Security post orders: what they should say, and how to know they are followed

01

What security post orders are, and where the rules mention them

Post orders are the site-specific written instructions for a security post. A post is a position an officer staffs: a lobby desk, a guard shack at a truck gate, a roving patrol, a control room. The post orders for it say when it is staffed, what the officer does there, the rounds they walk, how they handle access, alarms and emergencies, what they report and to whom. In the United States the trade term is post orders.

No federal law requires a private property to have post orders, and OSHA has no post orders standard. They are a contract and management document: the client's requirements and the security company's procedures turned into instructions an officer can follow on a Tuesday night with nobody to ask. But state training rules take it for granted that they exist, and several name them:

• California. The Bureau of Security and Investigative Services lists Post Orders & Assignments, up to four hours, among the elective courses in its BSIS security guard training requirements, covering site-specific training, equipment, emergency response issues, liability implications and lost and found articles.
• Washington. Under RCW 18.170.105, licensed guards complete at least four hours of annual refresher training, and no more than one hour of it may focus on customer service; the remaining three hours "must focus on emergency response concepts, skills, or topics including but not limited to knowledge of site post orders or life safety."
• New York. The Department of State's security guard training requirements include a 16-hour on-the-job training course, completed within 90 days of employment, described as "a course relevant to the duties of guards, requirements of the work site, and the needs of the employer." The requirements of the work site are, in practice, the post orders.

Federal buildings show the same idea at scale. In GAO-10-341, its April 2010 report on the Federal Protective Service's contract guard program, the Government Accountability Office describes FPS post orders as describing "a number of things that guards are prohibited from doing while on post," and post desk books as "the complete operational reference book provided for each contract security guard post," with information "ranging from the facility occupants and points of contact to procedures on how to respond to HAZMAT incidents." Contract guards there must be familiar with the desk book before standing post.

02

What post orders should include

Every site is different, but complete post orders usually cover:

• The site: the address, a short description of the property and its use, and a site plan marking entrances, emergency exits, stairwells, the fire alarm control panel, sprinkler risers, utility shutoffs, AEDs and first aid kits, and assembly points.
• Contacts: the client's property manager or facility manager, the building engineer, the security company's dispatch or control center, the account manager and field supervisor, and the after-hours escalation list, with who to call first.
• Each post and its hours: when it is staffed, uniform and equipment, whether it is armed or unarmed, break relief, and what happens if the relief officer does not arrive.
• Duties at the post, in the order they happen: opening and lock-up, lobby and front desk work, deliveries, mailroom, parking and loading dock control.
• Patrol rounds: the route, the checkpoints, the times or frequency, and what to check at each point, such as exit doors latched, lights working, no water on the floor, roof hatch secured.
• Access control: badges and credentials, visitors, vendors and contractors, after-hours entry, who may be admitted and how to verify them, and how to refuse politely.
• Key and access card control: which keys are held, the key log, who may sign keys out, and what to do when one is missing.
• Security systems: CCTV, intrusion alarms, access control and, where the post includes it, the fire alarm panel, with the action to take on each kind of alarm, trouble or supervisory signal.
• Emergency procedures: fire, medical emergencies, severe weather, power outages, elevator entrapments, bomb threats and suspicious packages, and an active threat, each matched to the building's emergency action plan.
• Use of force and detention: what the company allows, which is often stricter than state law, and when to observe, report and call 911 instead.
• Reporting: the daily activity report (DAR), incident reports, the pass-down log, and when the supervisor or client must be called rather than written to.
• Conduct: uniform, carrying the state guard card or license where the state requires it, phone use, visitors at the post, and anything the officer must never do on post.
• Safety: hazards on the site, lone work check-ins, personal protective equipment, and heat or cold where the post is outdoors.
• Version control: the date, the version, the client's approval and an acknowledgment page each officer signs.

Most companies separate these into general orders, which apply to every post on the site (conduct, reporting, emergencies), and special orders for one post (the loading dock gate, the overnight roving patrol). Short-lived changes, such as a contractor working in the building for a week or a door out of service, go in a dated temporary order with an end date, rather than an edit to the whole binder.

03

Writing post orders officers will actually use

The test is simple: could a trained officer who has never been to this property run the post properly after reading the orders? Most binders in a guard shack fail it, usually for the same reasons.

• Be specific. "Patrol the building regularly" tells an officer nothing. "Roving patrol, checkpoints 1 to 10, at 10 p.m., 1 a.m. and 4 a.m., checking every ground floor exit door is closed and latched" does.
• Write actions, in order. For each alarm, incident or emergency, list the steps and who to call, first to last. An officer at 3 a.m. with a panel sounding needs a one-page procedure, not a chapter.
• Mark the site plan. Draw the patrol route, the checkpoints and the exits on it.
• Keep the contacts current. A wrong number on the escalation list costs the minutes that matter most.
• Never write in a hazard. Security never outranks egress. Under OSHA's exit route standard, 29 CFR 1910.36, "employees must be able to open an exit route door from the inside at all times without keys, tools, or special knowledge." Post orders that tell an officer to chain or padlock an exit while people are inside are wrong, whatever the theft problem. (In the states with OSHA-approved State Plans, 22 of which cover private employers, the state's own rule applies, and the local fire code adds its own.)

Post orders should match the building's other plans, not compete with them. Where an OSHA standard requires an emergency action plan, 29 CFR 1910.38 requires it to include procedures for reporting a fire or other emergency, for evacuation and exit route assignments, and to account for all employees after evacuation. The officer's part in that plan, such as meeting the fire department at the fire command center or sweeping a floor, belongs in the post orders in the same words.

In California, most employers must now keep a written workplace violence prevention plan under Labor Code section 6401.9, operative since July 1, 2024. Among its required contents is "how to obtain help from staff assigned to respond to workplace violence emergencies, if any, security personnel, if any, and law enforcement." Where the officer is that help, the post orders should say what they do, and the two documents should agree. Federal OSHA's workplace violence page notes that "there are currently no specific OSHA standards for workplace violence," so outside such state laws the officer's role comes from the client's own policy.

04

Approving, signing and reviewing post orders

The security company writes the post orders, but they describe the client's property and the client's requirements, so the client approves them. A sound cycle looks like this:

1. Draft at startup, after a site walk and the client's security assessment, alongside the scope of work in the security services contract.
2. Agree with the client, and record who approved which version and when.
3. Train every officer on them before their first shift at the post, including relief, fill-in and supervisory officers, and have each sign an acknowledgment that they have read and understood them. In New York, that site training fits within the required 16-hour on-the-job course. In California it can count toward the elective training hours, and in Washington toward the annual refresher.
4. Keep them at the post, on paper or on a device, where the officer can reach them at any time, with the current version plainly marked and old versions removed.
5. Review and re-sign whenever something changes.

No statute sets an expiration date for private post orders. Review them whenever the property, its tenants, its risks or the client's requirements change: after an incident, a new access control system, a change of hours or use, a new tenant with its own needs, or a change in the building's emergency action plan. OSHA's rule for the emergency action plan is a useful model: under 29 CFR 1910.38(f) the employer reviews the plan with each covered employee when the plan is developed or the employee is first assigned, when the employee's responsibilities under it change, and when the plan changes. Apply the same three triggers to post orders, and add a fixed review date, such as once a year.

Each time the orders change, officers sign again for the new version, and the old one comes out of the binder. Ask the officers at every review, too: they know the door the route skips and the number nobody answers.

05

How to check the post orders are being followed

Post orders are only as good as the checking behind them. The Federal Protective Service's experience is a caution. In GAO-10-341, GAO found that "FPS continues to find instances where guards are not complying with post orders" and that "FPS has limited assurance that its 15,000 guards are complying with post orders." FPS required two guard inspections a week at level IV facilities, but GAO found that guard inspections were rarely done at facilities outside metropolitan areas, where some guards had not been inspected in over a year. It recommended a way to monitor those guards routinely. Fifteen years later GAO was reporting on the same program again, in GAO-25-108085 (March 2025), Federal Protective Service: Actions Needed to Address Critical Guard Oversight and Information System Problems.

A private property faces the same problem with fewer resources. The usual checks are:

• Post inspections, announced and unannounced, on every shift including nights and weekends. Ask the officer what they would do if a particular alarm went off, where the nearest exit is, or who the after-hours contact is. The answer should match the orders.
• Record review: compare the daily activity reports, the pass-down log and the patrol record with the rounds and times the post orders set.
• Acknowledgment pages: check that every officer who has worked the post since the last version signed it.
• Incident reviews: after any incident, ask whether the procedure was followed, and whether it was the right procedure.

Where the record and the orders disagree, one of them has to change. A round that never happens at the time the orders set may mean the officer is not following them, or that the times cannot be kept alongside the other duties at the post. Either way, that conversation is better had by the supervisor than discovered by the client.

06

Where post orders fail in practice, and where SiteClara fits

The post orders say the roving patrol covers ten checkpoints three times a night. The daily activity report says "patrols completed, all secure." Nobody can tell from that line which checkpoints were visited, when, or whether the exit door at the back of the parking garage was checked at all. The orders are clear; the evidence that they were followed is not.

SiteClara turns the rounds in the post orders into a record. A printed QR poster, with an optional NFC tag behind it, goes at each checkpoint the orders name. The officer scans the code or taps the tag on their own phone, with no app to install, sees the checks due at that point and marks them done, or says what stopped them, such as a locked door. The time and the named officer are recorded as it happens, with a photo when one helps. A problem found on the round is reported there and goes onto the team's list of jobs until someone closes it.

The security supervisor sees what was due, done and missed, with the reason where one was given, and a job that needs the building manager can be escalated to them to answer. Each day the supervisor reviews the totals and photos, adds a note and approves a report that goes to nominated management or client contacts at 8 a.m. the next morning, showing how the scheduled checks went, for example 30 of 30 completed, and what is still open.

07

Questions people ask

What are the post orders?

They are the written instructions for one security post: what the officer does there, when, and what they are not allowed to do. In federal buildings, the Government Accountability Office's GAO-10-341 report on the Federal Protective Service's contract guard program says FPS post orders "describe a number of things that guards are prohibited from doing while on post," and that the post desk book is "the complete operational reference book provided for each contract security guard post," which all contract guards are contractually required to be familiar with before standing post.

What are post orders for security guards?

For a guard, post orders are the site training for the job in front of them. California's Bureau of Security and Investigative Services lists Post Orders & Assignments, up to four hours, as an elective course in its BSIS security guard training requirements, covering site-specific training, equipment such as monitoring, communication, alarms and elevators, emergency response issues, liability implications and lost and found articles. In Washington, RCW 18.170.105 names knowledge of site post orders among the topics for the three hours of annual refresher training that must focus on emergency response.

08

Further reading, and a list to take away

Each state's licensing board publishes its own training rules; California's BSIS, New York's Department of State and Washington's RCW 18.170 show how site training fits into them. OSHA publishes the exit route and emergency action plan standards, its workplace violence guidance and the list of State Plans. GAO's reports on the Federal Protective Service are the most detailed public account of checking post orders at scale. ASIS International publishes the Private Security Officer Selection and Training Guideline (ASIS PSO-2019), a paid document for companies setting up an officer selection and training program.

Before an officer's next shift at a post, check that the post orders:

• are written for this property and this post, not copied from another site;
• set out the hours, duties, patrol rounds, checkpoints and times;
• give the steps to take and who to call for each alarm, incident and emergency;
• match the building's emergency action plan and, in California, its workplace violence prevention plan;
• never tell an officer to lock or block an exit route;
• have a current contact and after-hours escalation list;
• are approved by the client, with the version and date recorded;
• have been read and signed by every officer who works the post, relief officers included;
• are kept at the post, with old versions removed;
• have a date for their next review, and a supervisor who checks the work against them.