Hotel security: what it covers, the rules behind it, and the records that show it

01

What hotel security covers, and the rules behind it

Hotel security protects guests, visitors, staff and property in a building that never closes, where strangers sleep behind doors that staff hold keys to. A large hotel or resort may run its own security department under a director of security; a smaller one may contract officers from a guard company, or rely on the front desk and the night auditor with no officer on site. No single law sets out what hotel security must do. The duties come from several layers.

The first is state law. A hotel's liability to guests is mostly each state's premises liability and innkeeper law, much of it case law, and what counts as reasonable care depends on what was foreseeable at that property. Under California Civil Code section 1714, for example, everyone is responsible for an injury caused by "want of ordinary care or skill in the management of his or her property or person." Innkeeper statutes shape the routine too: New York General Business Law section 200 limits a hotel's liability for guests' valuables when it provides a safe and posts a notice saying so, capped at $1,500 for property deposited unless agreed otherwise in writing.

The second is the employer's duty to its workers. Federal OSHA has no specific workplace violence standard; its workplace violence topic page says so and lists risk factors that describe a hotel at night: "exchanging money with the public," "working alone or in isolated areas," "working where alcohol is served," and "working late at night or in areas with high crime rates." Section 5(a)(1) of the Occupational Safety and Health Act, the General Duty Clause, still requires every employer to furnish a workplace "free from recognized hazards that are causing or are likely to cause death or serious physical harm." Some states run OSHA-approved State Plans, which must be "at least as effective as OSHA," and some set stricter rules.

The third layer is hotel-specific law, so far city and state law. New York City's is the most detailed. Under Local Law 104 of 2024, often called the Safe Hotels Act, every hotel operator in the city has needed a license from the Department of Consumer and Worker Protection (DCWP) since May 3, 2025. DCWP's Hotel Licensing Law Frequently Asked Questions summarizes Administrative Code section 20-565.4: an operator must "schedule at least one employee to provide continuous front desk coverage," able to confirm the identity of guests checking in; overnight, a security guard who can assist guests and has had human trafficking recognition training may stand in; and an operator of a hotel with more than 400 guest rooms "must schedule at least one security guard to provide continuous coverage while any guest room is occupied." Section 20-565.6 requires panic buttons, at no cost, for core employees whose duties involve entering occupied guest rooms. Security employees are not core employees, so the law's direct employment rule does not stop a hotel contracting its security.

Elsewhere, Washington's RCW 49.60.515 requires hotels, motels and security guard companies that employ an "isolated employee" (a janitor, security guard, hotel or motel housekeeper or room service attendant who works where coworkers or supervisors cannot respond at once to an emergency without being summoned, or who spends at least half their working hours with no supervisor or coworker present) to provide each one with a panic button and to train managers and supervisors on "the responsibility to respond to the use of panic buttons." New York General Business Law section 205 requires lodging facilities to give human trafficking recognition training to employees "likely to interact or come into contact with guests," new hires within 60 days. Rules differ by state and city, so check the hotel's own.

Industry practice is the fourth layer. The American Hotel & Lodging Association's 5-Star Promise, announced in September 2018, is a voluntary commitment by member companies to "enhance policies, training, and resources, including employee safety devices."

02

What hotel security officers do

The written post orders for each post set the detail. Across most hotels, hotel security officer duties fall into the same groups:

• Patrols of guest floors, stairwells and exits, the pool and fitness center, parking, event space, back of house and the loading dock.
• Access control: who goes beyond the lobby, guest-only elevator access after hours, the staff entrance, contractors and deliveries, and asking people with no business there to leave, with a trespass notice where used.
• Key control: master and emergency keys, access to the key card encoder, and lost keys.
• Responding to panic buttons, disturbance complaints, intoxicated or aggressive guests, alarms and medical emergencies.
• Welfare checks and room entries with a manager, under a written policy.
• Guest property: the lost and found log and support for the front desk's safe deposit boxes.
• Equipment checks: security camera checks, exit door alarms, panic buttons, lighting and the electronic lock systems.
• Reporting: the daily activity report, incident reports and the pass-down log.

Hotel security is also a hospitality role. Officers greet guests, give directions, help with late check-ins and handle complaints, so most hotels expect the same customer service from them as from the front desk team, and a professional, friendly manner often settles a problem before it becomes an incident.

People often ask for the three types of hotel security. No law or standard sorts it that way, but the grouping usually meant is physical security (officers, patrols, locks, surveillance cameras, lighting), operational security (key control, identity at check-in, cash handling, emergency procedures, training) and information security (guest records and payment card data, usually handled by the IT team).

Where no officer is on site overnight, these duties fall to the front desk agent and the night auditor, often alone. Their post orders should say which duties they carry, which they do not, and who they call.

03

The hotel security patrol: where to go and what to check

No rule sets how often a hotel is patrolled. Set the frequency by risk (incident history, police calls, events, bar hours), write it into the post orders, and vary the timing so the round cannot be predicted. A hotel security checklist for a round usually covers:

• Guest floor corridors: no room door left open, lights working, trays and carts cleared, ice and vending areas lit, nobody going door to door.
• Stairwells and exits: routes clear, exit signs lit, exit door alarms armed, nobody sleeping or smoking there.
• Pool, spa and fitness center: closed at the posted time and empty after hours.
• Parking: lighting, vehicles broken into, people sitting in cars, the walk to the entrance.
• Back of house: linen rooms and storerooms secured, the loading dock clear and closed after deliveries.
• Meeting rooms after an event: cleared and locked.
• Roof and mechanical access: locked, with no sign of entry.

A round should leave behind the time each point was checked, by whom, and what was found, including "nothing found." A round recorded as one line at the end of the shift tells nobody whether the stairwells were walked at 1 a.m. or not at all. Checkpoints on the route, whether a guard tour system or a log at each point, make the gaps visible.

Problems found on the round, such as a light out in the garage or an exit door that does not close, should go to engineering as a work order the same shift and stay open until fixed.

04

Key control, panic buttons and guest incidents

Key control sits at the encoder and with the master keys, since most hotels use electronic locks. Issue a guest key only after identity is confirmed, never duplicate one for a caller at the desk without the same check, sign master and emergency keys out and back in by name and time, limit who can encode keys, and treat a lost master key as a security event: deactivate it and reprogram where needed. Most electronic locks keep an audit trail of entries that can be read after an incident. See the guide to key control.

Panic buttons are only as good as the response. Decide who receives an alert, how fast they must respond and who covers when they are busy; test the devices on a schedule (see panic button testing); and record every activation, the response time and the outcome. DCWP's FAQ lists proof of the purchase, upkeep and distribution of panic buttons among the records a New York City hotel keeps.

Room entries need a written policy: when staff enter a room whose guest does not answer, who goes (two people, one a manager or security), and when they call emergency services. Write up every entry, even when nothing is wrong.

Removing a guest follows state innkeeper law and the hotel's policy. Florida Statutes section 509.141 (2025), for example, lets an operator remove a guest who is "intoxicated, profane, lewd, or brawling," or who disturbs other guests, and call a law enforcement officer if the guest stays after being asked to leave. Any force used should be written up in a use of force report.

Human trafficking recognition training under New York's section 205 covers the nature of trafficking, how to identify victims and the national human trafficking hotline. Officers and front desk staff should know who they report a concern to.

05

The hotel security plan, and the records that show it works

A hotel security plan is the written document that ties posts, patrols and procedures together. There is no federal format. A workable plan covers:

• a risk assessment: incident history, police calls, events, and where and when problems cluster;
• posts and staffing by hour, including who carries security duties when no officer is on site;
• patrol routes, checkpoints and frequencies;
• key control, panic button response, room entry and guest removal procedures;
• emergency procedures for fire alarms, evacuations, medical calls and threats;
• incident reporting and escalation;
• training and licensing for each role, and the state and city requirements;
• how and when the plan is reviewed.

The records show the plan is followed: the daily activity report; incident reports written the same shift; patrol and checkpoint records; key sign-out logs; panic button tests and activations; equipment checks; and training records. Some have retention rules. New York's section 205 requires proof of trafficking training to be kept while the employee works there and for one year after. Washington's RCW 49.60.515 requires documented completion of its training. DCWP's FAQ says New York City hotels must maintain the records showing compliance with the staffing and safety rules electronically for at least three years.

Officers need the license their state requires. In New York, General Business Law section 89-n sets "an eight hour pre-assignment training course," 16 to 40 hours of on-the-job training within 90 working days, and "an eight hour annual in-service training course." The BLS profile of security guards lists communication and interpersonal skills among their important qualities, including the ability to "handle and deescalate confrontational situations," which hotel security jobs call for every shift.

Supervisors read the reports every shift, walk the routes themselves at different times, and compare the records with what they find: an exit door recorded as checked at 3 a.m. and found propped open at 3:20 a.m. is a conversation worth having. Once a year, or after a serious incident, the plan is reviewed against the incident data.

06

Where the record fails, and where SiteClara fits

Serious incidents are usually written up, because someone was hurt or the police came. The record thins out in the routine work meant to prevent them: the stairwell walk at 2 a.m., the check that the pool is empty after closing, the loading dock after deliveries. That work is often one line on the daily activity report, written at the end of the shift: "rounds completed, all secure." Nobody can tell when each area was checked, a missed round is rarely recorded as missed, and a broken exit door noted on the report may never reach engineering.

SiteClara records those checks at the location. A printed QR code poster, with an optional NFC tag behind it, goes at each checkpoint on the round: a stairwell landing, the pool, a parking level, the loading dock. The officer, or the front desk agent doing the round overnight, scans the code or taps the tag on their own phone, with no app to install, sees the checks due there, and marks each one done or says what stopped them. The time and the named person are recorded as it happens, with a photo when one is asked for. A problem found on the round, such as an exit door that does not close, goes onto the team's list of jobs until someone closes it.

The security supervisor sees what is due, done and missed, and records the reason when a check was missed. Each day they review the totals and photos, add a note and approve a report that goes the next morning to nominated managers, such as the general manager or, for a contracted service, the hotel's contact. It shows what was reported, completed and still open, and how the scheduled checks went.

07

Questions people ask

Do hotels have to have security guards?

Not under federal law, but some cities require them. In New York City, a hotel with more than 400 guest rooms must schedule at least one security guard to provide continuous coverage while any guest room is occupied, and every hotel must schedule someone to cover the front desk continuously (overnight, a security guard who can assist guests and has had human trafficking recognition training may cover instead), according to DCWP's Hotel Licensing Law FAQ.

What qualifications do you need to be hotel security?

Usually a state security guard license. The Bureau of Labor Statistics Occupational Outlook Handbook profile of security guards says most states require licensing, with basic qualifications that include being at least 18, passing a background check and completing training, and stricter checks for armed guards. Hotels add their own training in key control, guest incidents and, in New York, human trafficking recognition.

08

Where to read more, and a list to take away

Start with OSHA's workplace violence topic page. In New York City, read DCWP's Hotel Licensing Law page and its FAQ. Elsewhere, check your State Plan, your state's innkeeper statute and security licensing board, and any city ordinance on hotel worker safety.

Before your next audit, brand inspection or contract review, check that:

• the front desk, or an officer overnight, is covered every hour, and post orders say who carries security duties when no officer is on site;
• patrol routes cover guest floors, stairwells, exits, the pool, parking and back of house, at times that vary;
• guest keys are issued only after identity is confirmed, and master keys are signed out and back in;
• panic buttons are issued to everyone who works alone in guest rooms, tested, and every activation is answered and recorded;
• officers and front desk staff hold the licenses and training your state and city require;
• routine rounds leave a record of when each area was checked and by whom, and missed ones are recorded as missed;
• problems found on a round reach engineering the same shift and stay open until fixed.