What a UK Business Security Risk Assessment Should Cover

A list of cameras, locks and alarms isn’t a business security risk assessment. A useful assessment identifies credible threats, explains how existing weaknesses could expose people or operations, and assigns action according to the likely consequences.

It should cover premises, access, staff, visitors, assets, suppliers, emergencies and relevant cyber systems. The practical test is whether controls work, including after hours and when normal arrangements fail.

Start with the business as it operates, then record what needs protecting, what could happen and who must act.

Key takeaways

• Assess physical security, staff procedures and connected technology together, because weaknesses often sit between departments rather than within individual systems.
• Distinguish statutory duties covering health and safety, fire and personal data from recommended security practices and contractual requirements.
• Inspect the routes people actually use, including shared entrances, loading areas, rear doors and access outside normal working hours.
• Rank risks using consistent likelihood and impact definitions, supported by incident records, observations and evidence about existing controls.
• Give each finding a named owner, a completion deadline and a clear method for confirming that corrective work is effective.
• Review the assessment after incidents and operational changes, rather than relying on an annual date to identify new exposure.

What a business security risk assessment establishes

A risk assessment connects assets, threats, vulnerabilities and consequences. Assets include staff, stock, information, equipment, premises and the ability to keep trading. Critical assets are those whose loss would stop or materially disrupt trading.

A threat is a potential cause of harm. A vulnerability is a weakness that allows that threat to cause damage.

Separate risk assessment from a security survey

A survey may identify damaged fencing, poor lighting or gaps in camera coverage. A vulnerability assessment examines how weaknesses could be exploited. A broader risk assessment also considers credible threats, business impact and the level of risk management is prepared to retain.

An audit usually tests arrangements against requirements, policies or standards. These activities can support each other, but they answer different questions. A working lock establishes something about a door, not whether the right people hold its keys.

Define the decision the assessment must support

Set out whether the assessment supports routine operations, a relocation, changed opening hours, a new tenant or a particular concern. That purpose determines the required detail.

The result should be a usable risk register and action plan. A lengthy report that recommends equipment without explaining priorities leaves management with purchasing decisions rather than clear risk decisions.

Record limitations too. A daytime inspection cannot establish whether lighting, overnight staffing or out-of-hours alarm response is adequate.

Distinguish UK legal duties from recommended practice

There is no single law requiring every UK business to complete an assessment with this exact title. Duties arise through the activities undertaken, the people affected and the information handled.

A combined security report can support several duties. It doesn’t automatically satisfy each one.

Health and safety duties include foreseeable security-related harm

In Great Britain, the Management of Health and Safety at Work Regulations 1999 require suitable and sufficient assessment of workplace health and safety risks. This includes foreseeable violence and other security-related risks to people.

The HSE’s risk assessment guidance covers employees and others affected by work. Employers with five or more employees must record significant findings. Written records remain sensible for smaller employers.

Northern Ireland has separate legislation, including the Management of Health and Safety at Work Regulations (Northern Ireland) 2000. Avoid presenting Great Britain legislation as though it applies unchanged throughout the UK.

The employer retains its responsibilities when security work is outsourced. A guarding contract doesn’t remove duties towards employees, contractors or visitors.

Fire and data protection have separate requirements

For most non-domestic premises, England and Wales use the Regulatory Reform (Fire Safety) Order 2005. Scotland uses the Fire (Scotland) Act 2005 and Fire Safety (Scotland) Regulations 2006. Northern Ireland uses the Fire and Rescue Services (Northern Ireland) Order 2006 and Fire Safety Regulations (Northern Ireland) 2010.

Responsible roles and detailed requirements differ. The government’s workplace fire safety responsibilities explain the responsible person’s duties under the England and Wales framework.

UK GDPR requires appropriate technical and organisational measures for personal data, based on risk. The ICO’s data security guidance applies to information in visitor logs, access records and CCTV as well as business systems.

Insurance conditions, lease obligations and customer contracts may impose additional requirements. Record these separately from statutory duties so managers can distinguish legal compliance from contractual obligations and recommended practice.

Set the scope and assign accountability

Define the premises, activities, operating hours and systems covered before inspecting individual controls. Include temporary arrangements, shared facilities and work carried out away from the main building.

Record exclusions. Otherwise, an omitted warehouse, remote connection or communal entrance may be mistaken for an assessed area.

Map critical assets and operating conditions

Identify what would stop the business working, not simply what would cost most to replace. A low-cost network switch or specialist key can interrupt an operation more severely than expensive office furniture.

Record where assets are kept, who uses them and what depends on them. Consider delivery peaks, shift changes, lone working, seasonal stock, hybrid occupancy and periods when parts of the premises are unused.

Separate landlord, tenant and managing-agent responsibilities. Shared entrances and loading areas need agreed ownership even where no single business controls the whole space.

Give decisions to people with authority

Appoint a coordinator who can obtain records, involve departments and track actions. Name the senior manager who can approve expenditure, resolve disagreements and accept residual risk.

Facilities, operations, HR, IT and security should contribute where their responsibilities overlap. Reception staff, cleaners and maintenance teams often identify routines that formal procedures miss.

Government Secure by Design principles place risk ownership across the service lifecycle. Its approach starts assessment at project inception, with accountability held by the senior responsible officer and service owner. Private businesses can apply the same principle through equivalent management roles.

Inspect premises during real operating conditions

A walkaround should establish how somebody could approach, enter, move through or interfere with the premises. Following only the main entrance route leaves important assumptions untested.

Inspect during normal activity and quieter periods. After-dark conditions can change visibility, staffing and the practical response to an incident.

Follow boundaries, deliveries and alternative routes

Check fencing, gates, shutters, external doors, accessible windows, roof approaches, bin stores and plant areas. Look for damaged sections, concealed approaches and objects that provide climbing assistance.

Observe deliveries. Establish whether gates close afterwards, vehicles are expected and drivers remain within permitted areas. A gate that works during a demonstration may remain open throughout a busy dispatch period.

Include vacant units, temporary works and neighbouring activities. Scaffolding, a new access road or an adjoining empty property can change exposure without altering the business’s own entrance.

Record vulnerabilities by exact location and condition. “Poor rear security” gives a maintenance team little direction.

Test detection and response as one arrangement

Review lighting, CCTV, intruder alarms and communications as security controls. Check their intended function, which areas they cover, who receives alerts and what happens when an alert cannot be confirmed.

Camera coverage doesn’t establish that somebody will respond. Review maintenance records, faults, recording availability and authorised access to footage.

Establish whether alarms depend on mains power, broadband or a single contact. Record fallback arrangements where those dependencies fail.

Any physical or technical testing should be authorised and controlled. Unannounced intrusion exercises can create safety problems and misleading incident reports.

Assess access control, staff and visitors

Access arrangements should explain who may enter, which areas they may use and when permission ends. A functioning reader cannot compensate for shared credentials or unremoved permissions.

Inspect public entrances, staff routes, delivery doors and emergency exits together. Each forms part of the same access boundary.

Check permissions throughout employment and tenancy

Review keys, fobs, codes and administrator accounts. Establish who authorises access, who issues credentials and who removes them when employment, tenancy or a contract ends.

Sample current permissions against actual responsibilities. Include temporary workers, cleaners, maintenance contractors and staff transferred between departments.

Lost credentials need a clear reporting route and prompt cancellation. Shared codes should have controlled distribution and a defined replacement process. The practical requirements for commercial access control systems include administration and door hardware, not only readers.

Record who owns exceptions, such as access granted outside standard hours or to a normally restricted room.

Test visitor handling and staff reporting

Establish how visitors are expected, identified, admitted and escorted where required. Delivery drivers should know where to wait and who can authorise movement beyond the receiving area.

Review whether visitor records support emergency accountability without unnecessarily exposing personal information. A sign-in entry alone doesn’t establish where somebody went.

Staff need a safe way to report tailgating, suspicious requests or an unfamiliar person in a restricted area. Avoid procedures that expect an untrained employee to confront somebody.

Include opening and closing routines. Reduced occupancy can leave reception, isolated floors or external car parks without the support available during normal hours.

Cover theft, fraud, violence and insider risks

Use credible threats supported by the business’s assets, activities and experience. A retailer, distribution centre and professional office may share some weaknesses but face different opportunities for loss.

Consider deliberate acts and ordinary mistakes. Both can create security incidents.

Examine how stock, money and information move

Review receiving, storage, dispatch, returns, waste removal and stock adjustments. Identify where one person can authorise, release and reconcile valuable goods without another check.

Include cash handling, payment changes, purchase approvals and requests apparently sent by senior staff or suppliers. Social engineering can exploit a telephone conversation as readily as an email.

Insider risk includes malicious conduct, negligence and compromised accounts. Apply proportionate access, separation of duties and reporting controls rather than treating every employee as a suspect.

Use losses, discrepancies and near misses as evidence. An absence of recorded incidents may reflect weak reporting rather than limited exposure.

Assess violence against the actual work

Consider customer aggression, disputes, cash handling, isolated working, enforcement activities and predictable confrontation points. Staff interviews can reveal threats that never reached an incident log.

Record who may be harmed, when support is limited and how assistance is summoned. Include contractors and security officers, not only directly employed staff.

Controls may include layout changes, staffing arrangements, clear withdrawal procedures and reliable communications. Training has limits where staff cannot summon help or leave safely.

Where high-value assets, sensitive operations or a contentious public profile create greater exposure, use competent specialist advice. Threats should remain proportionate to the evidence.

Include fire, emergencies and safe movement

Security arrangements must support safe escape and emergency access. Additional locks, shutters or vehicle barriers can introduce harm if their emergency operation has not been considered.

The security assessment should identify these interactions. It doesn’t replace the required fire risk assessment.

Coordinate security with emergency procedures

Review escape routes, access-controlled doors, assembly arrangements and assistance for people who may need support. Consider contractors, visitors and staff working outside normal hours.

Establish how emergency services gain access and receive information about hazards or missing people. Give security staff defined responsibilities without expecting them to take unsafe risks.

Written security guard evacuation duties should fit the site’s emergency arrangements. Instructions must remain usable when reception is unattended or communications fail.

Exercise changes with the people expected to carry them out. A procedure understood only by the daytime manager leaves an out-of-hours gap.

Consider different protective responses

Fire, violence, a suspicious item and an external threat may require different movement decisions. Record who can order evacuation, restrict entry or direct people to a safer internal area.

Terrorism preparedness should reflect the premises and activities. The Terrorism (Protection of Premises) Act 2025, known as Martyn’s Law, received Royal Assent on 3 April 2025. The Home Office’s Martyn’s Law factsheet sets out an implementation period of at least 24 months.

Preparation for future requirements should be distinguished from duties already in force.

Connect physical security with cyber and information risks

Connected security equipment belongs in the assessment because it links physical security to business systems and cyber risk. CCTV recorders, access controllers, intercoms and alarm systems may expose information or provide a route into other systems.

IT and facilities should assess these dependencies together. A locked communications room doesn’t resolve an exposed supplier login.

Identify systems and credible attack routes

Record equipment ownership, software support, administrator permissions and remote connections. Review patching, default credentials, multi-factor authentication where available, and separation between security devices and other business networks.

The CVE vulnerability catalogue identifies publicly disclosed vulnerabilities. Record only those that match the product and version, alongside other exploitable vulnerabilities found during the review. A published weakness isn’t automatically a site risk.

MITRE ATT&CK describes observed attacker tactics and techniques. It can support threat modelling, which examines plausible routes through systems and controls.

Neither resource replaces local evidence. Assess exposure, access and business consequences before assigning a priority to a technical finding.

Assess information loss and recovery

Cover email compromise, ransomware, lost devices, paper records, shared accounts and unauthorised access to confidential information. Include the operational effect of losing access to systems even where no data is stolen.

Review backups, restoration evidence, incident reporting and secure disposal. Assess whether CCTV and access logs have suitable permissions and retention periods.

A data protection impact assessment is a separate requirement where processing is likely to create high risks for people’s rights and freedoms. Biometric access or extensive monitoring may require that additional assessment.

IBM’s 2024 data breach research reported a global average cost of USD 4.88 million. That figure describes its research population, not an expected loss for a UK small business.

Assess suppliers and business continuity dependencies

A business can have sound internal controls while depending on a supplier whose access, staffing or recovery arrangements remain unclear. Record those dependencies as part of the operation.

Include landlords, managing agents, maintenance firms, IT providers, security contractors and critical delivery partners.

Define supplier access and performance

Establish which suppliers can enter restricted areas, hold keys, view recordings or connect remotely. Access should have an authoriser, a defined purpose and a removal process.

Contracts should identify incident reporting, confidentiality, data handling and service failure responsibilities. They should also explain what happens when the normal contact is unavailable.

Use measurable security contract performance indicators where guarding, patrols or response services form part of a control. Attendance, completed checks and escalation records provide better evidence than general assurances.

For payment environments, PCI DSS requirements protect payment account data. PCI DSS is an industry standard commonly applied through contractual arrangements, not a general UK security statute.

Assess what happens when a dependency fails

Identify activities that cannot continue without a particular building, machine, system or supplier. Record the maximum tolerable interruption and the minimum resources needed to restart.

Consider denied access following a police investigation, damaged entrances, stolen specialist equipment, power failure and unavailable communications. A building may remain standing while its business function is unusable.

Assign responsibility for staff communications, temporary premises, alternative suppliers and customer updates. Define recovery priorities through business impact rather than replacement value alone.

Test whether emergency contacts and recovery instructions remain available when the main network or premises cannot be accessed. Keeping the only copy inside the affected building creates another dependency.

Turn observations into clear risk statements

Record an event and its consequences, not a vague topic such as “poor security” or “cyber risk”. A useful risk statement explains what could happen and which existing vulnerabilities allow it.

This is where inspection findings become assessable business risks.

Connect the threat, weakness and consequence

Secure by Design uses this risk statement structure:

There is a risk that [threat actor] [threat event] by exploiting [vulnerability of asset] resulting in [consequences].

Use that structure to connect an unauthorised person, an entry route, a vulnerable door and the resulting harm. Consequences may include theft, assault, information exposure or interrupted trading.

Keep separate risks separate where their causes, owners or treatments differ. Combining every issue affecting a loading bay into one entry makes corrective work difficult to assign.

Record evidence and uncertainty

Support statements with observations, incident records, maintenance history, permission reviews and staff accounts. Separate confirmed vulnerabilities from assumptions, and state what remains unknown.

The NCSC basic risk assessment method contains 11 steps, beginning with context and ending with continual iteration and improvement. The NCSC presents it as a starting point, not an approved method for every situation.

Its practical message is wider than scoring. Understand assets, threats, vulnerabilities and controls before deciding how to respond. Threat modelling can help examine plausible routes from a hostile source to an asset.

Score likelihood and impact consistently

Risk severity combines the chance of an event with its consequences. Scores support decisions; they don’t establish a mathematically precise probability.

Use the same definitions throughout the assessment and record the period being considered, such as the coming operating year.

Define the scale before assigning numbers

Secure by Design uses likelihood from 1, Unlikely, to 5, Almost certain. Impact runs from 1, Minor, to 5, Critical.

The following table pairs those endpoints with practical descriptions for an internal scale.

Translate impact into relevant measures, including injury, downtime, financial loss, information harm and legal consequences. Use the highest credible impact rather than averaging serious harm away.

Explain the basis for the score

Multiply likelihood by impact to obtain a severity score out of 25. Secure by Design’s example is 4, Probable, multiplied by 4, Severe, giving 16 out of 25, rated High.

Document the reasoning beside the numbers. Repeated unauthorised entry, a door left open daily and no effective challenge provide different evidence from a theoretical access route.

Define escalation thresholds and approval authority in advance. Matrix bands vary between organisations.

A low likelihood score doesn’t remove an applicable legal duty. Serious foreseeable harm may require action even when another risk produces a larger numerical score.

Work through a rear-door risk before choosing controls

A retailer’s rear stockroom entrance provides a practical structure for a worked assessment. The scores below are illustrative assumptions, not findings about a particular business.

The assumed conditions are an unattended delivery door, accessible stock and repeated occasions when the door remains open after deliveries.

Calculate the current risk

The risk statement is that an unauthorised person could enter the stockroom through an unsecured delivery door, resulting in stock loss and possible confrontation with staff.

Assume likelihood is 4, Probable, because the opportunity repeatedly occurs. Assume impact is 4, Severe, because the credible consequences include substantial stock loss, disruption and staff harm.

The calculation is 4 x 4 = 16, rated High under the Secure by Design example. The score depends on those stated conditions. Different stock values, supervision or consequences could change it.

Estimate the effect of corrective action

Potential actions include repairing the closer, defining delivery supervision, restricting onward access and recording faults immediately. Assign facilities responsibility for the door and the operations manager responsibility for the routine.

If completed and tested controls justify reducing likelihood to 2, while impact remains 4, the residual score becomes 8.

That reduction is a prediction until evidence supports it. Record the proposed score separately from the confirmed score.

If the door still remains open during peak deliveries, the underlying opportunity persists. Installing equipment alone doesn’t justify closing the action.

Document findings in a usable risk register

A spreadsheet can be sufficient if entries are clear, controlled and reviewed. The register should connect each risk to its evidence, decision and remaining work.

Secure by Design explicitly includes business impact, threat likelihood, risk severity, accountability and risk ownership. Additional fields help premises teams manage delivery.

The following entry carries the rear-door example into a practical record.

The example is a template, not a complete assessment. Actual entries need site evidence, named individuals or clearly assigned roles, and real completion dates.

Keep action ownership distinct from risk ownership. A contractor may repair the door, while the operations manager remains responsible for managing the exposure.

Government terminology may use SRO for senior accountability and IAO for an information asset owner. Use titles that match the organisation’s structure rather than importing labels without authority.

Restrict access to the register where it contains exploitable weaknesses, sensitive layouts or personal information. Circulate operational instructions to those who need them without distributing every vulnerability.

Prioritise treatment and assign practical actions

Deal first with immediate danger, applicable legal requirements and exposures that exceed agreed tolerance. Use the score alongside the evidence, not as an automatic purchasing order.

Record interim protection where permanent work will take time. An unresolved high risk needs an active decision.

Choose a clear risk response

The NCSC identifies four response options: treat, avoid, transfer or accept.

Treating changes controls. Avoiding stops or changes the activity creating exposure. Transferring may involve insurance or contractual allocation. Accepting requires an authorised decision to retain the remaining risk.

Insurance may offset covered financial losses. It doesn’t remove injury, disruption, regulatory duties or every consequence of an incident.

Match security controls to their function. Repairs may reduce entry opportunities; supervision may identify misuse; recovery arrangements may reduce downtime. State which effect is expected and why.

Match the security arrangement to the operating need

Where staffing is proposed, define the task, coverage and response authority. Continuous access supervision requires a different arrangement from periodic checks of an otherwise closed site.

Compare manned guarding and mobile patrol options against those requirements. A patrol visit cannot provide continuous observation between visits.

Each action should state the required outcome, owner, deadline, interim measure and closure evidence. “Improve staff awareness” is too broad. Specify the procedure, affected roles, briefing requirement and observation used to test understanding.

A risk score should fall because exposure has changed, not because an action has been marked complete.

Keep reviews proportionate and tied to change

Review frequency should reflect the risk, not a single universal timetable. An annual full review is a practical baseline for many premises, supported by more frequent attention to significant actions.

A fixed date doesn’t justify waiting when operating conditions change.

Reassess after incidents and material changes

Trigger a review after a break-in, violent incident, serious near miss, relocation, layout change or major system installation. Review changes to opening hours, staffing levels, stock profiles and supplier access, as well as system changes that affect physical exposure or cyber risk.

Black Duck’s assessment guidance recommends assessment at least once every other year and annual assessment of critical assets with higher impact and likelihood. That is vendor guidance, not a universal statutory UK review interval, and it shouldn’t delay a review after material change.

Secure by Design takes a lifecycle approach, starting at project inception and repeating assessment throughout service delivery. Apply the same reasoning when premises or operations change.

Review significant open actions regularly. Repeated missed deadlines require a management decision about resources or temporary restrictions.

Use a concise small-business completion checklist

A smaller operation may use one combined register rather than separate departmental systems. Keep enough detail to support decisions and follow-up.

• Confirm that the assessment covers occupied areas, shared spaces, operating hours and relevant systems.
• Record credible threats, exposed assets, existing controls and the evidence behind each judgement.
• Explain likelihood and impact scores using definitions that remain consistent across entries.
• Assign every required action to an owner with authority, a deadline and closure evidence.
• Document who accepts residual risks and when those decisions must be reconsidered.
• Retain a review date alongside triggers for earlier reassessment.

The scale can be modest. Responsibility and evidence still need to be clear.

Frequently asked questions

What are the five steps of a security risk assessment?

A practical five-step model is to define scope and assets; identify threats and vulnerabilities; assess likelihood and impact; select treatments; and record, monitor and review.

A seven-step model usually separates some of those activities, such as asset identification, control review or documentation. There is no universal step count for all UK businesses.

The assessment is complete when it supports clear decisions and assigned action. Dividing the process into more headings doesn’t establish greater rigour.

How do Black Duck and Panorays describe the process?

Black Duck describes four steps: identification, assessment, mitigation and prevention. Its emphasis is technology infrastructure and information security.

Panorays describes three phases: identification; gap analysis and prioritisation; and remediation. These are different ways of grouping assessment and treatment activities.

Neither structure replaces the need to examine physical premises, staff safety and operational dependencies where those matter. Choose a repeatable process that fits the business rather than treating a vendor’s terminology as a legal requirement.

Who should carry out the assessment?

Appoint someone competent for the scope and able to recognise when specialist help is required. A facilities manager may coordinate a straightforward premises assessment with operations, staff and IT input.

Complex cyber systems, serious violence exposure, sensitive assets or unusual premises may require specialist competence. Fire assessment duties also require appropriate capability.

Management retains responsibility for decisions, funding and accepted risk. An external assessor can identify and explain exposure, but cannot make internal accountability disappear.

Conclusion: make each finding an accountable decision

A business security risk assessment should explain what could happen, what allows it and what the consequences would be. Its value depends on evidence and follow-through, not the number of controls listed.

Record the priority, assign the owner and define how completion will be tested. Keep legal duties separate from recommendations and accepted commercial risks.

The assessment remains useful only while it reflects the premises, people and operating conditions it is meant to protect.