Site security planning: build it in from the start

The cheapest time to fix a security problem is before the building exists. Retrofitting guards, cameras and access control after a site is running is more expensive and leaves gaps. Site security planning means bringing security into the picture at the design stage — when the site is being planned or renovated — and keeping it there as the site operates.

This guide covers what to think through when you are securing a new or existing site, and the sequence that keeps the plan realistic.

Step 1 — Map the site and its risks

Start with the place itself. Write down:

• Location — urban, suburban or rural, and the surrounding area’s crime profile
• Ownership — owned or leased, and what that means for the changes you can make
• Layout — every entry and exit point, parking, loading areas and perimeters
• Operating hours — is it staffed 24/7 or only during the day?
• Working environment — what goes on there, who is present, and when

Inspect the site and list the realistic threats: theft, trespass, incidents at access points, damage to property, and threats to people. From that list you can decide where protection is actually needed instead of where it looks good on a diagram.

Then score what you found, because treating every threat as equally urgent is how security budgets get spent on the wrong things. For each risk, work out the likelihood and the impact if it happened, and write down the reasoning. A Business Impact Level that reflects harm to people, loss of assets and disruption to operations is more useful for prioritisation than a raw list — and it is the evidence you will need later when someone asks why a control costs what it does.

Talk to the people who run the site while you do this. Operations, facilities and HR see patterns a walk-around will not reveal, and insider risk is the threat that a site inspection is least likely to surface: the people who already have legitimate access are the hardest to detect and the most damaging when they turn.

Step 2 — Decide what needs protecting

Security exists to protect three things, and each changes the plan:

• People — staff, visitors and contractors, and the patterns of who is on site and when
• Physical assets — inventory, equipment and valuables, and how they move in and out
• Information — sensitive documents, discussion areas and meeting spaces, which need access control and protection from visitors and outsiders

Treat the security plan itself as sensitive: it is a blueprint of your weaknesses, so control who sees it.

Step 3 — Involve security early

Security is a design input, not an afterthought. Involve the security team when the site is being planned so that requirements — access points, camera sightlines, safe rooms — go into the design brief and contracts from the start. It is far cheaper to place a control room in the plan than to build it later.

Step 4 — Layer the measures

Effective site security works in layers, so a failure in one layer is caught by another. Use a mix of:

• Access control — who can enter which areas, with limits on sensitive zones
• Surveillance cameras — monitoring and recording across the site, with video analytics for proactive alerts
• Perimeter protection — fences, barriers and controlled entry points
• Security personnel — guards deployed so there is enough delay between a breach and a response for your team to act, deployed by an agency holding a valid PSARA licence for the state
• Standard operating procedures — documented protocols, with access to sensitive rooms and camera feeds limited to authorised people, and visitors escorted through the site

Step 5 — Blend security with how the business works

A security plan that hampers daily operations will be quietly ignored. Involve operations teams from the start so the measures fit how work actually happens, and so teams can change their own processes to meet security requirements. When security makes the daily work easier rather than harder, it holds up on the ground.

Step 6 — Plan for continuity, not just prevention

Prevention eventually fails, so decide in advance how the business keeps running when it does. A business continuity plan sets out how critical functions continue during and after a disruption, and what the incident response looks like: who is told, who decides, and what happens to staff, visitors and stock in the first hour.

Write it for the events this site can actually face — fire, flood, loss of power or connectivity, a security incident, the sudden absence of a key person — and keep it short enough that someone can follow it under pressure. Simple templates and checklists beat a long document nobody opens. The disaster preparedness and response guide covers how the security function fits into that wider plan.

Step 7 — Review, don’t just install

Security is not a one-time implementation. Reassess the site when the business changes — new teams, new floors, new threats — and check the measures you rely on are still in place and being followed.

Test them rather than assuming. Audits and exercises validate the assumptions you made when planning, and mock drills surface gaps in the response team before a real incident does. A plan that has never been exercised is a hypothesis, not a plan.

Frequently asked questions

When should security planning start on a new site?

At the design stage, before the layout is fixed. Decisions about entry points, camera sightlines, the control room and the storage of valuable goods are cheap while the building exists only on paper and expensive once it is built. Retrofitting is possible, but it rarely achieves what designing it in would have.

What is the difference between site security planning and a security risk assessment?

The assessment establishes what the risks are and how serious they are. The planning decides what to build, buy and staff in response, and in what order. In practice they alternate: assessment, plan, then reassessment as the site or the business changes.

What are the most common mistakes in site security planning?

Designing around the diagram rather than how the site operates; protecting assets while overlooking information and people; leaving the plan to the security function alone and getting no buy-in from operations; and treating the installation as the finish line when the plan needs reviewing and exercising.

Do we need a security plan for an existing site, not just a new one?

Yes, and existing sites often have the greater need, because the layout already constrains what you can change. The sequence is the same — map the risks, decide what to protect, layer the measures against how the business actually runs — but the emphasis shifts from design to compensating for what the building will not let you do.

How often should a site security plan be reviewed?

On change rather than only on a calendar: new floors, new teams, a change of use, new contracts, new stock profiles, or after a serious incident. Reviewing the plan at the same time as the risk assessment keeps the two aligned instead of letting one drift.

Who should be involved in drawing up the plan?

Operations, facilities and HR alongside security. Operations because a plan that ignores how work actually happens will be quietly ignored; HR and facilities because they control access, onboarding and the physical changes; and leadership because the plan needs a budget and an owner to survive its first year.

The bottom line

Site security is a continuous decision, not a checklist. Get it in early, protect people, assets and information, layer the measures, keep it aligned with how the business runs — and accept that you will eventually need the continuity plan, so write it before you do. If you are planning a new site or location and want an independent read on the risks and the measures, see security risk assessment and how we work, or contact us with the site’s details.