How to Conduct a Facility Security Assessment: Scope to Report

To conduct a facility security assessment, work through a defined sequence: set the scope, assemble an independent team, gather baseline documentation, walk the site systematically, evaluate networked building systems and human behavior alongside physical controls, calculate risk, and deliver a prioritized report that drives budgeted fixes and a reassessment schedule. The process produces an objective, ranked list of vulnerabilities and the concrete steps to close them, so security spending goes where it actually reduces exposure.

Set the Scope and Name the Assets

Every assessment begins with a boundary decision. Decide up front whether you are evaluating physical security alone, information technology safeguards, operational procedures, or all three, and specify which buildings or campuses are in and which are out. A focused scope you can finish beats an ambitious one that stalls halfway.

Inside that scope, list the assets that need protection in priority order: people first, then proprietary data, specialized equipment, inventory, and the infrastructure that keeps the operation running. The federal Interagency Security Committee standard scores facilities on five factors to set a security level: mission criticality, symbolism, facility population, facility size, and threat to tenant agencies. A small office with fewer than 100 people and low mission criticality lands at the lowest level; a high-profile building with more than 750 occupants and a critical mission sits near the top.¹ The same five factors are a useful way to gauge how much security your facility actually needs even when the ISC standard does not legally apply.

Assemble an Independent Team

The people running the assessment should not be the same people who built or currently manage the security program. Staff from outside the security department can work, but external consultants bring a fresh view and no political stake in the current controls. Third parties may handle any part of the work provided the facility’s security officer reviews and accepts their findings.²

Cover the disciplines the facility actually contains: physical security hardware, electronic surveillance, IT and network security, and emergency response. Bring in specialized expertise for chemical processing, laboratories, or data centers where you have them. Brief the team on the scope, give access to every area, and be explicit that the objective is finding problems, not confirming that everything looks fine.

Gather Baseline Documentation Before Walking the Site

Before anyone tours the property, the team should study the records that describe how security is supposed to work on paper. Federal maritime regulations offer a practical checklist that translates to almost any facility:

Current floor plans showing every active and inactive access point, restricted areas, escape routes, and assembly stations
Locations of security doors, barriers, lighting, cameras, and alarm systems
Number of employees, their security duties, and organizational charts showing who is responsible for what
Key control protocols, visitor management policies, cargo and delivery operations, and after-hours access rules
Fire response, active threat, bomb threat, and evacuation procedures
Previous security breaches, near-misses, and any prior assessment reports
Contracts with private security companies and local law enforcement

Most of an assessment’s value comes from comparing what these documents say against what is actually happening. A visitor management policy that lives in a binder but gets ignored at the front desk is a vulnerability, not a control.²

Walk the Property From the Outside In

The on-site inspection is the core of the assessment. Start at the outermost boundary and work inward, looking at the facility the way an adversary would: for the path of least resistance.

Perimeter, Standoff, and Lighting

Examine boundary fencing for gaps, damage, and areas where vegetation or terrain provides concealment. Check automated gates and vehicle barriers for proper operation. CISA’s bomb threat guidance gives standoff distances worth comparing against your perimeter design: a car carrying 500 pounds of explosives has a mandatory evacuation distance of 320 feet, and a small delivery truck at 4,000 pounds pushes that to 640 feet.³ If your parking arrangement allows vehicles right up against the building, flag it.

Exterior lighting is one of the most cost-effective deterrents, and the assessment should verify that illumination supports both human observation and camera performance. Published benchmarks: parking lots typically 1 to 2 footcandles, pedestrian areas at least 0.5 footcandles, perimeter zones 0.2 to 0.4 footcandles of vertical illumination, and identification check areas often 5 to 10 footcandles or higher. Where closed-circuit cameras are part of the plan, the lighting must be designed to support the cameras, not just the human eye.⁴

Access Control and Surveillance

Document every entry point: main entrances, side doors, loading docks, windows, roof hatches, and utility tunnels. For each, record the controls in place and whether they work in practice. A badge reader propped open with a doorstop is not access control. Key management deserves particular attention, since lost or unaccounted keys are a persistent vulnerability that no electronic system can offset.

For surveillance, record each camera’s placement, field of view, and operational status. Verify that recording quality is sharp enough to identify a person, not just detect movement. Confirm retention periods against operational and regulatory needs. Look hard for blind spots at entry points and near high-value assets, and review footage from both day and night.

Visitor management is where assessors consistently find gaps. Check whether temporary visitors receive credentials with clear expirations, whether they are escorted in restricted areas, and whether their credentials are collected on departure. Apply the same scrutiny to vendors, contractors, and delivery personnel who have routine access that no one actively monitors.

Crime Prevention Through Environmental Design

CPTED is a design-based approach that uses the physical environment to deter criminal behavior. It relies on three strategies: natural access control, natural surveillance, and territorial reinforcement.⁵ Rather than adding locks and cameras, CPTED asks whether the building’s layout makes wrongdoing easy or hard.

Natural surveillance means clear sightlines: trim vegetation low enough to see over or high enough to see under, and keep signage and furniture from blocking windows and doors. Natural access control uses sidewalks, fences, and landscaping to funnel people toward monitored entry points and away from restricted areas. Territorial reinforcement uses signage, pavement treatments, and landscaping to mark public space from private, creating a psychological deterrent for anyone who does not belong.⁶

Critical Infrastructure Spaces

Inspect the rooms housing power generation, HVAC, telecommunications hubs, servers, and water treatment or distribution equipment as their own category. Disruption to any of these can force a full shutdown without direct harm to people. Confirm that access is restricted, monitored, and logged, and that backup power and communications are available and tested on a regular schedule.

Reconcile Security With Life Safety Codes

Assessments frequently uncover conflicts here that create real legal exposure. Every security measure that restricts movement has to coexist with fire and life safety codes that require rapid egress in emergencies. The NFPA 101 Life Safety Code requires doors in an exit path to open from the egress side without keys, tools, or special knowledge. A standard deadbolt or padlock on an exit door is never compliant, no matter how serious the security concern.

Two hardware types can satisfy both sides. Delayed-egress locks hold a door for up to 15 seconds after release, provided the building has sprinklers and fire detection, and they release automatically on fire alarm or power failure. Access-controlled egress doors release immediately on push of a sensor or bar, and also release on fire alarm, power failure, or loss of communication with the access control system. Both require signage explaining operation.

Flag any improvised security measures the team finds. Ropes, wedges, and objects jammed into door closer arms block both emergency egress for occupants and entry for first responders. If security hardware conflicts with egress requirements, it goes to the top of the recommendation list. An unlocked exit door is a security gap; a locked exit door that traps people during a fire is a catastrophe.

Assess Networked Building Systems

Modern facilities run on networked systems that blur the line between physical and digital security. Access control panels, cameras, intrusion sensors, HVAC controllers, elevators, and lighting are increasingly connected to the internet, creating entry points a purely physical review will miss. Building automation systems that let managers adjust HVAC or lighting remotely also expose those systems to cyber intrusion through their active internet connections.⁷

The consequences extend well past inconvenience. A compromised HVAC system could force a facility closure, render server rooms inoperable through temperature manipulation, or serve as a stepping stone into the corporate network where sensitive data lives. Inventory every network-connected physical device and check whether building automation networks are properly segmented from IT networks. Password practices on these devices are often poor: default credentials, shared logins, and no multi-factor authentication are common findings. Cameras reachable from the internet with default passwords are working for the adversary.

Test the Human Element

Physical barriers and electronic systems only work if the people using them follow the rules. Social engineering testing evaluates whether staff can recognize and resist deceptive tactics, and it almost always finds gaps a physical inspection cannot. Common scenarios include impersonating a vendor or delivery person to walk past a checkpoint, tailgating through a badge-controlled door, and calling employees to request sensitive information under a false pretext.

The purpose is not to embarrass anyone. It is to identify where training is weak and where procedures have drifted from written policy. If a tester in a reflective vest and clipboard can walk unchallenged into a server room, that says something about the access control culture regardless of how good the badges are. Results should feed the recommendations section, typically as targeted training or updated procedures rather than expensive hardware.

Digital social engineering, such as phishing emails and phone-based pretexting, can run in parallel with the physical work. Those tests reveal whether employees will click a suspicious link, share credentials by phone, or follow instructions from someone claiming authority they do not have.

Score the Risk and Rank the Findings

With physical findings and human factors data in hand, the team moves to analysis. Threat identification defines who or what could target the facility: disgruntled current or former employees, organized criminal groups, activist organizations, lone actors, severe weather, and technological failures. For each, evaluate capability, motivation, and historical patterns to estimate how likely an attempt is.

Vulnerability analysis matches the weaknesses found during the inspection against each threat. An unsecured loading dock is a vulnerability. A loading dock next to high-value inventory that a known theft ring has targeted at similar facilities in the region is a risk. Working through the pairings forces the team to think about how each specific weakness would actually be exploited rather than treating every gap as equally urgent.

The standard framework: Risk equals Threat times Vulnerability times Consequence. Threat is the probability that an attack or event will be attempted. Vulnerability is the probability the attempt succeeds against existing defenses. Consequence is the impact of a successful attack.⁸ A high-probability threat against a well-defended asset with low consequences scores lower than a moderate threat against an undefended asset with devastating consequences. This math drives the hard conversations about where to spend limited resources.

Rank the results by potential impact on personnel safety, mission continuity, and regulatory compliance. That ranked list becomes the backbone of the report.

Write a Report People Will Use

The report outlives the assessment, so it has to communicate to people who were not there for the walk-through. Open with an executive summary that states the scope, gives an overall security posture rating, and highlights the most significant risks. Decision-makers often read only this section, so it must stand on its own. CISA’s SAFE program organizes its reports around commendable existing practices, identified vulnerabilities with mitigation options, and useful contacts and resources, which is a solid template at any scale.⁹

The body should contain a prioritized list of recommendations, each linked to a specific vulnerability and its calculated risk score. Sort them into tiers:

Immediate actions: low-cost or no-cost fixes for the highest risks, such as repairing broken locks, trimming sight-blocking vegetation, or revoking credentials for former employees
Short-term projects: upgrades that need modest budgets and planning, such as adding lighting to dark zones, installing badge readers at uncontrolled doors, or implementing visitor management software
Long-term capital investments: major expenditures such as perimeter barrier systems, surveillance overhauls, building automation network segmentation, or facility redesigns incorporating CPTED principles

Include an estimated cost and the resources needed for each recommendation. That financial detail is what turns the report from an academic exercise into an actionable budget request. Facilities that share floorplans and vulnerability assessments with local law enforcement and first responders improve emergency response coordination, so the report should also address what information to share and with whom.¹⁰

Implement, Verify, and Reassess

A report in a drawer protects nobody. Assign a responsible person and a deadline to each recommendation. Track progress against the implementation plan at regular intervals, and test completed fixes to confirm they actually close the gap they were designed to address. A new badge reader nobody programmed to restrict access is an expensive decoration.

Security assessments are not one-time events. The threat environment shifts, buildings get renovated, tenants change, and technology evolves. Reassess on a regular cycle; most organizations find annual reviews a reasonable baseline. Beyond the schedule, certain events should trigger an immediate reassessment:

Any breach, attempted intrusion, or near-miss that reveals a gap the previous assessment did not catch
Renovations, expansions, new tenants, or changes in facility population that alter the risk profile
New building automation systems, surveillance upgrades, or network changes that introduce new attack surfaces
Changes in the local crime environment, new intelligence about threats to your sector, or incidents at comparable facilities nearby

Each cycle builds on the last. Review whether prior recommendations were implemented, test whether implemented controls still work, and evaluate any new vulnerabilities that have emerged. Over successive rounds this moves the facility from reactive patching to an evolving security program.

When an Assessment Is Legally Required

Some facilities must conduct assessments, not just consider them. Maritime facilities regulated under the Maritime Transportation Security Act must complete a written Facility Security Assessment that includes background information gathering, an on-scene survey, and an analysis with prioritized recommendations. The assessment must be reviewed and accepted by the facility’s designated security officer, and the resulting facility security plan is subject to Coast Guard approval.²

Chemical facilities handling certain dangerous chemicals were previously required to complete security vulnerability assessments under the Chemical Facility Anti-Terrorism Standards program, submitting assessments and site security plans within 120 days of notification from CISA. Congress allowed the CFATS statutory authority to expire in July 2023, and CISA is not currently enforcing CFATS compliance.¹¹ Facilities that were once covered should still assess voluntarily; the underlying risks have not changed with the mandate.

Federal buildings follow the ISC Risk Management Process, which assigns a security level from I through V based on mission criticality, symbolism, population, size, and threat to tenant agencies, with the security level dictating the required baseline countermeasures.¹ Healthcare, education, and other regulated sectors often carry their own assessment obligations through accreditation standards or industry-specific rules. Even absent a legal mandate, a documented assessment provides evidence of due diligence that can matter if a security incident leads to litigation.

1
Department of Homeland Security. The Risk Management Process – An Interagency Security Committee Standard
2
eCFR. 33 CFR Part 105 – Maritime Security: Facilities
3
Cybersecurity and Infrastructure Security Agency. Bomb Threat Guide
4
Military Surface Deployment and Distribution Command Transportation Engineering Agency. Exterior Lighting for Safety and Security
5
Cybersecurity and Infrastructure Security Agency. Houses of Worship Security Self-Assessment
6
Whole Building Design Guide. Building Resilience – Crime Prevention Through Environmental Design
7
Homeland Security Affairs. Building Automation System Cyber Networks: An Unmitigated Risk
8
Center for Homeland Defense and Security. Risk Methods and Models
9
Cybersecurity and Infrastructure Security Agency. Security Assessment at First Entry (SAFE) Fact Sheet
10
Cybersecurity and Infrastructure Security Agency. Planning and Response to an Active Shooter
11
Cybersecurity and Infrastructure Security Agency. Chemical Security Assessment Tool (CSAT) – Security Vulnerability Assessment and Site Security Plan