UL 437: The Key Lock Standard Behind "High-Security" Cylinders

What UL 437 Covers

UL's standards catalog lists the scope of UL 437 (Key Locks) as five categories of product:

• Cabinet locking cylinders
• Door locks
• Locking cylinders
• Security container key locks, Type 1 and Type 2
• Two-key locks

The current document is Edition 8. UL's catalog gives its publication date as May 15, 2013, with the latest revision dated January 31, 2023. That 2023 revision updated the title page to show the standard's reaffirmation as an American National Standard, and UL notes that "no technical changes have been made." When BHMA standards refer to it, they cite it as UL 437-2013.

What the Tests Look For

UL 437 divides attacks into two broad groups. Lock-security researchers Marc Weber Tobias and Matt Fiddler, in a 2007 DEF CON presentation, summarized them as covert entry (picking and impressioning) and forced entry (forcing, drilling, sawing, prying, pulling, and driving or punching). Their slides quote the standard's core requirement: a product "shall not open or be compromised" when the listed tools and methods are applied for the specified time.

For door locks and locking cylinders, two independent secondary summaries (the Tobias and Fiddler presentation and the Lockwiki entry on UL 437) give the same attack-resistance times. The Tobias summary predates the 2013 edition, so treat the table as a published summary rather than the current text:

Those times are net working time on the sample under laboratory conditions. They are not a prediction of how long any lock will hold out against a real attack. Security container key locks and two-key locks have their own, different time tables. Readers who need the exact current wording should consult the standard itself, which UL sells through its standards catalog.

The same summaries describe the tool kit in general terms: common hand tools, portable electric drills, saw blades, pullers, and picking tools. For door locks, pry bars are also included. This article does not go into attack methods beyond the names of the tests.

How UL 437 Relates to BHMA Cylinder Standards

UL 437 is referenced by name in the BHMA cylinder standards.

ANSI/BHMA A156.5 covers cylinders and input devices for locks. The 2014 edition (the text we read) says that for "applications where pick resistance and other higher security protections are required," readers should "consider locks meeting UL 437-2013 Key Locks, or ANSI/BHMA A156.30-2010 for High Security Cylinders." It also defines a Cylinder Drilling and Picking Test: cylinders that meet "all the drilling and picking requirements of UL 437-2013" are designated with an "A" suffix and must also meet Grade 1 of A156.5. Cylinders already listed to UL 437 "do not need to be retested for drill and pick resistance."

ANSI/BHMA A156.30 is BHMA's standard for high-security cylinders (current edition 2025). It lists UL 437-2013 among its referenced standards. The 2007 Tobias and Fiddler summary of A156.30 notes that one of its pick-resistance levels requires meeting UL 437 for pick resistance (10 minutes). A156.30 adds requirements that UL 437 does not address, including key blank and credential control, cylinder marking restrictions, and, for electronic products, audit trail and time-zoning capability.

A156.30 rates cylinders in three letter levels (A, B, and C) in each category. The ranking of those letters is described differently in the sources we read, so this article does not say which letter is highest. See ANSI/BHMA lock grades.

What UL 437 Does Not Cover

• Key control. The Tobias and Fiddler presentation states plainly that UL 437 has "no key control criteria." Protection against unauthorized key duplication comes from restricted keyways, patents, and the key-control provisions in A156.30. See restricted keyways and key control.
• The whole door. The standard tests the lock or cylinder. Frame strength, the strike plate, hinges, and the door itself are separate. A listed cylinder in a weak opening is still a weak opening.
• Cycle grades. UL 437 is not a cycle-durability grade. Lock durability grades come from the BHMA product standards. For example, ANSI/BHMA A156.36 sets the Grade 1 deadbolt figure at 250,000 cycles, and ANSI/BHMA A156.2-2022 sets the Grade 1 bored lock figure at 1,000,000 cycles. See deadbolts and cylindrical locks.
• Euro-profile cylinders sold to European standards. Those are usually graded under EN 1303 and related European documents, not UL 437. See euro cylinders.

BHMA's own standard carries the reminder that "no lock can provide complete security by itself."

Reading a UL 437 Claim

UL's certificates name the specific models covered and point readers to the UL Online Certifications Directory. A useful habit when reading a product claim:

• Check which models and configurations the listing covers. A listing may apply to a particular cylinder, not every lock that can accept it.
• Look for the UL Listing Mark on the product, as UL's certificates advise.
• Treat "meets UL 437" or "UL 437 tested" in marketing copy as something to confirm in the directory.

Related Topics

• High-security locks: the broader category
• ANSI/BHMA lock grades: A156 grades and A156.30 levels
• Restricted keyways: key control by design and patent
• Key control: managing who holds keys
• Rim and mortise cylinders: the cylinder formats often listed
• Euro cylinders: European cylinder formats
• Medeco: rotating-pin high-security cylinders
• EN 1303: European cylinder classification
• Padlocks
• Disc detainer locks

Sources