After a security audit last week, I advised a 22-door medical suite to move from ad hoc rekeys to a restricted keyway with SFIC on the perimeter. For small clients, where do you draw the line between a quick rekey and proposing a master plan that builds key control and audit-friendly hardware into the next 12 months? I’m trying to keep solutions tailored without overselling, and I’d love to hear what’s worked for you.