Site security checklist: what to check, how often, and how to show it was done

01

Why a site needs a security checklist

No single law requires a site security checklist. The duties behind one come from several places, and a checklist, with the documentation behind it, is the ordinary way of showing day-to-day compliance with them.

• The Health and Safety at Work etc. Act 1974 requires employers to protect people who are not their employees, including visitors and members of the public, so far as is reasonably practicable. On a construction site that includes children and trespassers drawn to plant, scaffolding and excavations.
• The Construction (Design and Management) Regulations 2015 require a construction site, where necessary in the interests of health and safety and so far as is reasonably practicable, to have its perimeter identified by suitable signs, be fenced off, or both (regulation 18(2)), and require the principal contractor to ensure that the necessary steps are taken to prevent access by unauthorised persons to the construction site (regulation 13(4)(b)). The Health and Safety Executive's guidance on protecting the public from construction work says that, in populated areas, the site boundary will typically mean a two-metre high small mesh fence or hoarding around the site (guidance, not a height set in law), and its guidance Protecting the public: Your next move (HSG151) explains what that means in practice.
• Occupiers' liability law places a duty of care on whoever controls premises towards visitors and, to a lesser extent, trespassers. The Acts differ between England and Wales, Scotland and Northern Ireland, but the principle is the same.
• Fire safety law – the Regulatory Reform (Fire Safety) Order 2005 in England and Wales, the Fire (Scotland) Act 2005, and the Fire and Rescue Services (Northern Ireland) Order 2006 with its regulations – means security measures must never block escape routes or lock fire exits while people are inside.
• Data protection: CCTV that captures identifiable people is covered by the UK GDPR and the Data Protection Act 2018, and the Information Commissioner's Office publishes guidance on using it lawfully.

Two more sources often matter more in practice than any statute: the insurer, whose policy conditions may require an intruder alarm, keyholders, locks of a set standard or security patrols, and the client or landlord, whose contract sets what the security provider must check. The Terrorism (Protection of Premises) Act 2025, known as Martyn's Law, will add duties for some publicly accessible premises and events once its implementation period ends, with the Security Industry Authority as the regulator.

02

What a site security checklist should cover

The checklist should come from a security risk assessment: what could be stolen, damaged or misused, who might try, and what would follow if they did. Tailor it to the site: the potential threats to a city office are not those facing a rural warehouse or a housing development. A good checklist then covers the physical security measures that answer those risks:

• Perimeter: fences, hoardings, gates and barriers intact, with no gaps, climbing aids or loose panels; signs in place.
• Access control: gates and doors locked or staffed; card readers and door entry working; visitor and contractor sign-in in use; no unauthorised people on site.
• Locks and keys: padlocks, shutters and doors secure; keys and fobs accounted for against the key register; codes changed when people leave.
• Lighting: external and car park lighting working, with no dark spots at entrances, yards or storage areas; good visibility is one of the cheapest ways to deter intruders.
• CCTV: CCTV cameras on, clean and pointing where they should; recording working; the date and time correct; signs displayed.
• Intruder alarm system: set when the site is empty; detection zones clear of stacked goods; faults and activations logged; keyholders and the monitoring centre's contact details up to date.
• Secure storage: tools and equipment locked away; high-value materials and fuel in secure storage; plant immobilised and keys removed.
• Hazardous substances: chemicals, gas cylinders and fuel stored securely, away from the perimeter and from anyone who might misuse them.
• Fire safety: escape routes clear, fire exits unobstructed and not locked while occupied, fire extinguishers in place, no combustible waste stacked against buildings or hoardings.
• Sensitive areas: server rooms, plant rooms, roof access and stores locked and entered only by authorised people.
• Signs of trouble: vandalism, graffiti, damage, rubbish or anything that suggests someone has been on site.
• Emergency equipment: first aid kits stocked and the emergency contact list current, so whoever finds a problem out of hours knows who to call.

Keep it to what someone can check properly on the round. A list of forty items walked in ten minutes gets ticked, not checked.

03

Construction site security

A construction site changes every week, which is why a construction site security checklist is reviewed more often than one for a finished building. The perimeter moves, scaffolding goes up, new plant arrives and the most valuable materials are often delivered just before they are fitted. Construction site security usually adds:

• Scaffolding and ladders: ladders removed or boarded at the end of the day so no one can climb.
• Excavations and openings: covered or fenced, particularly where children could reach them.
• Plant and vehicles: parked inside the compound, immobilised, with keys held securely.
• Deliveries: checked in, stored securely and not left unattended at the gate overnight.
• Materials: stored within the site perimeter, preferably in a secure compound or away from the perimeter fencing, as HSE's guidance on protecting the public advises, and stacked so that pipes, manhole rings and cement bags cannot topple or roll over.
• The site office and welfare cabins: locked, with no tools, keys or documents left visible.
• Security personnel: patrol times, gatehouse hours and the out-of-hours contact, if the site has guards or mobile patrols.

The principal contractor owns the construction site security plan and the checklist that goes with it. On a larger construction project the plan also covers business continuity: what happens to the programme if plant or materials are stolen, and how quickly the site can be made safe again after a break-in.

04

How often each check is due

There is no statutory frequency for most security checks. The right interval follows the risk assessment, the insurer's conditions and how the site is used. A common pattern for a building or a site that is staffed during the day and empty at night is:

• At opening: alarm unset and any overnight activations noted, perimeter walked, doors and gates checked for damage, anything unusual recorded before people arrive.
• Through the day: access points watched, visitors signed in, deliveries received, fire exits checked for obstruction.
• At closing: every room and floor checked for people, windows and doors locked, equipment secured, lights set, alarm set, gates locked.
• Out of hours: patrols by a guard on site or a mobile patrol, at the times the assignment instructions set.
• Weekly: CCTV recording checked, key register reconciled, lighting walked after dark.
• Monthly or quarterly: a fuller inspection or audit of the security plan against the checklist.
• At least yearly, and after any incident or change of use: the security risk assessment reviewed.

Alarm and CCTV systems also need maintenance by a competent contractor, at the intervals the installer and the insurer set. A daily check that the alarm set properly is not a substitute for that service.

05

Who does it, and what good evidence looks like

Every check on the list should have an owner: a named role, not "security" or "the team". On a guarded site that is usually the security officer on shift, with the security supervisor checking the checklist is being followed. In an office or warehouse without guards it may be the site manager, a caretaker, the last keyholder out, or the facilities team.

A record that shows the checks were done well has the same features on any site:

1. It is completed at the time, at the place, not filled in afterwards from memory.
2. It names the person who did the check.
3. It records exceptions: the gate found open, the light out, the camera pointing at the sky, and who was told.
4. Faults are followed up: a broken lock recorded on Monday should not still be recorded on Friday.
5. Gaps are explained: a missed closing check with a reason is more credible than a sheet with no gaps.
6. Someone reviews it: a manager who reads the checklist each week spots the repeated problem before it becomes an incident.

That accountability matters when something goes wrong. After a break-in, the insurer and the police will ask when the site was last checked, by whom, and what was found. A checklist that answers all three is worth more than any number of ticks.

06

Where security checklists fail, and where SiteClara fits

The paper checklist on a clipboard in the gatehouse has the same weakness everywhere. It is filled in at the end of the shift. Nobody can tell whether the rear gate was checked at 18:00 or ticked at 18:00 from the office. Faults written on the sheet stay on the sheet. And the client, or the manager responsible for several sites, sees it only if they visit.

SiteClara records the checks where they happen. A printed QR poster, with an optional NFC tag behind it, goes at each checkpoint: the main gate, the compound, the plant room, the fire exits, the roof door. Whoever does the round scans the code or taps the tag on their own phone, with no app to install, and marks the scheduled check done or explains what stopped them. The time and the named person are recorded as it happens, with a photo where one helps. A fault found on the round goes onto the team's list of jobs until someone closes it, and the supervisor can escalate it to the building manager.

The supervisor sees what was due, done and missed, and can record the reason a check was missed. Each day's report is reviewed and approved by the supervisor and goes to nominated management or client contacts at 8am the next morning, with what was reported, what is still open and how scheduled checks went.

07

Further reading, and a list to take away

The Health and Safety Executive publishes Protecting the public: Your next move (HSG151) for construction sites and guidance on the CDM Regulations. The National Protective Security Authority (NPSA) and ProtectUK publish protective security advice for UK businesses, including preparation for Martyn's Law. Secured by Design, the police crime prevention initiative, publishes guidance on physical security standards. The Information Commissioner's Office publishes guidance on CCTV and surveillance systems.

Before you print or revise the checklist, check that:

• it comes from a current security risk assessment for the site;
• every item has a named owner and a set frequency;
• opening, closing and out-of-hours checks are separate;
• fire exits and escape routes are checked, and never locked while people are inside;
• keys, codes and alarm contacts are reconciled regularly;
• faults found are reported to someone who will fix them, and followed up;
• someone reviews the completed checklist every week;
• the checklist is reviewed after any incident and whenever the site changes.