — Kisi (cloud-native SMB/mid-market), Brivo (enterprise SMB), Genetec (large enterprise/unified security), Salto (EU-strong), HID Mercury (infrastructure), Lenel S2 (Carrier-owned enterprise/federal), Honeywell Pro-Watch, Bosch Access Control, AEOS (Nedap EU-strong), Inner Range Integriti (Australian/UK), Avigilon Access Control (Motorola), Schlage Access (Allegion), Identiv, OpenPath/Avigilon Alta. Integrate with the visitor-management platform — Envoy, Proxyclick, The Receptionist, SwipedOn, Eptura Visit, Sine (EMEA), Pacifica Visit (Brazilian) — for the visitor-vs-employee distinction at entry. For mobile credentials, integrate with HID Mobile Access, Brivo Mobile Pass, Kisi Mobile, Genetec Mobile, Salto KS Mobile, OpenPath/Avigilon Alta, Verkada Pass. For biometric processing, configure the LGPD/LOPDGDD/GDPR-compliant data processing with the explicit employee consent and the data-minimization principle (typically the biometric template is stored, not the raw biometric data).

Key card request FAQs

Deprovisioning speed is one of the most-tested controls in SOC 2 Type II and ISO 27001 audits. The general expectation: physical access deprovisioning within 24 hours of termination effective date; for voluntary terminations with notice, deprovisioning at the end of the last workday; for involuntary terminations, deprovisioning effective immediately at the termination meeting. SOC 2 CC6.4 specifically tests that 'access for employees and contractors is removed when no longer required' with the audit expectation of timely removal. ISO 27001 Annex A.7.2 and A.7.5 (the 2022 version reorganized A.7) include similar requirements with the documented procedure expectation. PCI-DSS Requirement 9.4 explicitly requires that access rights are removed when no longer needed and that physical media/devices are recovered. The mechanism: the HRIS integration with the access control platform triggers the automatic deprovisioning when the employee's status changes to Terminated in the HRIS — Workday + Kisi, BambooHR + Brivo, Rippling + Kisi (Rippling has native physical-access support via Rippling IT), Personio + Brivo are common integrations. The audit trail captures the HRIS termination timestamp, the access control deprovisioning timestamp, and the time delta between them. Most auditors expect under 24 hours; many companies target under 4 hours with the automated integration. For high-risk terminations (security-cleared roles, executives with broad access, employees with access to sensitive areas like server rooms or research labs), the deprovisioning is sometimes faster with the manual override. For SOC 2 controls audited annually, the time-to-deprovision is reported with statistical sampling; for HIPAA-covered entities, the OCR enforcement has cited multiple cases where deprovisioning failures led to breach incidents and fines.
The four-tier access level model is the standard pattern for most organizations because it balances simplicity with sufficient granularity. Standard (office hours only): typically Monday-Friday 7 AM to 7 PM with the main building entrance, restrooms, common areas, and the employee's specific floor/team neighborhood; covers about 70-80 % of employees in a typical office. Extended (24/7 building access): same physical access as Standard but extended to 24/7 with the after-hours and weekend access; typically for senior employees, individual contributors with on-call rotation, employees in different time zones who occasionally need after-hours access; covers about 15-20 % of employees. Full (24/7 + restricted areas): includes Extended + access to specific restricted areas like server rooms, executive suites, finance/HR sensitive areas, secure storage; covers about 5-10 % of employees including IT, security, executives, finance, HR business partners. Custom (catch-all for non-standard patterns): for cases where the standard tiers don't fit — contractors with specific project access, visiting executives, regulatory-required access for compliance roles, lab access for research roles, controlled substance access for healthcare roles. The form's structured intake handles the four-tier model with the manager-approval requirement increasing with the tier (Standard: manager only; Extended: manager + facilities; Full: manager + security director; Custom: manager + security director + relevant area owner). For SOC 2 controls auditing the segregation of duties, the access tiering documents the role-to-access mapping that auditors test.
Mobile credentials (smartphone-based badges) have been the dominant trend in access control since 2020, accelerated by hybrid work patterns. The adoption considerations: (1) Cost — mobile credentials are typically $1-3 per credential per year (subscription model) vs. $5-10 per physical card plus the replacement-on-loss cost (average loss rate is 5-10 % per year); for organizations with 500+ employees, the mobile credential cost is typically lower over 3-year analysis; (2) Provisioning speed — mobile credentials deliver instantly to the employee's phone via the credential app vs. 1-2 days for physical card production and shipping; (3) Security — mobile credentials have stronger cryptographic protection than legacy 125 kHz prox cards (which are easily cloneable with widely available hardware) and at least equivalent to modern 13.56 MHz HID iCLASS or MIFARE DESFire cards; mobile credentials also have the device-binding security (the credential is tied to the specific device with the certificate-based authentication); (4) User experience — mobile credentials are 'always with you' since employees rarely forget their phone, unlike physical cards which are routinely forgotten; the tap-to-enter UX is the same; (5) Compatibility — modern access control platforms support both physical and mobile credentials with the same reader hardware; the transition is gradual rather than a forklift upgrade; (6) Edge cases — visitor management still typically uses physical visitor badges (visitors are typically not enrolled in the mobile credential system for the brief visit duration); some employees may prefer physical cards for privacy or for the work-life separation. The hybrid pattern is dominant 2024-2026 — most companies issue both physical and mobile credentials with the mobile as the primary day-to-day credential and the physical as the backup. Major mobile credential providers: HID Mobile Access (dominant provider with broad reader compatibility), Brivo Mobile Pass, Kisi Mobile, Genetec Mobile Credentials, Salto KS Mobile, OpenPath/Avigilon Alta (Motorola), Verkada Pass.
Contractor, visitor, and temporary-worker access has distinct considerations from employee access. (1) Contractors (typically 1099 in US, autonomous workers / freelance / autónomos in Spain, PJ / pessoa jurídica in Brazil) need access for the duration of their engagement with the specific scope; the form should have a contractor-specific track with the engagement-end-date enforcement that automatically deprovisions on the scheduled end date. (2) Temporary workers (often through staffing agencies) need access similar to contractors but typically with shorter durations and through the staffing agency's compliance framework; the access provisioning should align with the staffing agency's own background-check and security requirements. (3) Visitors (one-time or short-duration visits) need access typically managed through the visitor management system rather than the key-card workflow — the visitor receives a day-pass badge from the front desk rather than an enrolled credential; the integration with the visitor management platform (Envoy, Proxyclick, The Receptionist, SwipedOn, Eptura Visit, Sine for EMEA, Pacifica Visit for Brazil) handles this. (4) Vendors (utility workers, cleaning services, delivery personnel) may need recurring access; depending on the vendor type, they may be enrolled as ongoing contractors or managed through the vendor management framework with the building manager. The form's reason field captures the worker classification (New Employee / Contractor / Temporary / Vendor / Visitor) which drives the appropriate downstream workflow. For SOC 2 audits, the segregation of access between employees, contractors, and visitors is one of the tested controls; the structured intake produces the documentation. For Spanish companies, the contractor access has implications under the convenio colectivo and the empresa principal-contratista relationship; for Brazilian companies, the contractor access has implications under CLT versus PJ classification and the responsabilidade solidária of the empresa contratante.
On submission, the workflow creates the access provisioning request in the access control platform with the structured data attached. For Kisi (the modern cloud-native platform popular with SMB and mid-market), the request creates the badge provisioning task with the access group assignment and the mobile credential issuance if applicable. For Brivo (enterprise SMB with strong compliance features), similar workflow with the additional compliance reporting features. For Genetec (large enterprise/government with strong unified security platform combining access control, video surveillance, intrusion detection, ALPR), the request flows into the unified security workflow with the cross-system correlation. For Salto (European-strong, particularly hospitality and healthcare), the workflow integrates with the Salto KS cloud-managed or the Salto Pro on-premise system depending on the deployment. For HID Mercury (the access control infrastructure layer used by many integrators), the request flows to the system integrator's management software. For Lenel S2 (Carrier-owned, enterprise/federal), Honeywell Pro-Watch (Honeywell-owned), Bosch Access Control, AEOS (Nedap EU-strong), Inner Range Integriti (Australian/UK-built), Avigilon Access Control (Motorola), Schlage Access (Allegion), Identiv, OpenPath/Avigilon Alta — equivalent integrations with the platform's API. For the HRIS integration (the most critical integration for compliance), the active-employee status flows from Workday, BambooHR, Personio Spain, Factorial HR, Holded, Cezanne HR Spain, Bizneo for Spain; Convenia, Sólides, Senior Sistemas, TOTVS RH for Brazil; ADP Workforce Now, Rippling, Gusto, BambooHR for US — so the access auto-deprovisions on termination. For mobile credentials, integration with HID Mobile Access, Brivo Mobile Pass, Kisi Mobile, Genetec Mobile, Salto KS Mobile, OpenPath/Avigilon Alta, Verkada Pass for the smartphone-based credential. For visitor management, integration with Envoy, Proxyclick, The Receptionist, SwipedOn, Eptura Visit, Sine (EMEA), Pacifica Visit (Brazilian) for the visitor-vs-employee distinction at entry. The audit trail captures the full lifecycle — request, approval, provisioning, access activity (entries/exits), revocation on termination, with the timestamped documentation that SOC 2, ISO 27001, PCI-DSS, HIPAA auditors and the Spanish/Brazilian regulatory equivalents all test.

Related templates

Client Onboarding Questionnaire Template

Replace scattered intake calls and email threads with a structured client onboarding questionnaire — captures business details (W-9/EIN, CNPJ, CIF)

View template

Expense Report Form Template

Capture business expenses with line-item detail, receipt uploads, project allocation, and manager approval — built for IRS Publication 463 accountable-plan

View template

Project Proposal Form Template

Capture project proposals with the PMBOK Project Charter skeleton — business case, scope, milestones, capex vs opex breakdown, stakeholder RACI, risk register

View template

Ready to build forms that work for you?

Create your first form in minutes. Your submissions will thank you.

Be first in lineLimited early accessSet up in 2 minutes