A commercial property security checklist should cover the building from the outside in: the perimeter and car parks, entrances and reception, access control and keys, CCTV and alarms, people and procedures, out-of-hours arrangements and legal compliance. Each item should have an owner and a review date, because a checklist only improves security when the gaps it finds are closed.
Read moreShow less
Use the tables below as a starting point for an annual review, a new acquisition or a change of tenant. Mark each line as in place, partly in place or not in place, then prioritise the gaps by risk.
Key takeaways
- Work through security in layers, from the perimeter inwards, and record who owns each action.
- Access control and key management are often the weakest points in a multi-tenant building.
- CCTV must have a documented purpose, a data protection impact assessment, clear signage and a retention policy.
- Out-of-hours cover, alarm response and lock-up checks should be written down, not assumed.
- Martyn’s Law will place new duties on some larger premises once it commences, so owners should check whether their buildings are in scope.
How to use this checklist
Read moreShow less
- Walk the site. Complete the checklist on site, at different times of day, including after dark.
- Involve the right people. Facilities, the managing agent, tenants’ representatives, the security provider and, where relevant, the insurer.
- Record evidence. Photographs, logs and system reports are more reliable than memory.
- Assign actions. Each gap needs an owner, a cost estimate and a target date.
- Review. Repeat at least annually, and after any significant incident, a change of tenant or use, major building works or a change of security provider.
1. Perimeter, grounds and car parks
Read moreShow less
| Check | Why it matters |
|---|---|
| Boundary fences, walls and gates are intact and free of climbing aids such as bins or pallets | Damaged or easily climbed boundaries invite trespass and theft |
| External lighting covers entrances, car parks, bin stores and service yards, and is checked for failed lamps | Poor lighting reduces natural surveillance and CCTV quality |
| Landscaping is kept low near windows and doors | Overgrown planting provides concealment |
| Car park barriers and shutters operate correctly and fail safely | Faulty barriers are often left open permanently |
| Bin stores and external plant are locked and away from the building where possible | Combustible waste near walls is an arson risk |
| Signage shows that the site is monitored and gives the CCTV operator’s identity | Supports deterrence and data protection transparency |
2. Entrances, reception and goods-in
Read moreShow less
| Check | Why it matters |
|---|---|
| A single controlled public entrance during business hours, with secondary doors kept closed | Multiple open entrances make visitor control impossible |
| Visitors sign in, are issued passes and are escorted or directed according to policy | Ensures everyone in the building can be accounted for |
| Reception staff or officers have a clear procedure for unexpected visitors, deliveries and suspicious items | Reduces hesitation when something unusual happens |
| Goods-in and loading areas are supervised when open and secured when not | Service entrances are a common route for unauthorised access |
| Fire exits are alarmed or monitored to detect misuse, while remaining easy to open in an emergency | Security must not compromise means of escape |
On fire exits, the Regulatory Reform (Fire Safety) Order 2005, which applies in England and Wales, requires that emergency doors are not locked or fastened in a way that prevents them being easily and immediately opened by anyone who may need to use them in an emergency. Scotland has separate fire safety legislation with comparable expectations. Security measures on these doors should always be agreed with the person responsible for fire safety.
For more on front-of-house roles, see our reception security service.
3. Access control and keys
Read moreShow less
| Check | Why it matters |
|---|---|
| Access cards or fobs are issued by a defined process and cancelled promptly when people leave | Live credentials held by former staff or contractors are a common weakness |
| Access rights are reviewed periodically and limited to the areas each person needs | Reduces insider risk and limits the impact of a lost card |
| Plant rooms, risers, roof access and comms rooms are restricted | These areas are attractive to thieves and critical to building operation |
| Keys are recorded in a key register, held in a secure cabinet and signed in and out | Untracked keys make it impossible to know who can enter |
| Master keys and alarm codes are limited and changed after staff or contractor changes | Compromised codes and master keys undermine every other control |
| Arrangements exist for keys to be held by a professional keyholder out of hours | Avoids sending staff alone to alarm activations at night |
Our article on the benefits of professional keyholding explains how keyholding and alarm response work in practice.
4. CCTV, alarms and monitoring
Read moreShow less
| Check | Why it matters |
|---|---|
| The purpose of each camera is documented and a data protection impact assessment has been completed | The ICO expects a DPIA in most surveillance cases |
| Images are of usable quality day and night, with correct date and time | Poor or mistimed images have little evidential value |
| A retention period is set by purpose, and footage is deleted securely at the end of it | UK GDPR sets no fixed period; retention must be justified |
| Only authorised people can view or export footage, and disclosures are logged | Supports subject access requests and evidence handling |
| Intruder alarms are maintained, zoned sensibly and connected to a monitored response | An unmonitored alarm may simply ring until someone notices |
| Fault and false alarm trends are reviewed with the installer and response provider | Repeated false alarms reduce the credibility of every activation |
The ICO’s guidance on video surveillance also expects signs to be visible before people enter the monitored area, to name the organisation responsible and to provide a contact route. If you use body-worn video or facial recognition, the ICO treats these as additional considerations requiring specific assessment.
5. People, procedures and training
Read moreShow less
| Check | Why it matters |
|---|---|
| Written assignment instructions exist for every security post and are signed off by the client | Officers can only follow procedures that are documented |
| Contracted security officers hold valid SIA front-line licences, checked on the SIA register | A legal requirement for licensable contract security work |
| Staff know how to report suspicious behaviour and what to do in an emergency | Security depends on the whole building population, not only officers |
| Lone working risks for security and facilities staff have been assessed and managed | HSE expects risks to be managed before people work alone |
| Incident reports are completed for every incident and reviewed for trends | Trends show where controls need to change |
| Procedures exist for evacuation, invacuation and lockdown | Different threats require different responses |
6. Out of hours and vacant areas
Read moreShow less
| Check | Why it matters |
|---|---|
| A lock-up routine checks doors, windows, lights and alarm setting at the end of each day | Unlocked doors and unset alarms are among the most common causes of loss |
| Out-of-hours patrols or guarding are matched to the risk | Empty buildings are more vulnerable at night and weekends |
| Vacant floors or units are inspected regularly for intrusion, leaks and utility faults | Unnoticed damage in vacant space quickly becomes expensive |
| A plan exists for when primary systems fail, such as a power cut affecting doors or CCTV | System failures create windows of opportunity |
| Contractor working out of hours is permitted, supervised and logged | Uncontrolled contractor access is difficult to investigate afterwards |
For buildings with empty space, see our guide to vacant property security planning.
7. Compliance and governance
Read moreShow less
| Check | Why it matters |
|---|---|
| A current security risk assessment exists and is reviewed at least annually | Controls should reflect current risks, not historic ones |
| Security provider’s SIA approved contractor status and approved activities have been checked on the SIA register | Confirms what the provider is actually approved for |
| Insurance requirements for security, such as alarm maintenance or attendance conditions, are understood and met | Breaching policy conditions can affect claims |
| Data protection responsibilities for CCTV and visitor records are allocated between landlord, tenants and provider | Avoids confusion over who is the controller |
| Applicability of the Terrorism (Protection of Premises) Act 2025 has been considered | Some larger premises will have new duties once it commences |
Martyn’s Law
The Terrorism (Protection of Premises) Act 2025, known as Martyn’s Law, received Royal Assent on 3 April 2025. Home Office statutory guidance describes an implementation period of at least 24 months before the main duties commence, with the SIA as regulator. Premises within scope that can reasonably expect between 200 and 799 people to be present at the same time fall into the standard tier, and those expecting 800 or more fall into the enhanced tier. Not every commercial building will be in scope, because the Act applies to specified uses, so owners and managing agents should read the statutory guidance and take advice where needed. There is no legal duty to comply until the requirements commence.
Turning findings into an action plan
Once the checklist is complete, group actions into three categories:
Read moreShow less
- Quick fixes: lighting repairs, clearing climbing aids, cancelling unused access cards, updating signage.
- Procedural changes: new assignment instructions, lock-up routines, visitor policy, key register.
- Investment decisions: CCTV upgrades, access control replacement, additional guarding or patrol cover.
Present investment decisions with the risk they address and the expected effect, so that budget holders can compare options.
How Seccuro can help
Seccuro supports commercial property owners, managing agents and facilities teams with security guarding, reception security, mobile patrols, keyholding and alarm response, lock and unlock services and monitored CCTV towers and site equipment, available across the UK.
Read moreShow less
See our commercial property security page, or request a quote.
Questions
Can fire exits be locked for security reasons?
Only in ways that keep them easy to open in an emergency. Door alarms, monitoring and approved emergency release hardware can deter misuse without compromising escape.
Does a commercial building need a DPIA for CCTV?
In most cases, yes. It should be completed before the system is installed or changed.
Will Martyn’s Law apply to my office building?
Possibly, but not automatically, because the Act covers only specified uses. The thresholds and timetable are set out in the Martyn’s Law section above.
Sources (6)Hide sources
- ICO: Video surveillance (including guidance for organisations using CCTV)
- ICO: How can we comply with the data protection principles when using surveillance systems?
- legislation.gov.uk: Regulatory Reform (Fire Safety) Order 2005, article 14
- GOV.UK (Home Office), Terrorism (Protection of Premises) Act 2025: statutory guidance
- GOV.UK: Check security staff have a licence to work
- HSE, Lone working: protect those working alone
General guidance, not legal advice. Check current legislation and official guidance for your circumstances.