Building security checklist: what to check, when to check it, and how to show it was done

01

Why a building needs a security checklist, and which rules apply

No federal law requires an ordinary office, school or commercial building to keep a security checklist. The duties behind one come from several places, and a checklist, with the record behind it, is the ordinary way of showing that the security program works day to day and not only on paper.

• The employer's general duty. Section 5(a)(1) of the Occupational Safety and Health Act of 1970, the General Duty Clause, requires every employer covered by the Act to furnish a place of employment "free from recognized hazards that are causing or are likely to cause death or serious physical harm" to its employees. In the 21 states and Puerto Rico whose OSHA-approved State Plans cover private employers, the state program applies instead, and some states add rules of their own, so check which applies before relying on the federal text.
• Workplace violence. OSHA's workplace violence page defines it as "any act or threat of physical violence, harassment, intimidation, or other threatening behavior that occurs at the work site" and says plainly: "There are currently no specific OSHA standards for workplace violence." Its risk factors include working alone or late at night, which is exactly who a lockup check or a night round involves.
• Exit routes, which limit what security may do. Under OSHA's exit route standard, 29 CFR 1910.36, "Employees must be able to open an exit route door from the inside at all times without keys, tools, or special knowledge," and exit doors must be free of any device or alarm that could restrict emergency use if it fails. 29 CFR 1910.37 adds that exit routes "must be free and unobstructed" and adequately lit. Security decides who gets in; it must never decide who gets out. The local fire code, adopted and enforced by the authority having jurisdiction, sets its own rules on door locking and hardware on top.
• Premises liability. State law places a duty of care on whoever owns or controls a building toward the people lawfully in it. The rules differ by state, but after an assault in a dark parking lot the question is the same: what did the owner know, and what did they do about it?

Two more sources often matter more in practice than any statute: the insurer, whose policy may require a monitored alarm, named keyholders or a set standard of lock, and the lease or the security contract, whose post orders set what the officers must check and when. A campus, a hospital or a building under a state-specific rule will have more to add.

The federal guidance that pulls this together comes from the Cybersecurity and Infrastructure Security Agency (CISA). It is voluntary. CISA's Security Planning Workbook (September 2023) is described as a resource to "assist critical infrastructure owners and operators with the development of a foundational security plan" and is "designed to be flexible and scalable to suit the needs of most facilities." The checklist is how that plan is carried out on an ordinary Tuesday.

02

What a building security checklist should cover

The checklist should come from an assessment of the building: what could be stolen, damaged or misused, who might try, and what would follow if they did. CISA's fact sheet Physical Security Considerations for Temporary Facilities (September 2025) puts it simply for event venues, and the order holds for any building: "an important first step is to conduct a vulnerability assessment to identify and prioritize areas of concern that need to be addressed." A downtown office tower and a suburban school face different risks, and their checklists should differ. A good one covers the physical measures that answer those risks:

• Exterior and grounds: fences and gates intact; nothing pushed against walls that could be climbed; landscaping trimmed back from doors and windows.
• Entrances and access control: card readers and door strikes working; doors closing and latching fully; nothing propping a door open; the visitor sign-in in use.
• Non-public doors: loading docks, service doors, roof hatches and mechanical rooms locked. The CISA fact sheet advises that operators "secure non-public entrances or post staff to monitor non-public entrances."
• Locks, keys and codes: keys, cards and fobs accounted for against the key log (see key control); codes changed when people leave; lost cards deactivated the same day.
• Lighting: exterior, parking lot and garage lights working, with no dark spots at doors, walkways, stairwells or the trash enclosure; interior exit routes lit.
• Video surveillance: cameras on, clean and aimed where they should be; recording working; the date and time right. CISA's first listed measure is to "ensure all closed-circuit television (CCTV) cameras or video surveillance systems are operable." See security camera checks for the routine.
• Intrusion alarm: armed when the building is empty; motion detectors not blocked by stacked boxes; activations and trouble conditions logged; the call list at the central station that monitors the alarm kept current.
• Exits and fire safety: every exit door opening from the inside without a key, exit routes clear, exit signs lit, fire extinguishers in place, and nothing stored in stairwells. A security measure that chains an exit is a violation, not a precaution.
• Sensitive areas: server rooms and data closets, electrical rooms, pharmacy or cash rooms, safes and records storage locked and entered only by authorized people.
• Signs of trouble: forced doors, broken glass, graffiti, people sleeping in a stairwell, unattended bags or packages.
• Emergency equipment and contacts: the AED and first aid kits where they belong, the emergency call list current, and radios or phones working, so whoever finds a problem after hours knows who to call.

Keep it to what someone can check properly on the round. A list of forty items walked in ten minutes gets checked off, not checked. Split it: a short opening list, a short lockup list, and a longer weekly walk.

03

Opening, through the day, and lockup

Most security failures in an occupied building happen at the edges of the day: the first person in finds a door that was never locked, or the last person out assumes someone else set the alarm.

At opening. Whoever unlocks the building, often a security officer, the building engineer or the first custodian on shift, disarms the alarm and notes any overnight activations, walks the exterior doors and the ground floor, checks for forced entry or damage, and records anything unusual before tenants and staff arrive.

Through the day. The lobby officer or the front desk controls who comes in: visitors signed in and badged, contractors checked against the work order, deliveries received at the dock and not left in the corridor. Exit routes are walked for obstruction. CISA's Power of Hello program is aimed at exactly this: staff who notice someone out of place, greet them, judge whether the behavior is genuinely suspicious, and get help, reporting what, who, where, when and why.

At lockup. The closing sweep is the check most worth writing down. Every floor and restroom checked for people who should not be there, windows closed, exterior doors latched and locked, the loading dock secured, lights set for the night, the alarm armed, and the parking lot or garage gates closed. In a multi-tenant building, lockup is often split between the officer, the evening custodial crew and each tenant's last person out, which is where gaps appear. The checklist should say who does which door.

After hours. A building with officers on post or a mobile patrol checks at the times the post orders set, usually the perimeter, the parking areas, the exterior doors and the alarm panel. Without officers, the building relies on the alarm and the cameras, and the lockup check matters all the more.

04

How often each check is due, and who owns it

There is no federal frequency for most building security checks. The right interval follows the assessment, the insurer, the lease and how the building is used. A common pattern for a building that is occupied during business hours and empty at night is:

• Every opening and every lockup: the exterior doors, the alarm, the loading dock, a sweep for people at closing.
• Every shift, or at the times the post orders set: the officer's rounds of the perimeter, the parking areas and the exterior doors.
• Daily: exit routes walked for obstruction, the video system checked for cameras offline, the visitor log reviewed.
• Weekly: the exterior lighting walked after dark, card access reports reviewed for doors held open or forced, the key log reconciled.
• Monthly or quarterly: a fuller walk of the building against the whole checklist, usually with the facility manager or property manager.
• At least yearly, and after any incident, renovation, change of tenant or change of use: the security assessment and the checklist reviewed.

Alarm, access control and camera systems also need maintenance by a qualified contractor, and fire alarm and exit hardware have their own testing under the adopted fire code. A daily check that the alarm armed is not a substitute for either.

Every item on the list should have an owner: a named role, not "security" or "the team." With contract security, that is usually the officer on post, with the security supervisor making sure the checklist is followed. Without officers, it may be the building engineer, the property manager, the lead custodian or whoever holds the last key out. Where two companies share a building, the post orders and the janitorial scope of work should say which doors belong to whom.

05

What good evidence looks like, and how it is checked

A record that shows the checks were done well has the same features in any building:

1. It is completed at the time, at the door or the panel, not filled in at the end of the shift from memory.
2. It names the person who did the check, not only the post or the company.
3. It records exceptions: the dock door found unlocked, the light out over the side entrance, the camera aimed at the sky, and who was told.
4. Faults are followed up: a broken door closer written up on Monday should not still be written up on Friday. Each should become a work order.
5. Gaps are explained: a missed lockup check with a reason is more credible than a sheet with no gaps at all.
6. Someone reviews it: a supervisor or property manager who reads the record each week spots the door that is always found open before it becomes a break-in.

That matters most when something goes wrong. After a theft, an assault or a claim, the insurer, the police and the client will ask when the building was last checked, by whom, and what was found. A record that answers all three, with the incident report and the daily activity report alongside it, is worth more than any number of check marks.

Periodic review brings in fresh eyes: a colleague from another site, the insurer's loss control representative or an outside consultant finds what the regular officer no longer sees. CISA also has Protective Security Advisors across the country, who, in CISA's words, "advise and assist state, local, tribal, and territorial (SLTT) officials and critical infrastructure owners and operators." The National Fire Protection Association publishes NFPA 730, Guide for Premises Security, which some owners and consultants use as a reference; like any NFPA document, it has no force unless a jurisdiction or a contract adopts it.

06

Where security checklists fail, and where SiteClara fits

The paper checklist on a clipboard at the security desk has the same weakness everywhere. It is filled in at the end of the shift. Nobody can tell whether the loading dock was checked at 10 p.m. or checked off at 10 p.m. from the lobby. Faults written on the sheet stay on the sheet, and the client sees it only if they visit.

SiteClara records the checks where they happen. A printed QR poster, with an optional NFC tag behind it, goes at each checkpoint: the main entrance, the loading dock, the roof hatch, the parking garage, the server room door, the alarm panel. Whoever does the round, whether an officer, the building engineer or the evening custodian, scans the code or taps the tag on their own phone, with no app to install, sees the checks due there, such as "dock doors closed and locked" or "exit route clear," and marks them done or says what stopped them. The time and the named person are recorded as it happens, with a photo when one is asked for. A problem found on the round, such as a door that will not latch or a camera offline, is reported there and goes onto the team's list of jobs until someone closes it, and the supervisor can escalate it to the building's management to answer.

The supervisor sees what was due, done and missed, and can record the reason a check was missed. Each day the supervisor reviews the day's checks, adds a note and approves a report that goes to nominated management or client contacts at 8 a.m. the next morning, showing what was reported, what is still open and how the scheduled checks went.

07

Questions people ask

What is a security checklist?

A security checklist is the list of checks that carries a security plan out day to day: what is checked, where, how often and by whom. For a building, the plan comes first, and CISA's Security Planning Workbook is a federal resource to "assist critical infrastructure owners and operators with the development of a foundational security plan." The checklist then turns that plan into the rounds at opening, through the day and at lockup.

What are the five W's in security?

In CISA's Power of Hello guidance, the 5Ws are the questions to ask yourself before reporting suspicious behavior to management or the police: what is happening, who is doing it, where it is taking place, when you observed it, and why they are here. The same five make a useful test of any exception written on a security checklist.

08

Further reading, and a list to take away

CISA's physical security pages collect its guidance for businesses, schools and houses of worship, including the Security Planning Workbook, the Preventing Workplace Violence: Security Awareness Considerations infographic, Power of Hello and active shooter preparedness. OSHA's workplace violence page and the exit route standards at 29 CFR 1910.36 and 1910.37 set the floor for employers, with the state plan where one applies. The local fire marshal is the authority on door locking and exit hardware.

Before you print or revise the checklist, check that:

• it comes from a current security assessment of this building, not a template for a different one;
• every item has a named owner and a set frequency;
• opening, lockup and after-hours checks are separate and short enough to finish;
• every exit opens from the inside without a key, and no security measure blocks an exit route;
• keys, cards, codes and the alarm call list are reconciled regularly;
• doors shared between security, custodial staff and tenants are assigned to someone;
• faults found become work orders, and are followed up until closed;
• someone reviews the completed record every week;
• the checklist is reviewed after any incident and whenever the building or its use changes.