Since 1985ISO 27001 compliantPublic sector: GSA · CMAS · TESMA

LA 562-298-5000 · Chicagoland 312-432-5300 · Phoenix 602-733-6807 · Client Support

Free fillable checklist · Physical security

Commercial Security Self-Assessment Checklist

An 80-point, scored physical security audit for facilities, operations, security and IT leaders, covering entry points, access control, video, alarms, visitors, connected-device cyber protection, emergency response and multi-site governance. Fill it in on screen or print it.

  • 8 scored sections and 80 items, fillable on screen
  • Score bands that show where to act first
  • One-page action plan and 90-day priorities
Get the Free GuideDownload the PDFCall 800-HELP-BTI (800-435-7284)
40 yearsIn business since 1985
ISO 27001Compliant
GSA · CMAS · TESMAContract awardee
Free PDFReviewed October 2026
LA · CHI · PHXLocal offices, U.S. coverage
At a glance

What This Guide Answers

A physical security checklist is a structured walkthrough that rates each control as good, needing improvement or a critical gap. This free, fillable checklist has 8 sections and 80 items. Walk the facility with your facilities, security, IT and operations leads, score every item, total each section, then copy critical gaps into the action plan. Plan about 90 minutes per site.

What’s inside

What’s Inside the Commercial Security Self-Assessment Checklist

  • Section 1: Building access and entry points
  • Section 2: Access control and credentials
  • Section 3: Video surveillance and recording
  • Section 4: Intrusion alarms, duress and monitoring
  • Section 5: Visitors, contractors and deliveries; Section 6: Cyber protection for connected security
  • Section 7: Emergency response and workplace violence; Section 8: Multi-site governance and lifecycle, plus an action plan

Send Me the Guide

Key takeaways

Key Takeaways From the Guide

Simple, consistent scoring

Good = 2, Needs improvement = 1, Critical gap = 0. Leave N/A items blank and subtract 2 from that section’s maximum of 20.

Score bands show where to act first

85% or more is Strong (maintain and test); 60-84% is Moderate (fix within 6-12 months); below 60% is High risk (address critical gaps within 90 days). Bands are BTI planning guidance, not a regulatory standard.

Offboarding speed matters more than badges

Departing employees should lose access the same day, ideally automatically through HR or identity integration, and access levels should be reviewed at least quarterly.

Move off 125 kHz prox and Wiegand

Readers should use encrypted smart credentials and OSDP Secure Channel.

Copper phone lines are a silent failure risk

Alarm panels that rely only on POTS lines should move to cellular or dual-path communication confirmed by the monitoring center.

California workplace-violence plans are required

Labor Code §6401.9 (SB 553) has required a written plan, violent-incident log and training for most employers since July 1, 2024.

Run it at least annually

Repeat per site every year and after a major incident, renovation, tenant change or new system installation.

Facts are taken from the guide, which cites dated sources (retrieved October 2026). Dates and product lifecycles change; confirm before ordering or filing. Not legal advice.

Who it’s for

Who Should Read This Guide

Facilities and operations managers responsible for one or many sites

Security directors preparing budgets and project lists

IT leaders responsible for cameras, controllers and other connected security devices

Multi-site organizations standardizing security across locations

Related services

How BTI Helps You Act on the Guide

BTI Communications Group has served organizations since 1985 and designs, installs and supports managed IT, cybersecurity, networks, communications and integrated security systems for regulated, multi-site organizations from Los Angeles, Chicagoland and Phoenix. BTI is ISO 27001 compliant and holds GSA, CMAS and TESMA contracts.

More free guides: BTI resources library.

FAQ

Commercial Security Self-Assessment Checklist FAQ

What should a physical security checklist include?

Entry points, access control and credentials, video surveillance, intrusion alarms and duress buttons, visitor and contractor control, cyber protection for connected security devices, emergency response and, for multi-site organizations, governance and lifecycle planning.

How often should we run a security self-assessment?

At least annually per site, and after a major incident, renovation, tenant change or new system installation.

Who should complete the checklist?

A small team: facilities, security, IT and an operations or executive sponsor. IT should join for Section 6 on connected security devices.

Why does the checklist ask about copper phone lines?

Many alarm panels still signal the monitoring center over copper (POTS) lines, which carriers are retiring. Cellular or dual-path communicators avoid silent failures.

Can BTI review our results?

Yes. A BTI business advisor can review your scores, walk the site and turn the gaps into a prioritized plan and budget for each location.

Free download

Get the Commercial Security Self-Assessment Checklist

Request the guide below and a BTI business advisor can walk through it with you for your sites. Prefer to skip the form? Download the PDF directly.

Communication

Let's Start a Conversation

What's the best way for us to contact you?

IT Services

Let's Start a Conversation

What's the best way for us to contact you?

Top quality brands, expert engineering, transparent cost, and maximum ROI.