High-Security Locks: Standards, Key Control, and What the Ratings Mean

What Counts as a "Cylinder"

A156.30 defines the cylinder broadly. The term covers mechanical lock cylinders, electromechanical cylinders, and the electronic subassemblies that do the same job. A cylinder includes its keys or electronic credentials, its detainers (the standard names mechanical pins, levers, and discs) or its electronic control device, and its tailpiece, cam, or electronic output. So a high-security rating can apply to a keyed cylinder or to an electronic credential system.

The Three Things A156.30 Evaluates

A156.30 groups its requirements into three categories.

Key control. In the standard's words, this feature is meant to provide security "by limiting the availability of unauthorized keys or unauthorized electronic credentials that would operate the locks." The requirements cover:

• whether key blanks or credentials can be bought from a second source
• whether blanks or encoding formats are protected by law
• whether factory-cut keys or factory-programmed credentials are only supplied after authorization
• cylinder marking restrictions
• for electronic products, audit trail and time zoning

An audit trail is a retrievable, recorded history of the valid keys used in the cylinder.

Destructive tests. BHMA's 2025 Hardware Highlight lists a cylinder plug static pull test, a plug impact pull test, a torque test, and a drill resistance test. After testing, the cylinder's driving element must not turn without the correct key.

Surreptitious entry resistance. This category sets:

• a minimum number of key changes
• limits on mechanical key-biting steps
• mechanical pick resistance, measured through decoding or picking
• electrical pick resistance, tested with overvoltage, electrostatic discharge, magnets, or conductive liquids
• a mechanical security tolerance test of up to 100,000 cycles

These are names of tests only. This encyclopedia does not describe attack methods.

Levels A, B, and C

Each category is rated in three letter levels: A, B, and C. A cylinder can only claim a level for a category if every feature in that category reaches that level.

Which letter is the highest level is a live question in the sources. The 2014 standard text builds each level on the one before it, from C through B to A. BHMA's 2025 Hardware Highlight calls "C" the highest. Until the 2025 standard text settles it, this article does not rank the letters. When you compare products, read the manufacturer's listing and the current standard itself, not the letter alone. See ANSI/BHMA lock grades.

Levels Are Not Grades

A156.30 keeps security levels separate from durability grades. Levels show special security features. Grades come from the BHMA product standards. Two rules in the standard matter when you specify hardware:

• A lockset fitted with a cylinder that has no grade listing is treated as ungraded, even if the cylinder has a high-security level.
• An assembly takes the grade of its lowest graded component.

Electrified products also have to meet A156.25 to get a grade listing.

For a sense of grade scale, ANSI/BHMA A156.36 sets the Grade 1 deadbolt figure at 250,000 cycles, and ANSI/BHMA A156.2-2022 sets the Grade 1 bored lock figure at 1,000,000 cycles. Neither number says anything about attack resistance. See cylindrical locks.

Where UL 437 Fits

UL 437 covers key locks: door locks, locking cylinders, cabinet locking cylinders, security container key locks, and two-key locks. Published summaries describe its two groups of tests:

• covert entry, such as picking and impressioning
• forced entry, such as drilling, sawing, prying, and pulling

Both run on timed lab samples. A156.30 lists UL 437-2013 among its referenced standards. The cylinder standard A156.5-2014 points readers who need higher pick resistance to UL 437 or A156.30.

The two listings measure different things. A DEF CON 15 presentation by lock researchers Marc Weber Tobias and Matt Fiddler noted that UL 437 has "no key control criteria." A156.30 does cover key control. See UL 437.

A156.30 also states plainly that its tests "are performed under laboratory conditions" and that in real use "results vary because of installation, maintenance and environmental conditions."

Mechanism Examples

Manufacturers get to a high-security listing in different ways. Two examples from manufacturer documents:

• Rotating pins with a sidebar. Medeco's catalog describes its M4 cylinders as UL 437 listed. In addition to pin tumblers "that lift and rotate," the design adds side pins and a movable key element. All of them must line up with a sidebar before the key can turn. The catalog also mentions hardened-steel inserts placed to resist drilling.
• Rotating detainer discs. ABLOY says its locks are built on rotating detainer discs, with "no springs or pins to wear, jam or freeze." See disc detainer locks.

These are illustrations, not a ranking. Other platforms reach their listings with other designs. A rating comes from testing, not from the mechanism type.

Key Control in Practice

A pick-resistant cylinder protects little if anyone can copy its key. Key control is why many high-security systems pair the mechanism with:

• restricted keyways, where blanks come only through the manufacturer or authorized dealers, sometimes backed by patents
• authorization steps before a key is cut

A156.30 also defines visual key control: marking all keys, and the visible face of every cylinder, with standard keying symbols. For managing who holds keys across a building, see key control and master keying.

European Grading

In Europe, cylinders for building locks, including the euro-profile cylinder, are classified under EN 1303 (published in the UK as BS EN 1303). The current edition is EN 1303:2026, which supersedes the 2015 edition. BSI lists BS EN 1303:2026 as current and BS EN 1303:2015 as withdrawn.

EN 1303 writes its classification as an eight-digit code. Its 2026 scope sets six grades of key-related security based on design requirements and five grades based on performance tests that simulate attack. The 2026 edition also brought cylinders for master key systems into scope and changed the meaning of the third digit from door mass to mechanical coding. A code printed on a cylinder tested to the 2015 edition should therefore be read against that edition.

EN 1303 grades do not translate directly into A156.30 levels or UL 437 listings. See EN 1303.

The Rest of the Opening

BHMA's A156.5 carries a blunt reminder: "No lock can provide complete security by itself." A high-security cylinder can still be defeated by forcible or technical means, or simply bypassed through another way into the property.

ASTM F476, the test method for the security of swinging door assemblies, treats the door assembly as including "the hinge, lock, door, strike, and jamb." A strong cylinder in a weak frame, with a short strike plate screw or exposed hinges, is still a weak opening. For more on the cylinder formats that usually carry these listings, see rim and mortise cylinders.

Related Topics

• ANSI/BHMA lock grades: grades and A156.30 levels
• UL 437: the key-lock listing
• Restricted keyways: key control by design and patent
• Key control: managing who holds keys
• Master keying: system design trade-offs
• Sidebar locks: the sidebar principle
• Disc detainer locks: rotating-disc mechanisms
• Security pins: manipulation-resistant pins
• Rim and mortise cylinders: common listed formats
• Euro cylinders: the format most often classified under EN 1303
• EN 1303: the European cylinder standard, 2026 edition
• Strike plates: the other half of the opening

Sources