Building Security Audit Template

Standard Operating Procedure: Building Security Audit Template

Document ID: SOP-OPS-SEC-402
Classification: Internal Operational Standard / Enterprise Compliance

---

1. Document Control & Revision History

---

2. Executive Summary & Scope

2.1 Purpose

This Standard Operating Procedure (SOP) defines the rigorous, repeatable methodology for executing comprehensive physical security audits across all enterprise-owned and leased facilities. It establishes standardized metrics to evaluate the efficacy of perimeter defense, access control systems (ACS), closed-circuit television (CCTV) coverage, visitor management protocols, and life-safety integration.

2.2 Scope

This procedure applies to all corporate headquarters, regional offices, research and development centers, and critical data infrastructure facilities managed by the organization. It governs the actions of internal security personnel, contracted third-party audit firms, and facilities operations teams.

2.3 Regulatory Compliance & Standards

Audits executed under this SOP shall align with and maintain compliance against the following standards:

• ISO/IEC 27001:2022 (Clause 7 - Physical and Environmental Security)
• NIST SP 800-53 Rev. 5 (Physical and Environmental Protection [PE] Security Controls)
• OSHA 1910 (Exit Routes, Emergency Action Plans, and Fire Prevention)
• CPTED (Crime Prevention Through Environmental Design) principles

---

3. Prerequisites & Tool Requirements

Prior to initiating an audit, the lead auditor must assemble and verify the following equipment, software credentials, and safety items:

3.1 Hardware & Testing Equipment

• Calibration-Verified Light Meter: Capable of measuring foot-candles (FC) and lux for illumination audits.
• Multimeter & Continuity Tester: For physical lock, magnetic door contact, and sensor testing.
• RFID Cloning/Testing Device: Authorized credentials for testing access control reader latency and encryption integrity.
• Acoustic Decibel Meter: For validating emergency alarm audibility across zone perimeters.
• Enterprise Tablet/Ruggedized Laptop: Pre-loaded with auditing software and encrypted local storage.

3.2 Software Access & Credentials

• Physical Access Control System (PACS) Administrator Access: Read-only access to badge logs, door schedules, and alarm history.
• Video Management System (VMS) Viewer Access: Live and historical playback access for all camera feeds.
• Computer-Aided Facility Management (CAFM) System: Access to asset locations, floor plans, and previous maintenance tickets.

3.3 Safety & Personal Protective Equipment (PPE)

• High-visibility safety vest (ANSI/ISEA 107 compliant).
• Steel-toe safety footwear (ASTM F2413 compliant).
• ANSI-approved eye protection and hard hat (for mechanical/electrical room access).
• Valid corporate identification badge and high-clearance escort pass.

---

4. Roles & Responsibilities (RACI Matrix Table)

• Responsible (R): The role that performs the activity or audit execution steps.
• Accountable (A): The sole decision-maker with final approval and sign-off authority.
• Consulted (C): Subject matter experts providing critical inputs and technical verification.
• Informed (I): Stakeholders updated on audit progress, high-risk findings, and final reports.

---

5. Step-by-Step Operational Procedure

Phase 1: Pre-Audit Preparation & Documentation Review

• 1.1 Schedule the audit window with the Facility Operations Manager and Local SOC at least fourteen (14) business days in advance.
• 1.2 Review previous security audit reports, unresolved remediation tickets, and historical incident logs from the past 365 days.
• 1.3 Obtain current architectural CAD files, egress route schematics, and camera placement overlays from the CAFM system.
• 1.4 Calibrate all technical testing instruments (light meters, multimeters) and document calibration serial numbers in the audit log.

Phase 2: Perimeter & Exterior Security Assessment

• 2.1 Inspect all property boundaries, fencing, gates, and vehicle access control points (bollards, automated arm gates) for structural integrity and forced-entry vulnerabilities.
• 2.2 Measure exterior lighting levels at all pedestrian and vehicular entrances; verify compliance with the minimum standard of 5 foot-candles (54 lux).
• 2.3 Verify that all exterior perimeter CCTV cameras provide unobstructed coverage fields with zero blind spots along fence lines and blind corners.
• 2.4 Test exterior emergency call boxes or intercom stations, confirming direct two-way communication routing to the active security operations center.

Phase 3: Access Control & Visitor Management Evaluation

• 3.1 Audit the main lobby visitor management process: verify identity checking, NDA execution, visitor badge issuance, and escort enforcement policies.
• 3.2 Test a representative sample (minimum 10%) of exterior and interior card readers for response latency (threshold: <1.5 seconds) and anti-passback enforcement.
• 3.3 Inspect turnstiles, speed gates, and optical barriers for tailgating vulnerabilities and emergency drop-arm mechanical functionality.
• 3.4 Cross-reference active PACS user databases against current Human Resources active employee rosters to identify and flag orphaned credentials.

Phase 4: Interior, Zone, & Critical Infrastructure Audit

• 4.1 Inspect Server Rooms and Main Distribution Frame (MDF)/Intermediate Distribution Frame (IDF) closets; verify dual-authentication biometric or card-plus-PIN access enforcement.
• 4.2 Audit internal stairwells and emergency exit doors: verify that door contact sensors, request-to-exit (REX) devices, and magnetic locks function without mechanical binding.
• 4.3 Test mechanical, electrical, and plumbing (MEP) room security; ensure unauthorized access triggers immediate high-priority visual and audible alarms in the SOC.
• 4.4 Review interior CCTV coverage inside secure storage zones, executive suites, and mail-handling rooms for complete archival retention (minimum 90-day storage capacity).

Phase 5: Life-Safety Integration & Egress Verification

• 5.1 Verify that all emergency exit paths are entirely unobstructed by furniture, construction materials, or improperly stored assets.
• 5.2 Test fire alarm system integration: verify that fire panel activation initiates immediate unlocking of all magnetic access control portals to ensure unhindered egress.
• 5.3 Inspect emergency lighting battery backup systems along primary exit corridors; conduct a manual power-drop test to verify minimum 90-minute operational capability.
• 5.4 Confirm clear, illuminated signage is present and operational for all primary and secondary emergency evacuation routes.

Phase 6: Post-Audit Debrief & Reporting

• 6.1 Compile all raw data, photographs, light meter readings, and system logs into the enterprise audit template database.
• 6.2 Convene a verbal debriefing session with the Facility Operations Manager and local security supervisors to highlight critical immediate-risk findings.
• 6.3 Draft the final audit report, categorizing all identified deficiencies by risk severity (Critical, High, Medium, Low).
• 6.4 Submit the finalized report to the Director of Global Security and Executive Leadership for formal sign-off and remediation tracking.

---

6. Quality Assurance & Verification Criteria

To successfully pass the Building Security Audit, the facility must meet the strict quantitative and qualitative benchmarks defined below. Any failure to meet these thresholds requires formal remediation tracking.

6.1 Acceptance Benchmarks & Tolerances

6.2 Risk Severity Classifications

• Critical: Direct threat to human life, active security bypass of a server room/data center, or completely non-functional fire-life safety egress. (Remediation window: 24 Hours)
• High: Compromised perimeter defense, systemic CCTV blind spots in secure corridors, or massive orphaned credential populations. (Remediation window: 7 Calendar Days)
• Medium: Minor exterior lighting deficiencies, slow access control reader response, or damaged visitor badging hardware. (Remediation window: 30 Calendar Days)
• Low: Cosmetic signage damage, minor wear on turnstile finish, or minor documentation gaps. (Remediation window: 60 Calendar Days)

---

7. Practical Troubleshooting Scenarios

Scenario A: Access Control System (PACS) Network Drop / Reader Latency Spike

• Symptom: During Phase 3 testing, multiple card readers exhibit response times exceeding 5.0 seconds, or intermittent offline status errors appear on the SOC dashboard.
• Immediate Corrective Action Protocol:
  1. Notify the Local SOC and IT Infrastructure Lead immediately to check local Power-over-Ethernet (PoE) switch health and fiber-optic uplinks.
  2. Access the local door controller cabinet and verify power supply battery backup voltage (must be $\ge 12V$ DC or $\ge 24V$ DC).
  3. Perform a soft reboot of the primary access control panel processor if network traffic is congested.
  4. If communication is unrecoverable, instruct local security guards to implement manual guard-verification logs and physical check-in protocols until the network bridge is re-established.
  5. Document the incident, duration, and root cause in the audit exception log.

Scenario B: Fire Alarm Integration / Fail-Safe Egress Failure

• Symptom: During Phase 5 life-safety testing, triggering the zonal fire alarm test panel fails to release the magnetic locks on two secondary emergency exit doors.
• Immediate Corrective Action Protocol:
  1. Immediately halt the test and contact the building fire safety officer and facility management.
  2. Use the physical mechanical override key (held in the designated Knox Box or SOC key vault) to manually unlock the doors, ensuring emergency egress is unimpeded.
  3. Inspect the relay interface module between the fire alarm control panel (FACP) and the access control power supply for blown fuses or miswired dry contacts.
  4. Classify the finding as Critical, apply a physical tamper tag to the door, and station a physical fire watch guard at the portal until a licensed technician replaces the faulty relay module.
  5. Retest the fail-safe integration loop prior to closing the audit finding.

Scenario C: Unmonitored Blind Spot / Compromised CCTV Coverage Area

• Symptom: During Phase 2 or Phase 4, auditors discover that a newly installed interior partition wall creates a significant, unmonitored camera blind spot covering a high-value asset storage corridor.
• Immediate Corrective Action Protocol:
  1. Mark the exact spatial coordinates of the blind spot using the floor plan overlay tool.
  2. Issue a temporary physical security remediation order requiring roving security guard patrols through the affected corridor every 30 minutes until resolved.
  3. Consult with the Facility Operations Manager to determine if the obstruction can be relocated or if an auxiliary wide-angle IP camera must be deployed.
  4. Submit an emergency infrastructure work order for camera repositioning or supplemental hardware installation.
  5. Verify and sign off on the corrected camera field-of-view (FOV) within 72 hours.