Facility operating playbook ·
When a Lock Is Missing: A Preserve-and-Escalate Playbook for Self-Storage Managers
A practical response for a missing lock or suspected unit tampering that preserves observations, access records, customer communication and release authority without inventing a conclusion.
A customer arrives at a unit and says the lock is gone. The latch has fresh marks. The door is closed, but nobody can say whether it was opened, whether the customer removed the lock, or whether an employee changed anything.
That is enough to start a controlled response. It is not enough to announce a break-in.
The manager’s first useful move is to separate what was reported from what was observed. A missing lock, a bent hasp, an unexpected overlock, a door sitting differently, or a customer’s concern can each be recorded as a condition. None establishes who acted, when it happened, what entered or left the unit, or whether a crime occurred.
The operating goal is narrower and more practical: protect people, keep the unit and nearby area from changing unnecessarily, preserve time-sensitive records, notify the right owners, and release the unit only when the authority for the next action is clear.
Governed companion package
Use the Missing-Lock Incident Record and inspect its evidence boundaries.
The 42-column record contains one guidance row and one explicitly fictional Lakeview Row teaching row. Use it to keep reports, observations, safety state, access restrictions, preserved physical and digital sources, customer communication, authority direction, repair, release and correction separate. It does not establish theft, forced entry, a suspect, loss, liability, an insurance outcome, product capability, facility deployment, customer result, certification or industry standard.
Start with danger, not paperwork
If someone may still be on the property, a confrontation is developing, a weapon is reported, or another immediate threat exists, move people away and use the emergency route in the site plan. The U.S. Department of Homeland Security directs people to call 911 for emergencies and to report suspicious activity to local police.1 The manager should not approach a person, enter a unit, pursue a vehicle, or turn a property check into an investigation.
When the event is not active and no immediate danger is apparent, the response can move to the nonemergency path defined by company policy and local authorities. That distinction belongs in the record. “No immediate threat observed” is not the same as “safe,” and “customer reports theft” is not the same as “theft confirmed.”
Use a short opening statement with staff: “Unit C-214 is restricted. Do not touch the door, lock hardware, nearby items, or related records. Route questions to the incident owner.” One instruction is easier to follow than a discussion about what probably happened.
Hold four states apart
Incidents become harder to manage when several different states are collapsed into one label. Keep these four apart:
- Reported: what a customer, employee, vendor, alarm or other source said.
- Observed: what an authorized person directly saw from a safe and permitted position.
- Established: what a qualified authority later determined from the available evidence.
- Released: what the facility owner has authorized people or systems to do next.
A customer may report that property is missing. A manager may observe that no lock is attached. Law enforcement may establish whether the scene will be processed. The operating owner may later release the unit for customer access, authorized repair or another bounded action. Those decisions can occur at different times and should not overwrite one another.
This protects the customer as much as the business. It prevents a tentative observation from becoming an accusation, keeps employees from speculating, and gives every later reviewer the same starting record.
Protect the unit without manufacturing a scene
Place the narrowest practical boundary around the affected unit and any nearby area that could be disturbed. The boundary may be a temporary access restriction, an employee instruction, a physical stand-off point, or a combination defined by site policy. Avoid blocking emergency exits or creating a new trip or vehicle hazard.
Do not open the unit to “see what is missing.” Do not test the latch repeatedly, wipe a surface, move a cut lock, sweep the corridor, replace hardware, or invite several employees to inspect. If an item must be moved for immediate safety, record the reason, the person, the original position, the action and the time.
The Office of Justice Programs’ crime-scene guide is written for law enforcement, not self-storage staff. Its sequence—from securing a scene through documentation and evidence submission—still illustrates why uncontrolled movement can damage later fact-finding.2 The operator lesson is limited: preserve the condition and defer evidence collection to the authority responsible for it. A facility manager does not become an evidence technician.
Write what the first observer actually saw
The first record should be plain enough for another manager to understand without interpretation. Include:
- exact facility and unit identifiers;
- when the report was received and when the condition was observed;
- where the observer stood;
- visible lock, latch, door and nearby conditions;
- the source of each statement;
- who established the access boundary; and
- what remains unknown.
Replace “door forced open” with an observation such as “fresh scrape visible on the latch plate; no lock attached; door remained closed during observation.” Replace “tenant’s items were stolen” with “customer reported two items missing; unit contents were not inventoried by staff.”
Photos should follow the site’s policy and the direction of the incident owner. If they are permitted, use a current device, preserve the original file, note who captured it and avoid editing or adding explanatory markings to the original. Photographing a condition does not establish cause, ownership or loss.
NIST describes evidence management as preserving items against compromise, contamination or degradation while tracking custody.3 That is a forensic-system standard, not a direction for a manager to collect physical evidence. It supports a simpler operational rule: if an item, file or record may matter, do not pass it around informally. Name the owner, preserve the original state where possible and record every authorized handoff.
Preserve digital records before retention windows move
The physical condition is only part of the timeline. A self-storage facility may also have gate events, employee access records, work-order history, lock-cut authorization, overlock activity, camera recordings, alarm events, call logs and customer communications.
Start by identifying the relevant time window, not by exporting everything. The window may need to begin before the customer’s last known access and extend through discovery, but its exact bounds should be set by policy or the incident owner. Record the system, timezone, device or account, export time, export owner and file reference. If a system has a short retention period, escalate that fact immediately.
CISA explains that useful logs show who accessed what, when and from where, and recommends protecting logs from unauthorized access or deletion.4 Preserve the native export or provider-generated record when available. A screenshot can help explain what an employee saw, but it should not silently replace the underlying source.
Do not reset credentials, delete user records, rename devices, overwrite camera media or “clean up” a work order until the authorized owner decides what must be retained. A corrective action can be necessary and still wait long enough for the original state to be captured.
Keep customer communication factual and private
The customer needs a direct point of contact, the current access state and the next expected update. The customer does not need staff theories, another customer’s information, an unverified suspect description or a promise about insurance, liability, recovery or timing.
A useful first message is bounded: “We recorded your report concerning unit C-214. Access to the unit is temporarily restricted while the incident owner coordinates the next steps. Morgan Lee is the contact for updates and will respond by 3 p.m.” Adapt the wording to the company’s policy and actual facts.
Collect only information needed for the response. Do not copy full access credentials, payment data, identification documents, an inventory of valuables or unrelated customer records into a general incident note. The NIST Privacy Framework is designed to help organizations manage privacy risk while building products and services.5 In this workflow, the practical application is role-based access, purpose-limited fields and a retention owner—not a claim of privacy compliance.
Let authority control repair and re-entry
Three decisions often compete after the first response:
- whether the customer may enter;
- whether hardware may be repaired or replaced; and
- whether a law-enforcement or insurer process requires the condition to remain unchanged.
Do not let the fastest available vendor decide all three. The incident owner should record the direction received, its source, its scope and the time. A police report number proves that a report exists; it does not by itself authorize entry or establish a loss. A completed repair proves that named work was performed; it does not close the customer claim or establish what happened.
Release should be specific. “Unit C-214 released to the named customer for accompanied access at 4:20 p.m.; latch replacement remains pending” is useful. “Issue resolved” is not. If a temporary lock or access restriction is applied, record who authorized it, who controls the key or credential, which system reflects the restriction and what evidence will remove it.
A fictional missing-lock report
Consider Lakeview Row Storage, an entirely fictional teaching facility. At 9:12 a.m., a customer reports that the lock is missing from unit C-214. The manager observes from the corridor that no lock is attached and that the latch plate has visible scrapes. The door remains closed. Nobody on staff knows when the condition changed.
The manager restricts access to the unit, keeps the corridor open, and records the report separately from the observation. The company incident owner chooses a preservation window beginning with the customer’s prior recorded gate entry. Gate events, a lock-cut work-order query and available camera recordings are preserved with source, timezone and export details. No employee opens the unit or handles the loose metal item found nearby.
Local law enforcement gives the fictional incident owner a nonemergency report reference and direction about the scene. The customer receives a factual update and one contact. Later, law enforcement releases the door condition. The operating owner authorizes accompanied customer access but keeps the latch repair as a separate open action. Final reconciliation records the customer-access decision, repair ownership, preserved source files and one unresolved question about the time of change.
Every facility, person, unit, time, condition, system record, authority and outcome in this example is fictional. It is not a customer case, crime report, service result or statement about modSTORAGE.
Make the next response easier
The accompanying Missing-Lock Incident Record gives the next shift one place to capture the report, direct observation, safety state, access boundary, physical and digital preservation, customer communication, authority direction, repair decision, release and corrections.
Review the blank record with the team. Confirm who can restrict a unit, who can preserve video and access logs, who speaks with the customer, who contacts law enforcement, who authorizes repair, and who releases the unit. Verify how long each relevant system retains records.
The standard is not certainty in the first five minutes. It is disciplined uncertainty: protect people, preserve the condition, record the sources and let the right authority establish the next state.
Sources
- U.S. Department of Homeland Security, Report Incidents, current official reporting guidance; accessed September 14, 2026. ↩
- Office of Justice Programs, Crime Scene Investigation: A Guide for Law Enforcement, official publication record and scope; accessed September 14, 2026. ↩
- National Institute of Standards and Technology, Evidence Management, official evidence-management overview; accessed September 14, 2026. ↩
- Cybersecurity and Infrastructure Security Agency, Use Logging on Business Systems, current official small-business guidance; accessed September 14, 2026. ↩
- National Institute of Standards and Technology, Privacy Framework, current official framework overview; accessed September 14, 2026. ↩