Physical security assessment: How to run one

Most physical security assessments are snapshots. A consultant walks the building, fills out a physical security checklist, hands over a report, and leaves. The report is accurate the day it is written. By the second month, contractors have been added to the access list, a camera has dropped offline, and a side door propped open for deliveries has become the easiest way in. The report still reads fine. But the building is no longer as secure as the report says.

A physical security assessment is a structured evaluation of how well a building's people, processes, and technology prevent, detect, and respond to security incidents. It is where a security program starts. A good physical security risk assessment maps your real risks, rates them, and gives you a prioritized plan to close the gaps. A physical security audit is the narrower, compliance-oriented version of the same exercise. It is a point-in-time check against a standard or a fixed checklist.

This guide gives facility managers, property managers, and security and IT directors a usable framework, a step-by-step process, a physical security checklist, and a straight answer on what to do after the report lands.

Physical security assessment vs. physical security audit

These two terms get used interchangeably, and in casual conversation they are close enough. There is a practical distinction everyone should know about.

A physical security assessment is broad and risk-oriented. It starts from a simple question, namely, what could go wrong in this building, and works outward from there. It looks at your people, processes, and technology together, asks how likely each threat is and what it would cost you, then ranks the findings by risk and hands you a prioritized plan to fix them. Because it is built around risk, and risk changes as tenants, access lists, and technology change, it is meant to be repeated on a cadence.

A physical security audit is narrower and compliance-oriented. Instead of asking what could go wrong, it asks whether you meet a defined requirement, then checks your current setup against a fixed standard, a regulation, or an insurance policy. The result is a pass-or-fail record at a single point in time, useful as proof that you met the requirement on the day it was checked.

The difference comes down to the question each one answers. An audit tells you whether you meet a standard today. An assessment tells you where your risk actually is, how serious it is, and what to do about it. The audit is essentially one part of the assessment, pulled out and measured against a fixed yardstick, which is why an assessment contains the audit. If you only have budget for one, run the assessment.

Why run a physical security assessment?

Run a physical security assessment because the cost of not knowing shows up on a balance sheet before it shows up in an incident report as theft, liability, insurance exposure, and lost tenants.

• Theft and loss. Unauthorized access to stockrooms, equipment, and back-of-house areas is a common, preventable loss in commercial buildings, and it usually traces back to a credential or a door nobody was managing.
• Liability. When an incident harms a tenant, an employee, or a visitor, the first question is whether the building took reasonable steps to prevent it. An assessment on record is evidence that you did.
• Insurance. Carriers ask for documented security controls and periodic review. A current physical security risk assessment supports your coverage and can affect your premium.
• Tenant and resident retention. Complaints about tailgating, broken readers, and slow response are retention problems. A property that feels unsafe loses the tenants you most want to keep.
• Response gaps. Most buildings can detect an incident. Far fewer can say who gets notified, how fast, and what they do next. The assessment surfaces that gap before an incident does.

The three-layer framework, applied

A physical security assessment works best when it is organized around what security is supposed to do. Physical security’s three-layer framework, namely deterrence, detection, and response, keeps the focus on outcomes. Assess each layer on its own, because a building can be strong in one and blind in another, and the gap is usually in the layer that gets overlooked.

Assessing deterrence: lighting, signage, and perimeter controls

Deterrence is everything that makes a building a harder target before anyone tries anything. Assessing it means walking the property like an intruder. Are entrances, docks, and parking lit well enough that there are no easy shadows? Is signage clear that the site is monitored? Do fences, gates, and landscaping channel people toward controlled entrances, or can someone reach a side door unseen? Deterrence is the cheapest layer to fix, and the one buildings most often skip, because it does not come with a dashboard.

Assessing detection: cameras, analytics, and access control monitoring

Detection is how quickly the building knows something is wrong. Assess camera coverage against a floor plan and mark every blind spot. Check whether analytics flag events in real time or only record them for later. Confirm that access events are actively monitored, with every event triggering a review as it happens. Check that a failed credential at 2 a.m. reaches someone who can act on it before the night is over. A camera no one monitors and an alert no one receives both leave the building exposed while the records pile up.

Assessing response: who gets notified, how fast, and what they do

Response is the layer that turns a detection into an outcome, and most assessments never reach it. For each type of event, be it a forced door, a fire alarm, or an after-hours access attempt, you should be able to name who gets the alert, how fast it reaches them, and exactly what they do next. If the honest answer is "it depends on who is nearby," you have found the most important gap in the building. Detection without a defined response only produces a record of what went wrong. Protection begins when someone is named to act on it.

How to conduct a physical security assessment

Here is a repeatable, step-by-step process. It works for a single office and scales to a multi-tenant building or a portfolio.

Step 1: Define scope and the assets you are protecting. List what matters, like people, spaces, equipment, data rooms, and cash-handling areas, and set the boundary of the site security assessment. A clear scope keeps the walk honest and the report focused.

Step 2: Walk the perimeter and entry points. Start outside. Check every door, gate, dock, and ground-floor window for how it is secured and whether it is used as designed. Propped doors and disabled locks show up on the walk itself, long before any system report would catch them.

Step 3: Evaluate access control and credential management. Review who has access to what, how credentials are issued, and how fast they are revoked when someone leaves. Pull the access list and look for names that should not be on it. Stale permissions are often discovered in a physical security vulnerability assessment.

Step 4: Evaluate video coverage and blind spots. Map cameras against the floor plan, confirm they are recording and that footage is retained for a useful period, and mark what they cannot see. A physical security gap analysis lives or dies on the blind spots you are willing to write down.

Step 5: Review incident history and response protocols. Look at what has actually happened with alarms, access denials, complaints, and near-misses, and trace how each was handled. History tells you where the real weaknesses are more reliably than any checklist.

Step 6: Score and prioritize the findings. Rate each finding by likelihood and impact so the list stops being flat. A simple security risk assessment matrix, like high, medium, or low on each axis, is enough to tell a busy owner what to fix first.

Step 7: Build the remediation plan and set a reassessment cadence. Assign each finding an owner, a fix, and a date, then decide when you will run the assessment again. This step starts a physical security audit process that helps improve the building.

Physical security checklist

Use this as a working physical security risk assessment checklist, organized by the three layers and program ownership. You can also use it as a building security checklist. It is a starting structure that still depends on a walk of your specific building.

Deterrence

• Exterior, entrances, docks, and parking are lit with no dark approaches to any door.
• Signage clearly states the site is monitored and access is controlled.
• Fencing, gates, bollards, and landscaping channel foot traffic to controlled entrances.
• Ground-floor windows and secondary doors are secured and alarmed.

Detection

• Camera coverage is mapped against a floor plan, with blind spots documented.
• Footage is recorded, retained for a defined period, and retrievable quickly.
• Access events are monitored in real time, with each event surfaced for review as it happens.
• Alarms and analytics generate alerts that reach a named person or team.

Response

• Every alert type has a documented owner and response procedure.
• Notification paths are tested and reach someone around the clock.
• Credential revocation on employee or tenant exit is immediate and verified.
• Emergency procedures meet local life-safety codes and are rehearsed.

Program and ownership

• Access permissions are reviewed on a regular schedule that runs independently of any problem.
• Someone is formally accountable for security operations between assessments.
• Findings from the last assessment were closed, with dates and owners on record.
• A reassessment date is set and on the calendar.

Building a physical security assessment report

A report is only useful if someone can act on it. A physical security assessment report template does not need to be elaborate, but it does need these parts:

• Scope and method. What was assessed, what was not, and how, so the reader knows the boundaries of the findings.
• Findings by layer. Deterrence, detection, and response, each with what you observed in plain terms.
• Risk ratings. A likelihood-and-impact score for each finding, so priority is obvious at a glance.
• Prioritized recommendations. The specific fix for each finding, ordered by risk, with an owner and a target date.
• Reassessment cadence. When the building will be assessed again, and what would trigger an earlier review.

The recommendation list is the part that matters. A report that rates risks but never says who fixes what, by when, describes the problem and stops there.

DIY assessment vs. one-time professional audit vs. ongoing managed assessment

There are three honest ways to assess a building's security. Each has a real place, and each has a limit one must understand before choosing.

DIY physical security assessment

A security audit checklist and an honest walk-through will catch obvious problems, like dark corners, propped doors, or cameras pointed at walls. For a small site, it is a reasonable first pass. Its weakness is scope. You tend to find the risks you already understand and miss the ones you do not, and when the walk is done, no one is responsible for closing what it found.

One-time professional physical security audit

Bringing in an expert raises the quality of the findings. A professional sees the failure patterns an internal team lives with every day. This is the right call before a lease, an acquisition, or an insurance review. It has the same structural limit as the DIY version, though. It is a snapshot. The building changes the week after the auditor leaves, and the report does not change with it.

Ongoing managed physical security assessment

Both one-time approaches leave the same gap, and it is a simple one. Nobody is watching six months later. An ongoing managed assessment closes it by treating the assessment as the first step in a program that continues long after the report is delivered. The building is assessed, the gaps are fixed, and someone stays accountable for keeping the posture current as access lists, tenants, and technology change. It is the only one of the three where a named partner still owns the building’s security in month six.

How managed security turns an assessment into a program

An assessment tells you where you stand today. Physical security risk does not hold still, so the real deliverable is what you do with the report and who keeps checking afterward. That is the difference between owning a security system and running a security program.

A managed security model closes the loop that every one-time assessment leaves open. One partner designs the system around the findings, installs it, monitors it around the clock, and maintains it as the building changes. When something needs attention, one call resolves it, with no gaps in protection and no vendors pointing at each other. Under this model, the building buys security as the outcome, with the partner handling day-to-day operations.

Kastle has worked this way for over 50 years, protecting more than 60,000 businesses across the United States and Australia. The assessment is where the relationship starts. One accountable partner owns the full security lifecycle, from design through ongoing maintenance, so the gaps a good assessment finds don’t quietly reopen once the report is filed.

The bottom line

A physical security assessment tells you where a building stands today, measured across deterrence, detection, and response. Its value is the program it starts, which closes the gaps the assessment finds and reassesses the building as it changes. A managed approach keeps that posture current long after the walk is done, so the risks a good assessment finds stay closed.