A physical security risk assessment connects the way a property operates with the unwanted events it needs to prepare for. It should help management decide what to improve first, what evidence supports that decision and who will complete the work. A list of cameras and door locks is only part of that picture.
Use this checklist to prepare for a professional assessment of a Miami office, mixed-use building or commercial property. It is a management framework, not a penetration test or a guarantee against incidents. Testing access controls requires explicit authorization and a defined safe scope.
Define the decision the assessment must support
Write down the property boundaries, operating hours, occupants and activities included. State whether the review concerns an entire building, a new tenant fit-out or a change in access arrangements. Include tenant and landlord responsibilities so a recommendation does not fall between two organizations.
Identify who will approve the final action plan. A report intended to support a staffing decision needs different detail from a maintenance review. List exclusions and access limitations openly. An area that was not inspected should not appear as “satisfactory” merely because no issue was recorded.
Gather the right evidence before the walk-through
- A current layout and description of public, staff-only and restricted areas.
- Operating patterns, including deliveries, contractors and after-hours work.
- Relevant incident and maintenance records with personal information limited.
- Existing post orders, escalation contacts and emergency-plan references.
- Access-control and alarm responsibilities, including authorized service contacts.
- Known changes in tenancy, construction, hours or equipment.
Keep plans and detailed vulnerabilities in a controlled project folder. Ask for information relevant to the agreed scope rather than indiscriminately collecting identity documents or personal schedules. Where information is missing, record the uncertainty and its effect on the review.
Observe the property as it is used
Walk the journey of an employee, visitor and delivery arrival. Observe how authorization reaches the entrance, how staff resolve an exception and how someone requests assistance. Compare written instructions with ordinary operations; a working card reader may coexist with an unclear visitor process.
Include relevant operating periods when agreed, such as a busy arrival window or evening closing. Coordinate with management so the review does not disrupt occupants or encourage unsafe testing. Do not publish photographs that expose access credentials, resident details or exploitable weaknesses.
Separate the observation from the risk judgment
An observation describes what was seen: a door did not latch during an authorized check. A risk statement explains the possible consequence in context: the approved access boundary may not function as intended. The recommendation assigns a response: maintenance inspection, an interim measure approved by management and a verification date.
Assess likelihood and consequence using a consistent method appropriate to the site. Avoid invented precision. A numerical score is not more reliable merely because it contains decimals. Explain the evidence and uncertainty behind priorities, especially when management must choose between staffing, maintenance and equipment.
Use an action register that can be closed
For each finding, record: reference, observation, affected operation, priority, proposed action, owner, target date and completion evidence. Include a separate field for management’s decision where a recommendation is deferred or modified. Do not mark an issue closed simply because a work order was opened.
For example, an unanswered help call may require a revised contact route and a supervised retest, not a new camera. A recurring unauthorized-access exception may require clearer tenant approvals. These are sample planning scenarios, not accounts of FSO client incidents.
Review the result with the people who must use it
CISA’s Security Assessment at First Entry resource describes structured reviews of existing measures and options for improvement. For a commercial assignment, ask the assessor to explain the scope, evidence, limitations and proposed follow-up in similarly usable terms.
FSO Guard’s commercial security services can support a discussion about the personnel and operational parts of your plan. Start with your property type, hours and the decisions you need to make. Use the parking lot checklist for that specific area and post orders guide when turning approved actions into officer instructions.
Frequently asked questions
Is a physical security risk assessment the same as a patrol?
No. A patrol performs assigned checks. An assessment evaluates the security arrangements, supporting evidence and priorities for improvement.
Does an assessment require testing doors or bypassing controls?
Not necessarily. Any test must be explicitly authorized, safe and within the agreed scope. An ordinary walk-through is not permission to attempt unauthorized entry.
What should the final report contain?
Scope, observations, evidence, limitations, prioritized recommendations and an action register with responsible owners and verification steps.
