Comparing smart lock quality & security? Look for these standards

We regularly review the latest smart locks–deadbolts, most often–reporting our impression on their design, installation process, daily use, their related mobile app, and more. What we can’t tell you is how well the lock will withstand years of exposure to the elements, how many open/close cycles it should deliver before it fails, or how difficult it will be for an intruder to defeat it—either by lockpick or brute force.

To answer those thorny questions, we consult the ANSI and BHMA standards bodies, both of which provide ratings about the long-term physical capabilities of a lock. But what do those ratings mean, and why doesn’t every lock manufacturer use them?

Let’s dig deeper.

Understanding ANSI ratings

ANSI, the American National Standards Institute, is a nonprofit organization that dates to 1918(!). It represents hundreds of thousands of companies and manages standards for a vast array of products, ranging from the size of a piece of paper to the way nuclear power plants should be cooled.

This story is part of TechHive’s in-depth coverage of the best smart locks.

ANSI ratings for locks place them into one of three categories: 1, 2, or 3. These are seemingly broad buckets where 1 is highest and 3 is lowest. According to ANSI:

• ANSI grade 1 locks are top-of-the-line products that (for deadbolts) must withstand 250,000 open/close cycles and 10 blows with a hammer delivering 75 foot-pounds of force.
• ANSI grade 2 locks are midgrade locks that can handle 150,000 cycles and 5 hammer blows.
• ANSI grade 3 locks are entry-level locks that must handle 100,000 cycles and 2 hammer blows.

Those are fairly simplistic gradations; they might even sound vague. There’s a reason for that: ANSI doesn’t test locks—or anything, for that matter. Rather, it oversees standards that are developed by third-party groups and signs off on whether those standards are up to snuff. A vast number of partners with much more specialized expertise are responsible for managing the testing protocols for products. In the case of locks, the three ANSI grades are derived not from ANSI’s tests but from tests that an industry group called BHMA (Builders Hardware Manufacturers Association) oversees.

Understanding BHMA ratings

BHMA

BHMA has developed standards to cover more than 40 categories of building materials products, including “locks, closers, exit devices, butts, hinges, power-operated doors, and access control products.” Its job is primarily to serve builders by guiding them to the suitability of various building products for specific types of construction.

BHMA director of standards Anthony Gambrall says BHMA has traditionally served the commercial building community, but in 2015 it expanded into the residential space. Today, two separate sets of standards exist, one for commercial buildings and one for residential, which explains why locks can have an ANSI rating, a BHMA rating, or both. “The ANSI grades of 1, 2, and 3 are for commercial use,” he says, “and A, B, and C ratings are for residential use.”

While BHMA operates a blanket website at buildershardware.com, consumers are directed to a separate site to get more information on relevant certifications: securehome.org. While buildershardware.com covers a wide range of building products, the securehome.org site is exclusively focused on just two: locks and deadbolts. These are denoted as ANSI standards A156.39 (Residential Locksets and Latches) and A156.40 (Residential Deadbolts).

How ANSI and BHMA ratings are calculated

Michael Brown/Foundry

To receive a rating (either ANSI or BHMA), a manufacturer must submit their hardware to a BHMA-approved lab for analysis and, ultimately, a certification for the product. This is a strictly voluntary process, and manufacturers are directed to work with one of the two labs designated by BHMA—either UL (Underwriters Laboratory) or Intertek—to complete the certification process. The lab charges the manufacturer for testing, and BHMA charges the manufacturer for administrative costs related to managing the certification.

Lab testing involves numerous tests that fall into three categories:

• Key control: How readily available are blank keys for the lock? How difficult is it to create a new key?
• Destructive tests: How difficult is it to drill the lock or destroy it via various physical means?
• Surreptitious entry resistance tests: How difficult is it to pick the lock or otherwise bypass the lock’s security?

Once complete, the manufacturer receives a report and, assuming the product passes the lab tests, a BHMA Certified mark which it can use on branding, advertising, packaging, social media, and the like. BHMA Certified products must be periodically re-tested to maintain their certification. A sample BHMA certificate is pictured higher up this page.

Robert Strohmeyer/TechHive

A BHMA Certified mark includes letter grades for three categories: Security, Durability, and Finish. The grade levels work like in school: C is “good,” B is “better,” and A is “best.” One grade is issued for each category, below:

• Security measures both the ability of the lock to withstand impact either from physical damage or extreme weather (like exposure to flooding).
• Durability is a measure of the lock’s performance over time and how resistant it is to wear and tear. It also measures “how well a lock or deadbolt operates with excessive weight on the door—such as a hanging purse.”
• Finish is more cosmetic in nature, measuring how well the lock withstands long-term conditions due to exposure to the elements. It namely concerns the ability of the lock to maintain its appearance and avoid corrosion or discoloration.

There’s a bit of crossover in these categories, but most consumers should likely be most concerned with the Security rating.

BHMA certification is tough, and AAA certification is much less common than you might expect. Gambrall (and a perusal of some of the testing protocols) confirms that these tests are not trivial.

“Let’s say there are 15 tests in a category, and you meet the top level on 14 of them,” Gambrall said. “On one of the tests you earned a B grade. Well, your lock receives the lowest grade that comes out of these tests, so your lock gets a B.”

ANSI grades align roughly with BHMA grades, Gambrall said, but the ANSI grades are a little tougher, since they are designed for commercial use and BHMA grades are residential. An ANSI grade 2 is roughly equivalent to a BHMA security grade A, according to Gambrall, but it’s not apples to apples. Part of the confusion is because commercial builders all have very strict building codes they must follow, right down to door hardware.

Christopher Null / IDG

ANSI grades help companies building skyscrapers understand what kind of hinges they need to put on a fire door, for example. But a consumer purchasing a new lock at a home improvement store needs a different level of guidance, which is part of the reason why things like Finish ratings are included for residences but not for commercial buildings.

It’s critical to note that, today, BHMA ratings are strictly related to a smart lock’s physical components. They don’t measure anything related to the electronic operations of smart locks, including PIN security, fingerprint readers, or wireless features. Gambrall said all of that is in the works, but ANSI moves slowly. Watch for BHMA to begin including measurements of electronic security for residential locks within the next five years. (Conversely, some other ANSI ratings cover electronic components today.)

The difference between a lock that is “certified” and one that “meets standards”

As you explore the smart lock space, you will encounter manufacturers who say their locks are certified to ANSI or BHMA standards, while some use more vague language that say their products “meet the standards” of one or both of the organizations.

What this means is probably what you’re thinking: Locks that have been certified–and that carry legitimate ANSI or BHMA logos on their packaging–have undergone formal testing and received a stamp of approval from the respective organization. Locks that “meet standards” have only been tested internally by the manufacturer, and while the lock very well might offer solid security, no third-party testing agency has verified the manufacturer’s claims. Ultimately it’s up to you to determine how seriously to weigh a claim that a lock “meets standards.”

BHMA says that “meets standards” claims of certification are common and are in fact fraudulent, noting (through a spokesperson), “If we find language that states a product ‘meets standards,’ then it is considered misleading and we send them a letter asking them to certify the product.” BHMA says that misuse of its branding certification logos on products which have not in fact been certified are also commonplace, so it encourages consumers to check the BHMA Certified Products Directory to verify the legitimacy of such claims. Choose ANSI Standard A156.40–Residential Deadbolts from the dropdown menu to find the information relevant to this article.

The bottom line: Is your lock any good?

Because each grade is based on numerous tests and those details are not made public, there’s no easy calculus that determines why a lock got a B in one category instead of an A. You can, however, look up any lock to see if it is certified and what grades it received on each of the three categories at buildershardware.com/Certification-Program/Certified-Products-Directory.

Why don’t all locks get ratings? Part of it is related to the time and expense of the process, and part of it is a lack of recognition about the BHMA standards, Gambrall said. Consumer awareness is fairly low about BHMA certification, according to Gambrall, and that is probably hurting buyers.

“There’s a lot of stuff out there that doesn’t get tested, and it’s just awful,” he says, noting that a typical survey of the lock section of a big box hardware merchant will reveal that only about a third of locks on display carry BHMA certification. Off-brand or private label locks that carry bargain-basement prices, according to Gambrall, are prime examples of “you get what you pay for” and that they should be avoided.

So while we at TechHive will keep hammering away at fingerprint readers and mobile apps, we’ll leave it to the BHMA to tell you if someone can smash a lock off your door with a sledgehammer. “The biggest thing to take away from this story,” Gambrall says, “is that people just need to look for that little house.”