What a Physical Security Assessment Includes

Who needs one

Almost any organization with a physical site can benefit. Common reasons include:

• A recent incident such as a theft, break in, assault or threat
• Opening a new building, moving or renovating
• A request from an insurer, lender, board or accreditor
• Growth that has outpaced old routines
• A legal matter where the adequacy of security is in question

The three parts of the work

Most assessments follow the same broad pattern, though the depth varies with the site and the budget.

1. Learning about you before the visit

A good consultant does homework first. They will usually ask for:

• Site plans and floor plans
• Current security policies and emergency plans
• Incident reports from recent years
• A list of security systems and who maintains them
• Staffing details, including any security officers and their post orders
• Information about the area around the site

Many consultants also look at local crime data and talk with local law enforcement. This helps them understand the real threats your site faces, rather than working from a generic list.

2. The site visit

This is the part most people picture. The consultant walks the property, inside and out, and watches how it actually works. They often visit at different times of day, including after dark, because lighting and staffing change a lot at night.

They also interview people. Front desk staff, facilities teams, managers, security officers and IT staff all see different parts of the picture. Sometimes the most useful finding comes from a short conversation with a receptionist about who walks in without signing in.

3. Analysis and the report

After the visit, the consultant compares what they found with your risks and with accepted practices and standards. They then write a report with findings and recommendations.

What the consultant looks at

The perimeter and grounds

• Fencing, gates and natural barriers
• Vehicle access, parking areas and the routes people walk from their cars
• Exterior lighting, including dark spots and fixtures that are broken or blocked
• Landscaping that blocks sight lines or offers hiding places
• Signs that tell people where to go and what is expected

Many consultants use CPTED principles here. CPTED, or Crime Prevention Through Environmental Design, looks at how layout, lighting and landscaping affect behavior. Small changes like trimming hedges or moving a bench can make a real difference.

Building entry and access control

• How many doors are in use, and which ones should be
• Locks, door hardware and whether doors close and latch properly
• Card readers, keypads and how credentials are issued and taken back
• Key control: who has keys, how many copies exist and whether anyone knows
• Visitor management and how deliveries are handled
• Whether doors are propped open, and why

The consultant also checks that access control choices respect fire and life safety codes. People must be able to get out quickly in an emergency.

Interior spaces

• Reception and public areas, and how they are separated from staff areas
• Sensitive rooms such as server rooms, records storage, pharmacies or cash handling areas
• Places where people could shelter during an emergency
• Panic or duress buttons and who responds to them

Security systems

• Camera coverage, image quality, recording time and who watches the footage
• Intrusion alarms, monitoring and response
• Mass notification and internal communication systems
• Maintenance: whether systems are tested and fixed when they fail

A common finding is that systems exist but are not used well. Cameras that point at walls, alarms that are routinely ignored and badge systems with hundreds of active cards for people who left years ago are all examples.

People and procedures

• Security staffing, post orders, training and supervision
• Opening and closing routines
• How incidents are reported, recorded and reviewed
• Emergency plans, drills and how well staff know them
• Training for staff on awareness, reporting and emergency response
• How terminations and other sensitive events are handled

Technology gets attention, but procedures and training often matter more. A strong lock does nothing if staff hold the door for strangers.

Links to cybersecurity

Many security systems now run on your network. A thorough assessment will at least note whether cameras, access control and alarm systems are on segmented networks, use changed default passwords and are kept up to date. Deeper review may call for a cybersecurity specialist.

What a useful report gives you

The report is the product you are paying for. A strong one includes:

• A short summary for leadership, written in plain language
• The scope and method, so it is clear what was and was not reviewed
• Findings, each one explained with the risk it creates
• Recommendations, ranked by priority, with rough cost ranges where possible
• Quick wins that cost little and can be done right away
• Photos or diagrams that show exactly what the consultant means

Be cautious of reports that are mostly checklists, or that recommend specific brands without explaining why. Independent consultants should describe what a solution needs to do, so you can get competing bids.

How long it takes

Timing depends on the number and size of sites, how much preparation you can provide and how many interviews are needed. A single small office may take a day or two on site. A campus or a group of buildings will take longer. Writing the report adds more time after the visit. Ask each consultant for a timeline in their proposal.

How to prepare

• Gather documents early: plans, policies, incident logs and system lists.
• Tell staff that the consultant is coming and that honest answers help.
• Arrange access to every area, including roofs, mechanical rooms and storage.
• Decide who will receive the report and how it will be stored.
• Decide who will own the follow up once the report arrives.

After the security assessment

Use the priority ranking to build a plan. Start with quick wins and the highest risks. Spread larger investments across budget cycles. Many organizations ask the consultant back after changes are made, to confirm they work as intended.

Find a consultant for your security assessment

Search physical security consultants by state, or request proposals and let consultants who match your project reply to you.

Why organizations order a physical security assessment

A security assessment gives you an independent picture of how well your site, people and procedures protect against the risks you actually face. Organizations usually order one for a handful of reasons:

• A recent incident, such as a break in, workplace violence or a near miss
• A new building, renovation, move or change in how a space is used
• An insurer, regulator, accreditor or board asking for an outside review
• Litigation, where attorneys need an expert opinion on whether security was reasonable
• Plans and procedures that have not been reviewed in years

Knowing your reason shapes the scope. A security assessment after an incident focuses on what happened and how to prevent it, while a routine review takes a broader look across the whole site.

The main parts of a security assessment

Document review

Before visiting, the consultant usually reads your existing plans, policies, incident logs, floor plans and any past security assessment. This tells them what you intend to happen, so they can check it against what actually happens on site.

Site walk through

The core of any physical security assessment is time on site. The consultant looks at the perimeter, parking, lighting, landscaping, entrances, doors and locks, visitor management, cameras, alarms and sensitive areas. Good consultants visit at different times of day, because a building at 7 in the morning is very different from the same building at 7 at night.

Interviews

People are part of security. The consultant talks with leaders, front desk staff, facilities teams, security officers and sometimes employees or students. These conversations reveal how procedures work in real life and where people feel unsafe.

Risk analysis

Findings are weighed against the threats that matter for your site and the likely impact of each one. A clear security assessment explains why each issue matters, not just that it exists.

Written report and action plan

The final report lists findings and recommendations in order of priority. The best reports separate quick, low cost fixes from projects that need budget and planning, and they are written so a non specialist board member can understand them.

What drives the cost of a security assessment

• Size and number of sites. One small office takes far less time than a campus or a portfolio of buildings.
• Depth. A focused review of entrances and access control costs less than a full security assessment that includes policies, training and interviews.
• Travel. Consultants who need to fly in will include travel time and expenses.
• Specialty. Healthcare, schools, critical infrastructure and litigation work often require specialized expertise.
• Deliverables. Board presentations, design drawings, training sessions and follow up visits add value and cost.

Ask each consultant for a written scope and fixed fee where possible, so you can compare one security assessment proposal against another on equal terms.

Frameworks and standards consultants use

There is no single required format, but experienced consultants usually draw on recognized guidance. Common references include the CISA physical security resources, crime prevention through environmental design principles and standards published by professional bodies such as ASIS International. Ask which framework the consultant follows and why it suits your site.

How to prepare for a physical security assessment

1. Name one internal contact who can schedule access and gather documents.
2. Collect floor plans, current plans and policies, incident records and past reports.
3. Tell staff the review is coming and why, so interviews feel normal.
4. Arrange access to all areas, including roofs, mechanical rooms and after hours visits.
5. Agree in advance how sensitive findings will be shared and stored.

Turning findings into improvements

A security assessment only helps if something changes afterward. Sort the recommendations into three groups: quick wins you can finish this month, items that need a budget request, and longer term changes to plans, training or culture. Assign an owner and a date to each one.

Many organizations ask the consultant back six to twelve months later for a short follow up visit. It keeps momentum going, shows the board measurable progress and catches anything that has slipped.

Frequently asked questions

How long does a physical security assessment take?

A single building may need one to three days on site plus time to write the report. Larger sites and multi location programs take longer. Ask for a timeline before you sign.

Is a free assessment from a vendor the same thing?

Not quite. A vendor review can be useful, but it often points toward the products that vendor sells. An independent security assessment is paid for advice only, so the recommendations are not tied to a sale.

How often should we repeat it?

Many organizations repeat a full security assessment every few years, and sooner after major changes such as construction, a move or a serious incident.

Ready to find an expert? Search consultants who specialize in physical security assessments, or request proposals for free.

Common findings in a security assessment

Every site is different, but some issues come up again and again. Knowing them in advance helps you read your own report with context.

• Doors that do not close or lock properly. Propped doors, worn hardware and broken closers are among the most frequent and cheapest problems to fix.
• Unclear visitor procedures. Staff are unsure who should be allowed in, how visitors are identified or who escorts them.
• Poor lighting and sight lines. Dark parking areas, overgrown landscaping and blind corners create places where problems go unnoticed.
• Cameras nobody watches. Systems that record but are rarely reviewed, or that point at the wrong areas.
• Plans that live on a shelf. Emergency procedures exist on paper, but staff have not practiced them recently.
• Unclear reporting. Employees do not know how to report a concern, or worry that nothing will happen if they do.

Most of these can be improved without major spending. That is why a good security assessment often pays for itself by steering money toward the changes that matter most.

What a good report looks like

Ask any consultant for a redacted sample before you hire them. A strong security assessment report usually includes:

1. A short executive summary written for leaders and board members
2. The scope, dates and methods used
3. A description of the site and how it is used
4. Findings grouped by area, each with a clear explanation of the risk
5. Prioritized recommendations with rough cost ranges
6. Photos or diagrams where they help explain an issue
7. Suggested next steps and a timeline

If a sample is full of jargon, generic checklists or product names, keep looking. Your report should read like it was written for your site, because it should be.

Choosing the right consultant

Look for someone with experience in your type of site, whether that is a school, a hospital, an office, a warehouse or a house of worship. Board certifications such as the PSP show tested knowledge of physical security, and the Verified badge in our directory confirms that credentials and a reference were checked. Our guide on how to hire a security consultant covers the full process, from short list to signed agreement.

Above all, choose a consultant who explains their thinking clearly. A security assessment is only as useful as your ability to act on it, and that starts with understanding what the consultant found and why it matters.

A final checklist before you book

• You know why you need the security assessment and what decisions it should support.
• You have a written scope, timeline and fee from at least two consultants.
• You have seen a redacted sample report and spoken with a reference.
• You have named an internal contact and gathered the key documents.
• You have agreed how sensitive findings will be shared and stored.

Tick those five boxes and you are ready for a productive review that leads to real, lasting improvements.

If you have a question about this guide, or would like us to cover a related topic in more detail, please contact us. We read every message and use your questions to plan new guides.

Thank you for reading, and good luck with your next security assessment.