Building Security Audit Checklist

Standard Operating Procedure: Building Security Audit Checklist

Document Identifier: SOP-OPS-SEC-402
Classification: Restricted – Internal Operations & Compliance

1. Document Control & Revision History

---

2. Executive Summary & Scope

2.1 Purpose

This Standard Operating Procedure (SOP) defines the mandatory protocol for conducting rigorous, systematic physical and electronic security audits across all enterprise-owned and leased facilities. The objective is to identify vulnerabilities, verify compliance with life-safety and asset-protection mandates, and ensure zero-tolerance adherence to institutional security baselines.

2.2 Operational Scope

This procedure applies to all operational sites, data centers, administrative headquarters, and regional offices globally. It encompasses perimeter defenses, access control systems, surveillance infrastructure, visitor management protocols, and internal zone compartmentalization.

2.3 Regulatory Standards

All audits executed under this SOP must align with and satisfy the baseline criteria of:

• ISO/IEC 27001:2022 (Information Security Management – Physical and Environmental Security)
• NFPA 101 (Life Safety Code – Egress and Emergency Exit Integrity)
• OSHA 1910 (Occupational Safety and Health Standards – Walking-Working Surfaces and Exit Routes)
• C-TPAT (Customs-Trade Partnership Against Terrorism) guidelines for supply chain and perimeter integrity where applicable.

---

3. Prerequisites & Tool Requirements

3.1 Hardware & Equipment

• Digital Multimeter: Fluke 87V or equivalent (for verifying door strike voltage and contact closures).
• Lux Meter: Extech LT40 (for measuring emergency egress and perimeter illumination levels).
• Calibrated Laser Measure: Disto D2 (for verifying perimeter fence height and setback compliance).
• Enterprise Credential Tester: HID Prox/iCLASS diagnostic reader.
• Personal Protective Equipment (PPE): ANSI-approved steel-toe footwear, high-visibility vest, safety glasses, and hard hat (required for data center and under-construction zones).

3.2 Software Access & Credentials

• Physical Access Control System (PACS): Read-only administrative access to Honeywell Pro-Watch, Genetec Synergis, or equivalent enterprise platform.
• Video Management System (VMS): Read/playback access to Genetec Security Center, Milestone XProtect, or equivalent.
• CMMS: Read/Write access to Maximo or ServiceNow Facilities module for logging immediate work orders.

3.3 Certifications

• Lead auditor must possess active CPP (Certified Protection Professional) or PSP (Physical Security Professional) credentials via ASIS International, alongside internal ISO 27001 Lead Auditor certification.

---

4. Roles & Responsibilities (RACI Matrix Table)

Legend: Responsible, Accountable, Consulted, Informed

---

5. Step-by-Step Operational Procedure

Phase 1: Pre-Audit Briefing & Telemetry Baseline

• 1.1 Schedule introductory alignment call with Site Operations Manager 48 hours prior to on-site arrival.
• 1.2 Pull the last 30 days of PACS exception reports (e.g., "Door Forced Open," "Door Held Open," tailgating alerts) from the central PACS database.
• 1.3 Review VMS camera health logs to identify any offline or degraded lenses prior to physical walk-through.
• 1.4 Verify calibration certificates for the Lux meter and laser measure to be utilized on-site.

Phase 2: Exterior Perimeter & Access Control Audit

• 2.1 Inspect all perimeter fencing, gates, and vehicle barriers for structural integrity, breach attempts, or climb hazards within 10 feet (e.g., stored pallets, unpruned foliage). Verify minimum fence height meets the 8-foot standard.
• 2.2 Measure exterior lighting levels using the Lux meter at all pedestrian gates and loading docks. Ensure a minimum of 5 foot-candles (54 lux) is maintained at grade level.
• 2.3 Test all exterior emergency call boxes (Intercoms); verify two-way audio clarity and automatic dispatch logging at the Global Security Operations Center (GSOC).
• 2.4 Audit vehicle gate loops and optical sensors; verify rapid reversal mechanisms are operational.

Phase 3: Building Entry & Visitor Management Verification

• 2.5 Conduct a spot-audit of the lobby Visitor Management System (VMS); verify active badging, NDA capture, and real-time watchlist screening.
• 2.6 Perform a penetration test simulation: attempt access via standard employee turnstiles using an expired or deactivated contractor badge; verify physical block and local alarm trigger.
• 2.7 Verify physical security officer (PSO) post compliance: check for adherence to post orders, visitor log accuracy, and clear line-of-sight to all primary ingress points.

Phase 4: Interior Compartmentalization & Data Center Security

• 2.8 Inspect all mandatory mantraps (sally ports) for anti-tailgating compliance; test optical height sensors and weight-scale integration to ensure simultaneous multi-person entry is physically blocked.
• 2.9 Verify dual-authentication requirements (Badge + Biometric or PIN) at all Tier-3/Tier-4 server room entrances. Test biometric false-acceptance/false-rejection rates via administrative sample.
• 2.10 Inspect all interior stairwell doors and fire-rated emergency exits; verify magnetic hold-open devices release instantly upon fire alarm simulation trigger.
• 2.11 Audit Server Room rack-level physical security; check for locked side panels and intact tamper-evident seals on high-density cabinets.

Phase 5: Surveillance & Alarm Infrastructure Check

• 2.12 Sample 15% of all fixed and PTZ cameras via VMS; verify unobstructed field of view (FOV), correct time-stamp synchronization, and crisp high-definition recording at minimum 1080p / 30fps.
• 2.13 Test duress buttons at high-risk internal counters (e.g., Cash Handling, Executive Reception); confirm silent alarm transmission to local law enforcement and GSOC within a 3-second window.
• 2.14 Verify uninterrupted power supply (UPS) and backup generator redundancy for the security control room, ensuring a minimum of 4 hours of autonomous run-time for PACS and VMS servers.

---

6. Quality Assurance & Verification Criteria

6.1 Audit Checklist Acceptance Benchmarks

To achieve a "Fully Compliant" audit rating, the facility must meet the following numerical thresholds:

• Perimeter & Access Control: 100% operational status for exterior doors, magnetic locks, and intrusion detection sensors. Zero unpatched physical gaps exceeding 4 inches under perimeter gates.
• Surveillance Systems: $\ge 98%$ camera uptime over the trailing 30-day window; 100% coverage of critical ingress/egress points and server room perimeters.
• Life Safety Interlocks: 100% pass rate on emergency egress tests; zero delayed-egress anomalies exceeding code-mandated 15-second override limits.

6.2 Tolerance Thresholds & Severity Classifications

• Critical Defect (Severity 1): Any failure compromising life safety (e.g., jammed emergency exit) or unrestricted access to classified data centers/executive suites. Action: Immediate remediation required within 4 hours; mandatory escalation to VP of Global Operations.
• Major Defect (Severity 2): Degradation of redundant security systems (e.g., single camera offline in a non-critical hallway, one of two mantraps sensors failing). Action: Remediation required within 48 hours.
• Minor Defect (Severity 3): Cosmetic or documentation discrepancies (e.g., outdated visitor log, slightly misaligned camera FOV). Action: Remediation required within 14 business days via standard CMMS ticket.

---

7. Practical Troubleshooting Scenarios

Scenario A: PACS Mantrap Failure (Simultaneous Entry / Tailgating Alarm Malfunction)

• Symptom: During Phase 4 audit, the optical weight and height sensors in the main data center mantrap fail to trigger a "Tailgating Detected" interlock when two test auditors enter simultaneously.
• Immediate Corrective Action Protocol:
  1. Log a Severity 1 Critical Defect in the audit workpaper.
  2. Locally override the mantrap via the PACS terminal to manual single-user mode (one person allowed per badge swipe).
  3. Station a physical security officer (PSO) at the mantrap threshold to enforce manual access control enforcement 24/7 until the sensor array is recalibrated.
  4. Issue an urgent dispatch to the PACS vendor technician for optical sensor recalibration and firmware verification. Do not return to automated mode until a secondary audit verification pass is logged.

Scenario B: Emergency Egress Magnetic Lock Failure During Fire Alarm Test

• Symptom: During Phase 4 exit door testing, an interior emergency stairwell door fails to drop magnetic lock power when the master fire alarm relay is tripped.
• Immediate Corrective Action Protocol:
  1. Immediately halt the fire alarm test and notify the facility Life Safety Officer and local fire marshal representative if on-site.
  2. Engage the manual mechanical panic bar override to verify physical latch release regardless of magnetic power status; if mechanical release fails, choke the door open and post a fire watch.
  3. Isolate the door control relay panel; use the digital multimeter to check voltage drop across the fire alarm dry contact interface (should register 0V open circuit upon alarm trigger).
  4. If relay is fused closed, replace the interlock relay module immediately and re-test. Log as a Severity 1 Critical Life Safety Defect.

Scenario C: VMS Storage Array Degraded / Frame Drop on Critical PTZ

• Symptom: During Phase 5 surveillance verification, loading dock PTZ cameras exhibit severe frame-rate drops (under 5 fps) and missing archival video blocks from the previous 48 hours.
• Immediate Corrective Action Protocol:
  1. Access the VMS storage appliance management dashboard to check RAID health and storage volume utilization.
  2. Identify if network bandwidth throttling or disk array write-latency is causing packet drops.
  3. If storage is exhausted, verify retention policy execution; if hardware controller fault is identified, initiate manufacturer RMA and fail over recording feeds to the secondary redundant recording node.
  4. Log as a Severity 2 Major Defect and establish manual roving security patrols of the loading dock until full archival continuity is restored.