School security checklist: what to check at a K-12 school, when, and by whom

01

What a school security checklist is, and where the guidance comes from

No single federal law sets out a school security checklist. What exists is federal guidance that most districts and states build on, state laws and education department rules that vary widely, and the fire and building codes the local authority enforces. A checklist is the working end of all of that: the short list of things that must be true at this campus, every day, for the security plan to work.

The main federal reference is the Cybersecurity and Infrastructure Security Agency's K-12 School Security Guide, 3rd edition (2022). CISA describes it as "a comprehensive doctrine and systems-based methodology to support schools in conducting vulnerability assessments and planning to implement layered physical security elements across K–12 districts and campuses." It is written for local education agencies, and it works alongside the free, web-based School Security Assessment Tool (SSAT).

The SSAT divides a campus into four layers: the school perimeter, the school grounds, the building perimeter and the building interior. At each layer it looks at five kinds of measure: equipment and technology; site and building design features; school security personnel; policies and procedures; and training, exercises and drills. Its reasoning is that "outer layers of security (at the grounds perimeter or on the school grounds) can support protections inside the school by detecting or delaying threats." A good daily checklist follows the same layers, so each item can be traced back to the assessment that asked for it.

The federal site SchoolSafety.gov, run jointly by the Departments of Education, Justice, Homeland Security, and Health and Human Services, defines physical security on its targeted violence page as "the protection of a school, school district, or school campus from threats that could cause loss or damage," and cautions that its measures should not impede the educational mission or the school climate. The same site says that "conducting a site assessment can help school leaders and personnel identify vulnerabilities, integrate future security practices, and inform the development of building security plans," which is why the checklist should come after the assessment, not before it.

02

What the checklist covers, layer by layer

The items below follow the SSAT's four layers. A one-building elementary school and a high school with portables and a stadium need different lists, so start from what your site assessment found and cut anything that does not apply.

School perimeter, the edge of the property:

• perimeter fencing intact, with no new gaps, climbable stacks or damaged sections;
• vehicle and pedestrian gates open or closed to the schedule, and locked outside it;
• signage directing visitors to the main entrance, and any posted rules still in place;
• bus loop, drop-off lane and fire lanes clear, with any barriers or bollards in position.

School grounds, between the fence and the building:

• exterior lighting working on walkways, parking lots and building entrances;
• clear sight lines from the office and cameras, with shrubs and trees trimmed back;
• portable classrooms, sheds and equipment storage locked;
• playground, athletic fields and bleachers checked for anything left behind or out of place;
• no ladders, dumpsters or pallets left where they give access to a roof or window.

Building perimeter, the outside walls and every way in:

• every exterior door closed, latched and locked unless it is the designated entrance, with no props, tape over latches or wedges;
• exterior doors numbered on the outside and inside, so a fault or an emergency can be pinned to one door;
• the main entrance and any secure vestibule working as designed: intercom, camera, door release and the visitor sign-in routine;
• card readers and electronic locks responding, and door-held-open alarms reporting;
• ground-floor windows closed and locked where they should be, and roof hatches secured.

Building interior:

• classroom and office doors able to be locked from inside the room, with the lock working and the key or thumb-turn where staff expect it;
• unused rooms, mechanical rooms, custodial closets and roof access locked;
• the public address system, intercom and two-way radios working, with radios charged;
• exit routes and exit doors clear and openable from the inside;
• emergency supplies, such as go-kits and classroom rosters, where the plan says they are.

Locking and exiting pull in opposite directions, and the fire code decides where the line is. The fire code your state or city has adopted, often based on NFPA 101, Life Safety Code, sets the rules for how doors on an exit route may be locked. For private-sector employers, OSHA's exit route rule, 29 CFR 1910.36, says "Employees must be able to open an exit route door from the inside at all times without keys, tools, or special knowledge." A checklist should never ask anyone to chain or padlock an exit, and add-on barricade devices bought after the fact can conflict with the code. Ask the fire marshal, the authority having jurisdiction, before fitting one.

03

How often: the day, the week and the year

Security checks fall into a rhythm that follows the school day. The split below is a practical starting point rather than a legal requirement; where your state sets a frequency, that frequency wins.

Opening, before students arrive. The custodian or first administrator in walks the building perimeter: alarm disarmed and any overnight alarm events noted, exterior doors checked, gates opened to the schedule, the main entrance tested, lights on in the parking lot until daylight, anything found overnight such as graffiti, broken glass or a forced door reported before the buses come.

During the day. The risk shifts from locked doors to propped ones. Staff on hall, recess and lunch duty, and the school resource officer or security officer on a round, look for doors held open, visitors who did not come through the office, and gates left open after a delivery. A short check after arrival, after lunch and before dismissal catches most of it.

Dismissal and close-up. After-school programs, practices and evening events keep some doors in use, which is when a door is most often left unlocked overnight. The evening custodian or the last administrator out checks every exterior door, the portables, roof access and gates, then sets the alarm. If the building is in use, the close-up check happens when the last event ends, not at the end of the regular day.

Weekly. Walk the cameras and confirm each one shows a usable picture of what it is meant to cover; test the intercom and the door release at the visitor entrance; check exterior lighting after dark; test radios on every channel the plan uses; confirm that door-held-open and forced-door reports on the access control system are being read.

Before breaks and summer. Walk the whole building before a long closure and again before reopening, because contractors, summer programs and construction leave doors, hatches and fences in states nobody planned.

Every year. Repeat the site assessment, using the SSAT or your state's own tool, and update the checklist to match. A new portable, entrance or access control system changes the list too.

04

Who does what

School security is a team job, and a checklist works best when each item has one named owner. A typical split in a public school district looks like this:

• The principal or building administrator owns the campus checklist, makes sure each check is assigned and covered when someone is absent, and deals with what is found.
• Custodians and the head custodian do most of the opening and closing checks, because they are first in and last out, and they report faults with doors, locks, lights and fences through the district's work order system.
• The school resource officer or campus security officer, where there is one, walks the grounds and building during the day, checks visitor entry, and brings a law enforcement or security view to what the checklist should include.
• Teachers and staff keep their own classroom doors lockable, know where the key or thumb-turn is, and report a door that will not lock the day they find it.
• Front office staff run the visitor entrance: who is buzzed in, how visitors sign in and badge, and what happens when someone refuses.
• The district's facilities and maintenance department repairs what is reported and maintains the cameras, locks, access control and alarms, often through contractors.
• The district safety or security coordinator sets the standard checklist, reviews the records across schools, and ties the checklist to the emergency operations plan.

Where contract security or an outsourced custodial provider does some of these checks, their post orders or scope of work should list the same items at the same frequencies.

The checklist is one part of school safety, not the whole of it. The emergency operations plan, which SchoolSafety.gov's emergency planning page describes as setting out "the actions students, teachers, and school staff should take before, during, and after emergency events," is written by a planning team with community partners. Behavioral threat assessment, the approach the U.S. Secret Service's National Threat Assessment Center has researched for K-12 schools, deals with people of concern rather than doors and fences. Locks and cameras support both, but neither replaces them.

05

What a good record looks like, and how it is checked

A checklist that is never looked at again is a to-do list. The record matters because it is what the principal, the district and, after an incident, investigators, insurers and parents will ask for. For each check, a useful record shows:

• Which door, gate or area was checked, using the same numbering as the building's door schedule and emergency plan;
• When, to the minute, not "a.m." or "p.m.";
• Who did it, by name;
• The result: secure, or what was wrong;
• What happened next: fixed on the spot, reported as a work order, or escalated, and when it was put right.

Look for patterns, not just gaps. The same door found propped every afternoon is telling you how the building is used: a gym door propped for athletics, a kitchen door for deliveries. The fix may be a schedule, a doorbell or an alarm, and it will not be found if the checklist only ever records "OK."

Check the checks. An administrator or the district safety coordinator should now and then walk the building unannounced and try the doors the record says are locked. Review the record after every drill and incident. Where a contractor does the checks, the district should see the same record the contractor's supervisor sees.

Handle the record with care. A list of every door, camera blind spot and weak point is useful to anyone planning harm, so keep it to the people who need it, and follow your district's records policy on what is released.

06

Where school security checks fail, and where SiteClara fits

The paper school security checklist has the same weakness everywhere. It is filled in at the end of the day, and nobody can tell whether the gym door was tried at 4 p.m. or ticked at 4 p.m. from the office. A door found propped is written on the sheet and stays there, and the district sees it only after something has gone wrong.

SiteClara records the checks where they happen. A printed QR poster, with an optional NFC tag behind it, goes at each checkpoint: the main entrance, the gym doors, the kitchen dock, the portables, the roof access, the bus loop gate. Whoever does the check, whether a custodian, an administrator or a security officer, scans the code or taps the tag on their own phone, with no app to install, sees the checks due there, such as "door closed and latched" or "gate locked," and marks each one done or says what stopped them. The time and the named person are recorded as it happens, with a photo when one is asked for. A problem found, such as a lock that will not engage or a fence panel down, is reported there and goes onto the team's list of jobs until someone closes it, and a supervisor can escalate it to the building's management to answer.

The supervisor sees what was due, done and missed, and records the reason a check was missed. Each day they review the checks and photos, add a note and approve a report that goes to nominated managers at 8 a.m. the next morning, showing what was reported, what is still open and how the scheduled checks went.

07

Questions people ask

What type of security is most needed for schools?

Federal guidance does not name one measure above the rest. CISA's K-12 School Security Guide focuses on vulnerability assessments and "layered physical security elements," and SchoolSafety.gov treats "physical security as part of the broader school safety and security enterprise, with measures that support prevention, response, and recovery efforts." What a campus needs most is whatever its own site assessment finds weakest.

What is the CISA School Security Assessment Tool?

The School Security Assessment Tool (SSAT) is CISA's web-based tool that helps K-12 schools analyze the physical security measures they have across the school perimeter, school grounds, building perimeter and building interior. It explains the reasoning for its results and lists improvement options a school could pursue. CISA says the data you enter "stays on your local device" and that it "will not collect, process, or store any of your information to operate the SSAT."

What is a school security risk assessment?

It is a structured look at a campus to find its vulnerabilities before deciding what to change. SchoolSafety.gov says a site assessment "can help school leaders and personnel identify vulnerabilities, integrate future security practices, and inform the development of building security plans," and points to the SSAT as "a web-based assessment that walks users through a tailorable vulnerability analysis and provides results and recommendations." The daily checklist then keeps the measures the assessment chose in working order.

08

Further reading, and a list to take away

CISA publishes the K-12 School Security Guide (3rd edition, 2022), the free School Security Assessment Tool, and the K-12 School Security Guide Companion Product for School Business Officials (2024), which helps business officials take part in security planning and make informed decisions about security spending. SchoolSafety.gov's targeted violence page has a section on physical security and site assessments, and its emergency planning page points to the federal Guide for Developing High-Quality School Emergency Operations Plans. For exits and locking, read the fire code your jurisdiction has adopted, often based on NFPA 101, and talk to the fire marshal. Your state education department or school safety center will tell you what your state requires.

Before you rely on a school security checklist, check that:

• it follows the layers of your site assessment: perimeter, grounds, building perimeter and interior;
• it includes every item and frequency your state requires;
• every exterior door is numbered and on the list by number;
• opening, daytime, close-up, weekly and annual checks each have a named owner and cover when they are away;
• evening events and after-school programs have their own close-up check;
• nothing on it asks anyone to lock an exit in a way the fire code does not allow;
• each check records the time, the person and the result, not just a tick;
• faults become work orders with a date they were fixed;
• someone tries the doors now and then to check the record;
• the list is reviewed every year and after any change to the building.