Warehouse security: the checks that protect the building, and the record that proves them

01

What warehouse security is, and which rules apply

A warehouse security program is the written plan, the physical protection and the routine checks that keep goods, trailers, equipment and information from unauthorized access, theft and tampering. In a distribution center it usually belongs to the site's general manager or a loss prevention or security manager, with in-house officers or officers from a contract security services company running the gate, the patrols and the security desk, and shift supervisors and dock leads doing their part on the floor.

No single federal law sets security requirements for an ordinary warehouse. What a site must do depends on what it stores, who its customers are, and which programs it has joined. Four sources come up again and again:

• CTPAT, for importers and the companies that handle their freight. U.S. Customs and Border Protection runs the Customs Trade Partnership Against Terrorism (CTPAT), a voluntary supply chain security program. A member commits to meet CBP's minimum security criteria for its business type. The CTPAT Minimum Security Criteria for Third Party Logistics Providers (October 2021) are the most detailed public description of warehouse security in the US, and they open the physical security section plainly: "All cargo handling and storage facilities, including trailer yards and offices must have physical barriers and/or deterrents that prevent unauthorized access."
• TAPA, for high-value and theft-targeted goods. The Transported Asset Protection Association publishes the TAPA Facility Security Requirements (FSR), which describe themselves as "the minimum industry requirements for secure warehousing, or in-transit storage, within a supply chain." There are three levels, A (elevated), B (moderate) and C (standard), certified by an independent audit body, with self-certification allowed at level C, as TAPA APAC's FSR page sets out. TAPA Americas says the 2026 FSR audit form will be available October 1, 2026.
• DEA, for controlled substances. A DEA registrant that stores controlled substances must follow 21 CFR 1301.71, which requires "effective controls and procedures to guard against theft and diversion of controlled substances," and the storage specifications in 21 CFR 1301.72. This is the one place federal law sets out safes, vaults, cages and alarms for a warehouse in detail.
• OSHA, which limits what security may do. Under the exit route standard, 29 CFR 1910.36, "Employees must be able to open an exit route door from the inside at all times without keys, tools, or special knowledge." Security decides who gets in; it must never decide who gets out.

Beyond those, requirements usually arrive by contract: a customer's security schedule, an insurer's conditions or a lease. Read them first, because they often set the frequencies the site is audited against.

02

What a warehouse security program covers

A program that works on a real distribution center starts from the site's own risks and covers the whole site, not only the building. It usually takes in:

• The perimeter and the yard: fencing or other barriers, gates for trucks and people, trailer parking, the guard shack, and the ground between. CTPAT's criteria say perimeter fencing "should enclose the areas around cargo handling and storage facilities" and "should be regularly inspected for integrity and damage by designated personnel," and that gates "must be manned or monitored."
• The building shell: dock doors and trailer restraints, personnel doors, roof hatches and skylights, and the emergency exits, alarmed but never locked against people inside.
• The dock and trailers: doors closed when no trailer is at them, loaded trailers sealed, empty trailers inspected, and cargo staged overnight protected. CTPAT says that when cargo is staged overnight or for an extended period, "measures must be taken to secure the cargo from unauthorized access."
• Secure areas inside: a high-value cage, a controlled substance vault, returns, the seal store, the IT room and the security equipment itself.
• Lighting: CTPAT requires "adequate lighting" inside and outside the facility, including, as appropriate, "entrances and exits, cargo handling and storage areas, fence lines, and parking areas."
• Security technology: intrusion alarms, access control, and video surveillance, with the recorders, panels and power behind them, and the footage and access data they keep.
• People and access: employee badges, visitor and vendor sign-in, driver identification, private vehicle parking kept away from the dock, keys and combinations, and what happens when someone leaves.
• Procedures and training: post orders for the officers, the opening and closing routine, protocols for reporting and investigating incidents, and awareness training for everyone on the floor.

03

The routine checks, shift by shift

Most warehouse security failures are not clever: a dock door left open after the last trailer, a gate propped for a late delivery, a camera knocked out of position, a light out over the yard. The frequencies below are common practice, not a federal rule; a customer contract, TAPA level or risk assessment may set its own.

1. Opening check: walk the building before the first shift, check the alarm log for overnight events, confirm every dock door, personnel door and roof hatch is secure, and look for signs of forced entry.
2. Gate and guard shack: at every truck arrival and departure, identify the driver and record the load. CTPAT requires drivers to be "positively identified before cargo is received or released" and a cargo pickup log, which should record the driver's name, arrival date and time, employer, truck and trailer numbers, departure time and seal number.
3. Dock walk: several times a shift, check that doors without a trailer are closed, that trailer restraints are engaged, that loaded trailers are sealed and staged cargo is where it should be.
4. Yard audit: at least once a shift, walk or drive the yard, check each trailer against the yard list, look at seals and doors on loaded trailers, and note anything parked where it should not be.
5. Fence line and lighting patrol: once a day and after dark, walk the fence for cuts, gaps, washouts under the fabric and anything stacked against it, and note every light that is out.
6. Secure areas: check the high-value cage, the vault and the seal store are locked at the times the program sets, and that the people inside them are on the access list.
7. Security technology: check cameras are recording, positioned and clean, and that alarms arm and report. CTPAT's criteria say a member relying on security technology must have written procedures to "test/inspect the technology on a regular basis," that inspection and test results are documented, and that corrective actions are taken "as soon as possible" and documented too.
8. Closing check: confirm every door is secure, the building is empty or accounted for, the alarm is set and the yard is locked, and pass down anything open to the next shift or the monitoring station.

Two checks sit on longer cycles. CTPAT requires periodic, random reviews of camera footage "to verify that cargo security procedures are being properly followed," with the results "summarized in writing" and kept for audit, and it suggests recording the date of the review, the date of the footage, the camera, the findings and any corrective action. CTPAT also requires security technology policies and procedures to be reviewed and updated annually, or more often as risk or circumstances dictate.

04

Who does what, including the risk from inside

Warehouse security works when each part has a named owner. On a typical site:

• The site or security manager owns the program, the risk assessment, the post orders and the relationships with the security contractor and the alarm company.
• Security officers run the gate, the patrols and the checks in the post orders. CTPAT says that if security guards are used, their work instructions "must be contained in written policies and procedures," and management "must periodically verify compliance and appropriateness with these procedures through audits and policy reviews."
• Shift supervisors and dock leads own the dock: doors closed, trailers sealed, staged cargo protected, and anything unusual reported.
• Maintenance maintains the fences, lighting, door hardware and dock equipment, and fixes what the patrols find.
• Human resources handles pre-employment screening where the law allows, and makes sure badges, keys and codes come back when someone leaves. CTPAT requires written procedures for how badges and access devices are "granted, changed, and removed," and suggests exit checklists.

Theft from a warehouse is often an inside job, or has inside help. The Cybersecurity and Infrastructure Security Agency defines an insider as "any person who has or had authorized access to or knowledge of an organization's resources, including personnel, facilities, information, equipment, networks, and systems," and its Insider Threat Mitigation page sets out four steps: define the threat, detect and identify concerning behavior, assess it, and manage it. On a warehouse floor that means a few practical controls: rotating yard and dock checks between people, reconciling seal and cargo logs against what was shipped, looking into unusual activity such as badge use at odd hours, and a way to raise a concern anonymously, which CTPAT recommends, with every report investigated.

05

What good evidence looks like, and how it is checked

A warehouse is audited from several directions: a CTPAT validation, a TAPA audit, a customer's visit, an insurer's survey after a loss, a DEA inspection. Each asks whether the checks in the program were actually done, when, and by whom.

Some records are required outright by the program or the regulation:

• CTPAT logs: the visitor log, which records the date, name, photo identification verified, arrival time, company point of contact and departure time; the cargo pickup log; the seal log recording receipt, issue and use of seals; the documented results of security technology inspections; and the written summaries of camera footage reviews.
• DEA theft reports: under 21 CFR 1301.74(c), a registrant must notify its DEA Field Division Office in writing "of any theft or significant loss of any controlled substances within one business day of discovery," and file DEA Form 106 within 45 calendar days.
• Access control for controlled substances: 21 CFR 1301.72 requires key locks on a Schedules III to V storage building to have "key control which limits access to a limited number of employees," and combinations to be limited to a minimum number of employees and able to be changed when an employee who knows one leaves.

Good evidence for the routine checks names the location, the time and the person; shows what was found, not only a tick; records a missed check as missed, with the reason; and links a problem found to the work that fixed it. A patrol record that says "all secure" at 2 a.m. every night for a month, in the same handwriting, tells an auditor very little.

06

Where the patrol record fails, and where SiteClara fits

The post orders say the fence line is walked every night and the dock doors are checked every two hours. The patrol log at the guard shack has a line for every round, filled in at the end of the shift. Nobody can tell from it whether the officer reached the far corner of the yard or when the dock was actually checked, and the light out by door 14 is still out three weeks later because the note never reached maintenance.

SiteClara records the checks at the place they happen. A printed QR poster, with an optional NFC tag behind it, goes at each checkpoint on the round: the dock office, the high-value cage, the far fence corner, the trailer yard, the roof access door. The officer scans the code or taps the tag on their own phone, with no app to install, sees the checks due there, such as "dock doors without trailers closed" or "fence line walked, no damage", and marks them done or says what stopped them. The time and the named person are recorded as it happens, with a photo when one is asked for. A problem found, such as a cut in the fence or a light out, is reported there and goes onto the team's list of jobs until someone closes it.

The security supervisor sees what was due, done and missed, with the reason where one was given, and can escalate a job such as a fence repair to the building's management to answer. Each day the supervisor reviews the totals and photos, adds a note and approves a report that goes to nominated management or client contacts at 8 a.m. the next morning, showing how the scheduled checks went, for example 11 of 12 yard audits completed, and what is still open.

07

Questions people ask

How much does a security guard get per hour?

The median wage for security guards in the United States was $18.29 per hour, or $38,020 a year, in May 2025, according to the Bureau of Labor Statistics' Occupational Outlook Handbook: Security Guards and Gambling Surveillance Officers. The lowest 10 percent earned less than $30,210 a year and the highest 10 percent more than $58,840. The same page notes that guards usually work shifts of about 8 hours on rotating schedules, and that night shifts are common.

What security guard gets paid the most?

Among the industries that employ the most security guards, the Bureau of Labor Statistics' Occupational Outlook Handbook: Security Guards and Gambling Surveillance Officers shows healthcare and social assistance paying the highest median annual wage in May 2025, $44,920, followed by educational services at $44,250. Guards employed by investigation, guard and armored car services, the contract firms that staff many warehouse posts, had a median of $37,350.

08

Further reading, and a list to take away

CBP publishes the CTPAT Minimum Security Criteria for Third Party Logistics Providers, with separate criteria for importers, highway carriers and other business types; even a site that never joins CTPAT will find its physical security, access control and security technology sections a sound checklist. TAPA Americas publishes the Facility Security Requirements, with the supporting audit forms available to members. CISA publishes a free Security Planning Workbook (2023) for building a foundational security plan and the Insider Threat Mitigation Guide (2026 edition). A DEA registrant should read 21 CFR 1301.71 to 1301.76 in full on the eCFR.

Before you sign off a warehouse security program, check that:

• it names the frameworks the site answers to: CTPAT, TAPA, DEA, customer contracts and insurers;
• the perimeter, gates, yard, dock, building shell and secure areas each have an owner and a check;
• every check has a frequency, a time window and a named role;
• lighting covers entrances, exits, the dock, the yard, the fence line and parking;
• cameras and alarms are tested, the results documented, and faults fixed and recorded;
• camera footage is reviewed at random, with a written summary;
• badges, keys and codes are recovered when anyone leaves;
• there is a way to report a concern anonymously;
• no exit route is locked from inside or blocked by stock;
• a missed check is recorded as missed, with the reason, and problems found reach maintenance.