Building Security Checklist

Standard Operating Procedure: Building Security Checklist

1. Document Control & Revision History

---

2. Executive Summary & Scope

2.1 Operational Boundaries

This Standard Operating Procedure (SOP) defines the mandatory, systematic protocols for executing, auditing, and verifying physical security checks across all enterprise real estate assets. This procedure governs perimeter integrity, ingress/egress points, critical infrastructure enclosures, automated access control systems (AACS), closed-circuit television (CCTV) coverage, and life-safety integration.

2.2 Regulatory Standards

Operations executed under this SOP must comply with or exceed the following frameworks:

• OSHA 29 CFR 1910.36 (Design and construction requirements for exit routes)
• ASIS/RIMS Risk Assessment Standard (Physical asset protection methodologies)
• NIST SP 800-53 (Physical and Environmental Protection PE-3 / PE-6) (Facility access controls and monitoring)
• NFPA 101 (Life Safety Code regarding egress security integration)

---

3. Prerequisites & Tool Requirements

Execution of this SOP requires the following verified equipment, credentials, and safety standards:

• Hardware & Equipment:
  • Enterprise-grade mobile handheld terminal with NFC/RFID credential reader and barcode scanner.
  • Encrypted two-way radio operating on designated facility security channels.
  • High-lumen tactical LED flashlight (minimum 1,000 lumens) with strobe function.
  • Calibrated physical key-management master ring or encrypted smart-key fob.
  • Digital lux meter for perimeter lighting verification.
• Software & Systems Access:
  • Physical Access Control System (PACS) administrative client access.
  • Video Management System (VMS) mobile monitoring profile.
  • Computerized Maintenance Management System (CMMS) field application for incident logging.
• Safety & Personal Protective Equipment (PPE):
  • ANSI Z87.1-compliant high-visibility safety vest.
  • Steel-toe ASTM F2413-certified safety footwear.
  • Cut-resistant tactical patrol gloves.

---

4. Roles & Responsibilities (RACI Matrix Table)

(R = Responsible, A = Accountable, C = Consulted, I = Informed)

---

5. Step-by-Step Operational Procedure

Phase 1: Pre-Inspection Briefing and System Status Check

• 1.1 Log into the Physical Access Control System (PACS) terminal and review the previous 24-hour alarm summary report.
• 1.2 Verify that all mobile scanning devices are charged to a minimum of 80% and synchronized with the central asset database.
• 1.3 Conduct a radio check with the central monitoring station (CMS) on the primary security talk-group to establish communications baseline.
• 1.4 Review current threat-con level and implement any temporary access restrictions mandated by corporate security leadership.

Phase 2: Exterior Perimeter & Ingress/Egress Verification

• 2.1 Inspect all primary vehicle and pedestrian gates for mechanical integrity, latching alignment, and uncompromised anti-ram cabling.
• 2.2 Verify exterior perimeter lighting using the lux meter; ensure illumination levels meet or exceed 2.0 foot-candles at ground level across all access points.
• 2.3 Inspect all emergency exit doors for signs of forced entry, latch tampering, or propped-open conditions.
• 2.4 Test the local door-contact sensor and local audible alarm on three randomly sampled emergency egress portals to ensure immediate PACS notification upon opening.
• 2.5 Verify that clear zones (minimum 10 feet interior, 20 feet exterior) are free of stacked materials, foliage obstruction, or temporary structures.

Phase 3: Interior Access Control & Common Area Inspection

• 2.1 Sweep all main lobby access turnstiles, visitor management kiosks, and optical barriers for hardware tampering or power interruptions.
• 2.2 Audit all internal stairwell doors to verify they latch automatically from the secure side while permitting free egress per NFPA 101.
• 2.3 Inspect elevator lobbies and secondary service corridors to confirm that credential-only read heads are active and responding to test badges within 500 milliseconds.
• 2.4 Verify that all public-facing restrooms, conference centers, and multi-tenant corridors are clear of unauthorized occupants prior to locking schedules.

Phase 4: Critical Infrastructure & Sensitive Area Audit

• 4.1 Access the Main Distribution Frame (MDF) and primary Telecommunications Rooms (TRs); verify biometric or multi-factor authentication (MFA) locks are functioning correctly.
• 4.2 Inspect the Data Center / Server Room perimeter cage; cross-reference active visitor logs against authorized escort-required manifests.
• 4.3 Check the primary electrical room, HVAC control center, and fire suppression pump room for secure deadbolt engagement and absence of unauthorized storage.
• 4.4 Verify that physical key-box cabinets (Pegasys or equivalent electronic key control systems) are locked and all master keys are accounted for in the registry.

Phase 5: Surveillance & Life-Safety System Integration Check

• 5.1 Spot-check 10% of all exterior PTZ and fixed-frame security cameras via the VMS client to confirm zero frame drops, clear lens visibility, and proper infrared illumination at night.
• 5.2 Validate that all emergency call boxes (blue-light stations) initiate a live two-way voice session with the CMS within 3 seconds of activation.
• 5.3 Confirm that fire alarm pull stations and strobe-integrated security doors drop magnetic locks instantly upon receipt of a simulated master life-safety interlock signal.

---

6. Quality Assurance & Verification Criteria

6.1 Audit Checklist & Tolerance Thresholds

• Door Latch Integrity: 100% positive latching rate across all audited portals. Zero tolerance for unlatched or compromised exterior doors.
• Lighting Compliance: Minimum 2.0 foot-candles maintained along perimeter corridors and exterior entry pathways. Deficiencies below 1.5 foot-candles require immediate work-order escalation.
• Camera Field of View: Zero occlusion or blind-spot deviation on critical infrastructure feeds. Maximum allowable PTZ drift is $\le 1.5^\circ$ from home position.
• AACS Latency: Badge-read-to-unlock response time must not exceed 750 milliseconds under normal network load.

6.2 Acceptance Benchmarks

This security check is deemed Passed only when all critical infrastructure access points are verified secure, 100% of discrepancies are logged into the CMMS with a severity rating, and the signed audit log is submitted to the Facility Security Officer within 30 minutes of route completion.

---

7. Practical Troubleshooting Scenarios

Scenario A: Exterior Emergency Exit Door Fails Self-Latching Mechanism

• Symptom: During Phase 2 inspection, an emergency exit door swings shut but fails to engage the top and bottom vertical rod latches completely into the frame strikes.
• Immediate Corrective Action Protocol:
  1. Position a security guard at the portal to maintain continuous physical custody of the vulnerability.
  2. Inspect the strike plate and latch bolt for mechanical obstruction, debris, or thermal expansion misalignment.
  3. If adjustment via hex key on the closure arm resolves the issue, re-test the latching action three consecutive times.
  4. If mechanical failure persists, deploy a temporary heavy-duty chain and tamper-evident security seal (if permitted by local fire code) or dispatch an on-call locksmith immediately.
  5. Log an urgent ticket in the CMMS tagged with code SEC-CRIT-01, and notify the FSO via radio.

Scenario B: PACS Network Communication Drop on Sensitive Enclosure

• Symptom: Reader LED on the Data Center perimeter turns solid amber/red, indicating loss of IP communication with the main access control panel.
• Immediate Corrective Action Protocol:
  1. Verify local power supply status at the enclosure's power-distribution module (PDM) and battery backup unit.
  2. Check the local network drop using a portable line tester to confirm link-layer connectivity.
  3. If power and network are confirmed, execute a local hard reboot of the access control panel controller board via power-cycle switch.
  4. While offline, transition the portal to manual armed guard post security protocol, requiring physical ID verification and manual logging in the paper visitor register.
  5. Escalate to Enterprise IT Network Operations Center (NOC) if communication is not restored within 10 minutes of controller reboot.

Scenario C: VMS Video Feed Loss on Critical Perimeter Sector

• Symptom: Security monitoring console displays a "No Video / Signal Lost" status for a cluster of three perimeter cameras covering the loading dock.
• Immediate Corrective Action Protocol:
  1. Check the Power-over-Ethernet (PoE) network switch serving that security quadrant to verify port status and power budget allocation.
  2. Inspect external weather-proof junction boxes for water ingress, damaged patch cables, or severed lines.
  3. If physical damage is identified, reroute the nearest mobile PTZ camera to sweep the unmonitored sector continuously until temporary hardwire redundancy can be established.
  4. Create an emergency dispatch ticket for the Low-Voltage Integrator contract vendor, referencing SLA-1 response time terms.