A physical security assessment is a structured walkthrough of a facility that scores how well its perimeter, entry points, surveillance, and procedures would actually stop an intruder, a theft, or a violent incident — and turns the gaps into a prioritized fix list. This guide includes the complete 9-area template 2M Technology uses on client sites, free to use on your own facility. Work through the tables below, or request a professional assessment and we’ll do it with you.
When a Facility Needs an Assessment
Five triggers account for most assessments we run: a security incident (theft, break-in, workplace violence, or a near miss); an insurance carrier or auditor requiring documented security controls; moving into or building a new facility; a compliance driver (CJIS server rooms, FTZ warehouses, school safety mandates); and technology refresh — cameras or access control near end-of-life, where an assessment stops you from replacing the wrong things first. Federal guidance for critical infrastructure lives at CISA’s physical security hub, and ASIS International publishes the professional standards most assessors work from.
The 9-Area Physical Security Assessment Template
Score each line: 2 = in place and working, 1 = partial or untested, 0 = absent. Anything scored 0 in areas 1–4 is a priority-one gap.
1. Perimeter & Grounds
| Check | Pass criteria | Common gap |
|---|---|---|
| Fencing / boundary condition | Intact, climb-resistant where required, no wash-outs or gaps | Gaps behind dumpsters and utility corners |
| Vehicle approach control | Speeds physically limited; rated barriers, bollards, or blockers where ramming is plausible | Straight high-speed runs to entrances |
| Grounds visibility | Clear sightlines; landscaping below 3 ft near paths and doors | Overgrown concealment near entries |
| After-hours deterrence | Site reads as monitored: signage, visible cameras, lighting | Dark, unsigned lots that invite entry |
2. Entry Points & Access Control
| Check | Pass criteria | Common gap |
|---|---|---|
| Door inventory | Every exterior door known, alarmed or controlled, self-closing | Propped or uncounted rear doors |
| Credential control | Individual credentials, same-day revocation, no shared codes (see commercial access control systems compared) | Ex-employee badges never deactivated |
| Tailgating prevention | Turnstiles, mantraps, or monitored single-entry at sensitive zones | Card reader on a door everyone holds open |
| Visitor flow | Sign-in, badging, escort rules actually enforced | Visitor policy exists on paper only |
3. Screening (where threats must be found before entry)
| Check | Pass criteria | Common gap |
|---|---|---|
| Weapons screening need | Documented decision: which entrances, what threat, what throughput | No analysis — screening bought (or skipped) on instinct |
| Detection equipment | Walk-through detectors / X-ray sized to real traffic, NIJ-benchmarked | One lane for 500-person shift change |
| Secondary screening | Trained staff + wand + procedure for alarms | Alarms waved through at rush |
4. Surveillance Coverage
| Check | Pass criteria | Common gap |
|---|---|---|
| Coverage map | Every entry, cash/asset area, and blind corner on camera | Cameras aimed at doors but not approaches |
| Image quality | Faces identifiable at entries, plates readable at gates (day and night) | 720p cameras “covering” a 100-ft lot |
| Retention & export | 30+ days stored; staff can actually export a clip | 7-day loop discovered after an incident |
| Health monitoring | Dead cameras flagged within 24h | Camera dead for months, found post-incident |
5. Lighting
| Check | Pass criteria | Common gap |
|---|---|---|
| Perimeter & lot levels | Even coverage, no dark pockets on paths, docks, lots | Bright doors, black parking rows |
| Camera compatibility | Lighting supports night image quality (no glare/backlight at lenses) | Floodlight blooming out the camera behind it |
| Hazardous-area fixtures | Classified areas use certified explosion-proof lighting | Commercial fixtures in Class I/II zones |
6. Intrusion Detection & Alarms
Fire alarm systems are assessed separately under NFPA 72 — our commercial fire alarm guide covers that side.
| Check | Pass criteria | Common gap |
|---|---|---|
| Sensor coverage | All exterior doors, glass, and roof hatches sensored | Skylights and hatches forgotten |
| Response path | Documented: who is called, in what order, verified quarterly | Alarm calls a phone nobody answers |
| Testing | Full-system test on a schedule with logs | Never tested since install |
7. Policies & People
| Check | Pass criteria | Common gap |
|---|---|---|
| Key/credential policy | Written issuance, return, and audit process | Nobody knows how many keys exist |
| Termination procedure | Access revoked before or at separation, every time | HR and security not synchronized |
| Staff awareness | Employees challenge unbadged strangers; reporting path known | Politeness beats protocol |
8. Emergency Response
| Check | Pass criteria | Common gap |
|---|---|---|
| Lockdown capability | Facility can lock exterior + interior zones in under a minute | Lockdown requires running to each door |
| Drills | Evacuation and lockdown drilled at least annually | Fire drills only, never security |
| Law-enforcement liaison | Local PD has site plans and a named contact | First responder sees the layout during the incident |
9. Hazardous & Special Areas (industrial sites)
| Check | Pass criteria | Common gap |
|---|---|---|
| Classified-area equipment | Cameras/electronics in rated zones carry UL 1203 / IECEx / ATEX certification | Commercial cameras inside Class I Division 2 |
| High-value storage | Layered controls: cage or vault + camera + access log | Single lock between thief and inventory |
Scoring Your Facility
Total the points (maximum 62). Above 50: strong posture — focus on testing and drills. 35–50: functional but exposed — close every 0-score in areas 1–4 first. Below 35: the facility is relying on luck; sequence fixes by the template order, because perimeter and entry gaps make everything downstream easier to defeat. For a faster read, our facility security risk score calculator turns a short questionnaire into a benchmark score.
DIY Template vs. Professional Assessment
The template above finds the obvious 80%. A professional assessment adds what self-audits structurally miss: adversarial thinking (we try the doors, tailgate the lobby, and walk the fence like an intruder would), measurement (light-meter readings, camera field-of-view testing, door-force checks), and product-neutral sequencing — which fixes cut the most risk per dollar. 2M Technology (Texas Security License B15309) runs assessments free for facilities planning improvements, from single buildings to multi-site industrial portfolios, covering entry control, weapons screening, surveillance, and hazardous-area equipment.
Physical Security Assessment FAQ
How long does a physical security assessment take?
Self-assessment with this template: 2–4 hours for a single building. A professional assessment runs half a day to two days on site depending on size, plus a written report with prioritized findings — typically delivered within a week.
How much does a professional assessment cost?
Standalone assessments from consulting firms commonly run $2,000–$10,000+ per facility. 2M provides assessments at no cost for facilities planning security improvements, because the assessment is how we scope the right system rather than oversell one.
How often should we reassess?
Annually as a baseline, plus after any incident, major renovation, tenant change, or shift in threat environment. The fastest-decaying items are procedural — credential audits and response-path testing — which is why areas 7 and 8 deserve a quarterly spot-check.
What is the difference between a security assessment and a security audit?
An assessment measures real-world effectiveness against threats — would this stop an intruder? An audit measures conformance with a written standard or policy — are we doing what the document says? Compliance-driven facilities usually need both; this template is assessment-first.
Who should perform the assessment?
Someone who doesn’t own the current setup. Internal staff defend past decisions unconsciously; an outside assessor — a licensed integrator, an ASIS-certified consultant, or your insurer’s loss-control engineer — has no stake in the status quo.
Can 2M assess a facility outside Texas?
Yes — 2M Technology assesses and installs nationwide, with design, equipment manufacturing, and installation handled by one team. Request a free assessment and include your facility type and square footage.
