Event security plan: a checklist for before, during and after the event

01

What an event security plan is, and what governs it

No single federal law requires an event security plan. What exists is a set of duties that apply to every workplace, a local fire code, and voluntary federal guidance on how to put it together.

The guidance comes from the Cybersecurity and Infrastructure Security Agency (CISA). Its Securing Public Gatherings page warns that places where crowds gather "are easily accessible and often have minimal security," and points to planning, training staff and volunteers, and working with local authorities. Two of its tools fit this job. The Mass Gathering Security Planning Tool (revised May 2024) gives event planners "a framework to begin or continue planning efforts for a mass gathering or special event" and produces a report of planning considerations; nothing is sent to CISA. The Security Planning Workbook (September 2023) walks through a planning team, an "as-is review" of the site, threats and mitigation, and asks whether "crowds gather inside, outside, or both."

For venues that host ticketed events, CISA and the Commercial Facilities Sector Coordinating Council publish more detailed guides, including the Public Venue Bag Search Procedures Guide and the Public Venue Credentialing Guide (both July 2026). Both are explicit that their procedures are "options for consideration" and not required by any regulation or legislation.

The duties that are not optional sit elsewhere. Under OSHA's 29 CFR 1910.37, exit routes, "Exit routes must be free and unobstructed. No materials or equipment may be placed, either permanently or temporarily, within the exit route." That includes barricades, bag search tables and merchandise stands. Where an OSHA standard requires an emergency action plan, 29 CFR 1910.38, emergency action plans, sets its minimum contents, and the event plan should sit inside it rather than beside it (see emergency action plans). In states that run their own OSHA-approved state plans, the state's standard applies instead.

The fire code is adopted locally, and the authority having jurisdiction, normally the fire marshal, decides what an event in your building needs: the occupant load, the exits, and whether a permit, trained crowd managers or a fire watch are required. Ask early. Security officer licensing is set state by state, so check that any extra officers hold the license your state requires.

02

What the plan covers

CISA's workbook describes security in layers, which it calls security-in-depth: an outer perimeter (parking lots and structures, exterior grounds, walkways, the fence line), a middle perimeter (anything on the property but outside the main buildings, such as doors, walls and generators) and an inner perimeter (lobbies, auditoriums, offices, and secure spaces such as server rooms and building systems). An event plan works through the same layers, from the street to the stage. A plan that holds up usually covers:

• The planning team and decision makers. A named security coordinator who decides on the day, with alternates, and who talks to police and fire.
• The site and risk assessment. The venue, its entrances and exits, the expected attendance, and the security risks it faces, from overcrowding and medical calls to fire, violence and severe weather, each weighed by its likelihood and what it would do, so the security measures go where they matter most.
• Vehicle control. CISA's Vehicle Ramming Action Guide (March 2025) recommends keeping vehicles out of pedestrian-only areas, delivery routes away from events, and standoff zones with bollards, heavy planters or barricades that are "appropriately sized, adequately anchored, and purposely reinforced against impact loads."
• Entry and screening. The bag policy, the prohibited items list, search locations, lines, lighting, equipment, and what happens when something is found.
• Credentials and access control. Who can go back of house, how they prove it, and how temporary credentials are collected at the end.
• Security personnel and posts. Where every officer, usher and screener stands, what they do there and who relieves them, written as post orders.
• Communication protocols. Radios, a duress word, announcements, and who calls 911.
• Emergency procedures. Evacuation, shelter and lockdown, a bomb threat (see the bomb threat checklist), an active assailant, a medical emergency and severe weather.
• Accessibility. An accessible entrance and search lane, and how the plan works for people who use a wheelchair, cannot see or cannot hear the announcements.

The size of the document should follow the size of the risk. A breakfast seminar for 60 may need a page and a briefing; a concert or a campus commencement needs every heading above, agreed with the police and the fire marshal in advance.

03

Before the event: the pre-event checklist

Most of the work is done before the gates open. OSHA's fact sheet Crowd Management Safety Guidelines for Retailers, written for big sales events but useful for any crowd, recommends a staffing plan that designates a location for each worker, trained security or crowd management personnel where large crowds are expected, checking with local fire and police that permits are obtained, and an emergency plan shared with local public safety agencies.

In the days before, the checklist usually reads:

1. Plan agreed. Decision maker and alternates named, the plan shared with police and fire, permits in hand.
2. Staffing confirmed. Every post filled, reliefs planned, post orders written.
3. Public told. The bag search guide recommends publishing the procedures, bag limits and arrival advice in the predominant languages of expected ticket holders, and making clear before people buy tickets that refusing a search means no entry.
4. Credentials issued. Numbered, dated and color-coded differently from the last event, with a record of who received each one, and a "Sample Credential Board" at each access control point that staff can see and the public cannot (credentialing guide).
5. Staff trained. The bag search guide says search training "should be conducted prior to every event," and suggests placing restricted items in bags during training to test the screeners.

On the day, before doors open, comes the walk-through, and this is the part of the checklist that is easiest to sign without doing:

• Every exit on the route unlocked from the inside, unobstructed and marked, including the ones the event does not expect to use. OSHA's fact sheet says: "Do not restrict egress, and do not block or lock exit doors." See exit route requirements.
• Barricades and rope lines in place so that the line does not start right at the entrance, with "an adequate number of breaks and turns at regular intervals" to reduce the risk of pushing from the rear (OSHA).
• Vehicle barriers and road closures in place and anchored.
• Search lanes set up with tables, gloves, flashlights, bins and a bag size template, with extra lighting for an evening event.
• Signs for prohibited items, exits, first aid and restrooms posted.
• Radios charged and tested; the command post staffed.
• First aid kits and automated external defibrillators (AEDs) in place, with people on shift trained to use them.
• Back-of-house doors, loading docks, rooftops and mechanical rooms locked and checked.
• A sweep of public areas, restrooms and parking structures for unattended items before the public arrives.

Each item should be checked where it is by a named person, not ticked from the command post.

04

During the event: entry, screening, credentials and the crowd

Once the gates open, the plan is only as good as its consistency. The bag search guide says bag search policies should be enforced from when gates open until they close, that a change in the volume of guests "should not cause deviations in standard bag search procedures," and that searches should be conducted "regardless of wait time." A search that becomes a glance when the line gets long is not a search.

The same guide describes the search itself, outside first and then "from top to bottom, layer-by-layer" with a stick or flashlight rather than the searcher's hands, and separates what screeners look for into three categories:

• Prohibited: legal elsewhere but not allowed in this venue, such as firearms, knives, glass bottles, hard coolers, air horns, fireworks, drones and bags over the permitted size.
• Illegal: illegal at the city, county, state or federal level, such as explosives and narcotics.
• Suspicious: allowed in principle but out of place in quantity or kind, such as screwdrivers, large rolls of wire, batteries, alarm clocks or unidentified powders.

When a prohibited or illegal item is found, the guide recommends notifying supervisors, security and law enforcement at once, keeping the item at the search area, swapping out the screener so the line keeps moving, and using a duress word when an item is suspicious. Because some devices can be triggered by radio frequencies, staff should practice "some level of radio distancing" when reporting one. A person who refuses a search is asked to step aside while a supervisor explains that it is a condition of entry, with an exit lane for anyone who would rather leave.

Credentials work the same way. The credentialing guide says credentials should be worn and visible in controlled areas, that holders are still screened, and that "there should be zero tolerance for allowing an individual into a controlled area without the proper credentials." Temporary contractors should sign in and out on a contractor log and return their credentials each day.

Watching the crowd is the rest of the job. OSHA's fact sheet says that at maximum occupancy no one else enters until the level drops, and that security and crowd managers stand to the side of people entering or leaving, not in their path. CISA's vehicle guide asks staff to watch vehicles approaching a gathering for suspicious behavior, such as unexpected truck traffic or unusual speed. The bag search guide adds two things supervisors often forget: rotate screeners to avoid complacency, and watch the security staff's own hydration and exhaustion.

Anything that happens goes into the log at the time, and that record becomes the security incident report.

05

After the event: egress, closeout and the debrief

The end of an event is a second peak. The credentialing guide says venues should take the same care over unauthorized entry after an event, while patrons are still present, as before and during it, keep adequate security and event staff on hand to manage large crowds leaving at once, and pay attention to people trying to enter or reenter. Exits, stairs and parking structures need the same attention on the way out as they had on the way in.

Then the closeout:

• Collect temporary credentials at the controlled access points, cross-check them against the record of those issued, and destroy or deactivate any that are expired or no longer valid.
• Log items surrendered to amnesty boxes; the bag search guide recommends it "so that the data can be used for improving venue management processes and procedures."
• Sweep the venue for people, unattended bags and lost property.
• Lock and check back-of-house doors, loading docks, rooftops and mechanical rooms again, and clear temporary barriers from exit routes.
• Complete incident reports and the event's daily activity report while the details are fresh.

Within a few days, hold a short debrief with the security company, the facility team and, for a large event, the police and fire marshal: which posts were short, where the lines backed up, and what the incident log shows. CISA's workbook says plans should be reviewed on a recurring basis and after a major incident, changes in key personnel or facilities, changes in the threat environment, and exercises, which it recommends at least annually.

Keep the plan, post orders, staffing list, walk-through record, incident log and debrief notes for each event together, so that if the police or an insurer later ask what was planned and what was done, the answer is on paper.

06

Where the event record fails, and where SiteClara fits

Event security plans rarely fail on paper. They fail between the plan and the night. The walk-through sheet is signed by a supervisor who walked half of it; the exit behind the stage was clear at 5 p.m. and blocked by equipment cases by 8. When something goes wrong, the questions are when that door was last checked, by whom, and what they found, and a clipboard in the command post rarely answers them.

SiteClara is built for that routine. A printed QR poster, with an optional NFC tag behind it, goes at each place the plan names: the exits, the search lanes, the loading dock, the parking structure levels, the first aid point, the mechanical room door. The officer or supervisor scans the code or taps the tag on their own phone, with no app to install, sees the checks due at that point, such as exit clear, door opens and closes, barrier in place and anchored or AED present, status light green, and marks them done or says what stopped them. The time and the named person are recorded as it happens, with a photo when one is asked for. Something found wrong on the round, a blocked exit or a missing sign, is reported there and goes onto the team's list of jobs until someone closes it.

The security supervisor or facility manager sees what was due, done and missed, with the reason where one was given, and a job that needs the building manager can be escalated to them to answer. The day after the event, the supervisor reviews the checks and photos, adds a note and approves a report that goes to nominated management or client contacts at 8 a.m. the next morning, showing how the scheduled checks went and what is still open. That gives the debrief a record made at the time.

07

Questions people ask

How do you plan security for an event?

You plan security for an event by connecting with local authorities, writing a plan that identifies issues and supports incident response, training staff and volunteers, and reporting concerns to emergency authorities; CISA's Securing Public Gatherings page says that with those steps "many incidents may be mitigated or avoided." A practical way to start is CISA's Mass Gathering Security Planning Tool, which gives event planners "a framework to begin or continue planning efforts for a mass gathering or special event" and produces a report the planning team, law enforcement and first responders can work from.

What should an event security plan include?

An event security plan should include the risk assessment, the security measures for each layer from the street to the stage, the posts and duties of security personnel, communication protocols, and the emergency procedures. Where an OSHA standard requires an emergency action plan, 29 CFR 1910.38, emergency action plans, sets the minimum the event plan must fit inside: procedures for reporting a fire or other emergency, evacuation procedures and exit route assignments, procedures for employees who stay to operate critical operations before they evacuate, a way to account for everyone after an evacuation, rescue and medical duties, and who to contact about the plan.

Is there a free event security plan template?

Yes: CISA's Security Planning Workbook (September 2023) is a free PDF with "fillable fields to guide a stakeholder's planning efforts," designed to help owners and operators develop "a foundational security plan" and to be "flexible and scalable to suit the needs of most facilities." For a specific event, the Mass Gathering Security Planning Tool is also free and produces a report that is downloaded by the user and not submitted to CISA.

Is an event security plan required by law?

No single federal law requires an event security plan, but the event must still meet the duties that apply to every workplace. 29 CFR 1910.37, exit routes, says "Exit routes must be free and unobstructed," and under 29 CFR 1910.38, emergency action plans, an employer must have an emergency action plan whenever an OSHA standard requires one, in writing and available to employees for review, although an employer with 10 or fewer employees may communicate it orally. The local fire code and the fire marshal decide permits, occupant load and crowd managers.

08

Where to read the official guidance, and a short list to take away

The primary sources, all free to read:

• CISA, Securing Public Gatherings.
• CISA Mass Gathering Security Planning Tool (revised May 2024).
• CISA Security Planning Workbook (September 2023).
• CISA Public Venue Bag Search Procedures Guide (July 2026).
• CISA Public Venue Credentialing Guide (July 2026).
• CISA Vehicle Ramming Action Guide (March 2025).
• OSHA, Crowd Management Safety Guidelines for Retailers.
• 29 CFR 1910.37, exit routes, and 29 CFR 1910.38, emergency action plans, or your state plan's equivalent.

The other sources are local: the fire marshal for the fire code as your jurisdiction has adopted it, the police department for the event itself, and your state's security licensing board for the officers you hire.

A short list to take away:

• Name one decision maker, with alternates, and share the plan with police and fire before the day.
• Write post orders for every post, and brief and train the staff before every event.
• Search every bag the same way however long the line, and collect and cross-check credentials afterward.
• Keep every exit route unlocked, unobstructed and marked until the last person is out.
• Walk the site before doors open and again at close, checking each point where it is, and keep a record that shows it was done.
• Log incidents as they happen, debrief within a few days, and update the plan.