How to Conduct a Physical Security Site Assessment

A physical security assessment should connect what was observed at a particular facility to the assets, threats, operations, existing safeguards, and consequences that matter there. A checklist helps create consistency, but professional judgment turns observations into defensible findings.

1. Define the purpose, scope, and authority

Identify why the assessment is being conducted and which decisions it must support. Record the locations, buildings, operating periods, assets, systems, and topics included or excluded. Clarify whether the work is a high-level review, compliance-oriented inspection, threat-informed risk assessment, design review, or validation of corrective action.

Agree on deliverables, evidence-handling rules, points of contact, and who may receive the report. A clear scope prevents an assessor from treating an inaccessible or out-of-scope condition as if it had been fully examined.

2. Prepare before arriving on site

Review available plans, prior reports, incident information, asset lists, policies, operating schedules, emergency arrangements, and outstanding corrective actions. Identify information gaps and prepare questions for facility, security, operations, safety, information-technology, and leadership personnel as appropriate.

• Confirm access, escort, identification, and personal protective equipment requirements.
• Check weather, lighting, occupancy, and operating conditions that may affect observations.
• Prepare a site route, interview list, equipment list, and evidence-numbering method.
• Agree on how urgent life-safety or security concerns will be escalated during the visit.

3. Use a consistent outside-to-inside route

A repeatable route reduces blind spots. Begin with the surrounding environment, approaches, adjacent properties, parking, delivery areas, utilities, and perimeter. Continue through public entrances, controlled access points, reception, circulation areas, critical spaces, service areas, and emergency exits.

Observe the facility during conditions that matter. A daytime visit may not reveal lighting performance, after-hours access practices, shift changes, delivery congestion, or how alarms are handled when staffing is limited. Record what was not observed as clearly as what was.

4. Observe how layered controls work together

Physical security is rarely defined by one device. Examine how people, procedures, equipment, and the built environment combine to deter, detect, delay, communicate, and support response. Relevant topics may include:

• Site boundaries, gates, fencing, vehicle controls, landscaping, signage, and lighting.
• Doors, windows, locks, keys, credentials, visitor processes, deliveries, and contractor access.
• Reception practices, staffing, guard operations, duress, incident reporting, and escalation.
• Video coverage, image quality, monitoring, retention, time synchronization, and maintenance.
• Intrusion detection, alarm transmission, verification, dispatch, and response arrangements.
• Protection of utilities, communications, records, high-value assets, and critical operating spaces.
• Emergency access, evacuation, accountability, shelter, and coordination with life-safety requirements.

Do not evaluate a device in isolation. A camera may provide useful evidence without stopping entry; a locked door may be ineffective if credentials are routinely shared; a strong perimeter may create operational or emergency-access problems if it is poorly integrated.

5. Document observations and evidence consistently

Each important observation should identify the exact location, observed condition, date and time, operating context, source, and related evidence. Separate firsthand observation from information provided by personnel. Assign unique identifiers to photographs, documents, and other supporting material.

For photographs, preserve the original file where possible and record the photo ID, location, direction or subject, condition shown, original filename, related finding, and any follow-up required. Follow site restrictions and avoid capturing personal, proprietary, classified, or operationally sensitive information without authorization.

6. Speak with the people who operate the controls

Policies and equipment records do not always show how controls function in practice. Ask authorized personnel to describe normal operations, exceptions, maintenance, outages, alarm handling, staffing limitations, workarounds, incidents, training, and known concerns. When feasible, compare explanations with records and direct observation.

Avoid asking only whether a control “works.” Ask what happens when it activates, who receives the alert, how it is verified, how quickly someone can respond, what is documented, and what occurs if the primary process fails.

7. Analyze the observation in context

An observed condition becomes meaningful when connected to an asset, credible threat or hazard, potential pathway, existing safeguards, and consequence. Record assumptions and limitations. Consider how other controls reduce or increase exposure and whether the proposed improvement creates operational, accessibility, safety, privacy, or maintenance effects.

Use the client’s approved risk and priority method where one exists. Do not invent false numerical precision. If information is insufficient, state the uncertainty and recommend the additional validation required.

8. Write findings that can be acted upon

A useful finding normally includes the condition, location, supporting evidence, why it matters, relevant context or criterion, and recommended next action. Recommendations should address the identified issue rather than defaulting to a product or technology.

• Use neutral, observable language.
• Identify effective controls as well as weaknesses.
• Connect photographs and records by unique identifier.
• Separate immediate risk-reduction steps from longer-term capital improvements.
• Identify dependencies, responsible roles, and validation needs.

9. Prioritize, assign, and verify follow-up

Review urgent observations through the agreed escalation path before leaving the site. In the final report, distinguish priority from ease or cost of correction. Assign an accountable owner and target date where the engagement permits, then define how completion will be verified.

A recommendation is not complete merely because equipment was purchased or a work order was closed. Verification should confirm that the control was implemented as intended, integrated into operations, documented, maintained, and capable of supporting the required outcome.

Common assessment mistakes to avoid

• Beginning the walk-through without written scope and authorization.
• Using a generic checklist as a substitute for site-specific risk analysis.
• Photographing sensitive areas or testing controls without permission.
• Recording observations without exact locations or evidence identifiers.
• Reviewing hardware while ignoring people, procedures, maintenance, and response.
• Treating every deficiency as equal priority.
• Recommending technology without explaining the risk it addresses.
• Failing to track corrective action through verification.

Sources and further reading

• CISA: Security Assessment at First Entry
• CISA: Mitigating Attacks on Houses of Worship Security Guide