A locked reception and several cameras don’t establish effective commercial building security. A business security system supports the plan, but can’t replace assigned responsibilities and a shared response process.
Shared entrances, different working hours and separate contractors create gaps that individual tenant arrangements may miss. Clear ownership matters as much as the equipment installed. Practical commercial security depends on arrangements that work across every occupier.
Start with the building’s actual operation, then connect physical protection, electronic systems and trained people through one coordinated security plan.
Key takeaways for property managers
- Commission a professional security risk assessment before buying equipment, then repeat it annually and after significant operational changes.
- Record which controls belong to the landlord, managing agent, security provider and individual tenants.
- Repair weak doors, gates and boundaries before adding electronic systems that depend on those barriers.
- Give each tenant suitable access permissions, with controlled arrangements for visitors, contractors and out-of-hours attendance.
- Connect alarms and surveillance to named responders, working contact details and clear escalation instructions.
- Test equipment, review incident records and measure provider performance against the agreed service, rather than relying on attendance alone.
Keep these decisions in one building security plan. Tenant procedures can sit alongside it, but they should explain how each business connects to the shared arrangements.
Start with a professional site risk assessment
Commission a competent security professional to assess the whole property, including shared spaces and the points where responsibility changes hands. Separate tenant assessments rarely reveal every weakness in communal entrances, loading areas or escape routes.
The assessment should establish credible threats, existing controls, likely consequences and the actions needed. A list of equipment is insufficient.
Inspect the routes people actually use
Walk the premises during normal activity and after dark. Include reception, pedestrian gates, loading bays, stairwells, roof access, plant rooms, bin stores, vacant suites and car parks.
Check how doors behave after deliveries and how people move during shift changes. Record whether a gate closes properly, whether visitors can bypass reception and whether contractors can reach another tenant’s premises.
Ask diagnostic questions. Who can enter? Who would notice? What happens next?
Consider opportunistic theft, unauthorised access, vandalism, social engineering, aggression and deliberate damage where these threats are credible. High-value stock, sensitive operations or a contentious public profile may require specialist advice.
Prioritise consequences, then assign actions
Record each weakness by location, condition, likely consequence and required action. Give it an owner, completion date and interim control.
For office accommodation, priorities may centre on reception bypass, stolen credentials and access to tenant floors. Warehouse accommodation adds vehicle movements, loading-bay exposure, stock handling and unattended shutters. Apply the assessment to the actual occupiers rather than copying another property’s controls.
Each measure should increase the effort required, increase the chance of detection, reduce the incentive or limit the available reward. Prefer controls that address several of these aims.
Repeat the risk assessment annually and after material changes. New tenants, altered hours, refurbishment, vacancy and changes to access arrangements can invalidate earlier assumptions.
Assign responsibilities across the building
The property manager should maintain a written responsibility schedule covering shared systems, tenant premises, contractors and emergency arrangements. Every recurring task needs an accountable role and a deputy.
Lease obligations, management agreements and statutory duties may overlap. A service contract can allocate work, but it doesn’t automatically transfer every legal responsibility.
Separate communal and tenant duties
The landlord or managing agent should coordinate the building plan, common-area records, shared-system maintenance and provider performance reviews. Each tenant should secure its own premises, maintain authorised-user information and report incidents promptly.
Security providers should deliver the agreed coverage, follow site instructions, maintain logs and escalate concerns. Contractors need defined working hours, sign-in arrangements and supervision rules near restricted areas.
The division should cover practical details: who repairs a communal door, who disables a departing employee’s pass and who authorises access to a vacant suite.
Fire duties require separate attention. GOV.UK’s guidance on workplace fire-safety responsibilities identifies employers, owners, landlords, occupiers and others with control as potentially responsible.
Close gaps between organisations
Appoint one building security lead with authority to coordinate shared arrangements. Each tenant should nominate a primary contact and an out-of-hours deputy.
Review emergency contacts quarterly and whenever somebody changes role. Record who receives routine faults, urgent access problems and confirmed incidents. A tenant’s general reception number is unlikely to be useful during a bank holiday closure.
Maintain a controlled version of the responsibility schedule. Distribute changes to affected tenants, reception staff, maintenance teams and responders, rather than leaving revised instructions in a management folder.
Repair physical weaknesses before adding systems
Physical protection should slow unauthorised entry and channel legitimate movement through controlled points. Start with damaged doors, unreliable closers, weak frames, loose fencing and gates that remain open after deliveries.
An electronic reader cannot compensate for a door that doesn’t latch.
Protect the boundary and secondary entrances
Avon and Somerset Police’s commercial-property security advice recommends security-rated boundary walls or fencing at least 2.1 metres high. Treat that as crime-prevention guidance, not a universal legal requirement.
The suitable arrangement depends on the site, planning constraints and access needs. Keep stored materials, bins and equipment away from boundaries where they could assist climbing.
Inspect rear doors, roof access, shutters and service entrances alongside the main frontage. Record who opens and closes each secondary entrance, particularly where several tenants share deliveries.
Control vehicle access without blocking escape
Security-rated bollards, heavy-duty concrete blocks and height restrictors can restrict unwanted vehicle access where the assessment supports them. Their placement needs competent design.
Preserve pedestrian accessibility, delivery manoeuvring and emergency-service access. Ordinary parking controls should not be described as protection against deliberate vehicle attack unless their performance supports that claim.
Keep keys, override controls and opening instructions available to authorised responders. A locked vehicle gate must not leave an emergency crew waiting for an absent tenant.
Make lighting and warning signs serve a purpose
Inspect exterior security lighting after dark, including car parks, rear approaches, loading bays and pedestrian routes. Assess what staff and cameras can see, not just whether the fittings switch on.
Constant low-level dusk-to-dawn lighting can support visibility without the sharp contrast caused by poorly positioned floodlights. Direct light towards access routes and faces without excessive glare or light spill.
Bollard-mounted lights are vulnerable to damage and may illuminate the ground without showing a person’s face. They can suit pedestrian landscaping, but shouldn’t be the main security lighting for an exposed entrance.
Keep planting trimmed and repair failed lamps promptly. Seasonal growth or a large waste container can make a previously clear camera view ineffective.
Warning signs for operating CCTV, alarms or patrols provide a low-cost deterrent. They should describe measures that exist, remain visible and carry the required privacy information where surveillance is used.
Pay particular attention to night-time vacancy, weekends and holiday closures. Lockable entry points and working lighting become more important when routine activity no longer provides observation.
Design access control around tenant boundaries
Commercial building security depends on deciding who may enter each area, at what time and under whose authority. A pass that opens every door creates convenience at the expense of separation.
Map public areas, shared facilities, tenant premises and restricted spaces before selecting readers or software.
Choose a system that supports shared administration
Networked or cloud-based access control generally suits buildings with several entrances, changing staff lists and separate tenant permissions. Standalone locks may remain suitable for a small number of contained spaces.
A cloud platform can support remote administration and faster changes. Its suitability still depends on connection arrangements, account security, local door operation and support during outages.
Compare access control systems for UK businesses against the building’s doors, tenant structure and operating hours. Include accessible entrances, lift permissions and future subdivision.
Give tenant administrators control over their own authorised users without allowing them to change another occupier’s permissions. Building-wide administration should remain restricted to appointed staff.
Control credentials throughout their lifetime
Issue individual credentials and record their owner, permissions and expiry. Shared fobs make incident investigation harder because a valid entry cannot reliably be linked to one person.
Tenants should notify management of departures, lost passes and role changes promptly. Disable lost credentials through a defined process, including outside office hours.
Use time-limited permissions for temporary staff and contractors. Review active accounts against current tenant lists, and record overrides rather than treating them as informal favours.
A credential record establishes that a pass was presented. It doesn’t prove who held it, whether somebody followed through or what happened inside.
Test door-held-open alerts, forced-door alerts and the response to each. Access control needs supervision as well as administration.
Control visitors, contractors and deliveries
Effective visitor management should establish an expected visit, a responsible host and a permitted destination. A sign-in record alone doesn’t authorise entry to a tenant’s premises.
Reception staff need a clear route for resolving uncertainty without admitting an unverified visitor.
Connect visitor approval to access permissions
Pre-registration and automated host notifications can reduce queues and improve the visitor experience. Keep the underlying approval decision clear.
Visitor software records attendance and visit details. Access control determines which doors or lifts a credential can operate. The connection between them needs defined rules.
Specify the information transferred, who authorises entry, when permission expires and who resolves synchronisation failures. Test revocation as well as successful admission.
Provide a staffed alternative for visitors who cannot use a touchscreen, smartphone or standard identification process. Reasonable adjustments should preserve security without excluding somebody through an inaccessible procedure.
Apply different rules to contractors and deliveries
Contractors may need working permits, escort arrangements or supervision near communications rooms, plant and other tenant areas. Their access should match the approved task and working window.
Deliveries need an agreed receiving point and a named recipient. Drivers should not gain general access because one tenant is expecting a parcel.
Record arrangements for early arrivals, failed collections, unattended goods and out-of-hours work. Reception should know which tenant can authorise exceptions and which requests require building management approval.
Train staff to challenge tailgating through a safe reporting process. They should be able to call security rather than physically block somebody or pursue them into another area.
Position CCTV for useful coverage
CCTV should answer defined operational questions: who entered, which route was used and what happened at the relevant location. Camera quantity alone doesn’t establish useful coverage.
Design coverage across the property, with attention to shared approaches and vulnerable spaces. This does not mean recording every activity in every tenant’s premises.
Match each camera to an observation task
Position cameras around entrances, reception, loading areas, car parks and other assessed risks. Consider the detail required, changing light, obstructions and the direction people approach.
Review recorded images during daylight and darkness. A clear live picture does not establish that recorded footage retains the detail needed for an investigation.
Avoid unnecessary views into neighbouring premises, private areas or unrelated workspaces. The ICO’s CCTV and video-surveillance guidance covers installation, operation, signage and data protection.
Train operators to retrieve evidence
Appoint trained staff who can locate incidents, export footage securely and preserve relevant material before routine deletion. Keep system clocks aligned so access events and video can be compared.
Document whether cameras are recorded only, actively monitored or viewed following an alarm. These arrangements provide different levels of intervention.
Analytics can flag movement or apparent intrusion, but alerts need assessment and an agreed response. Record missed events and false alerts so settings can be adjusted.
Keep an export procedure available during management absences. Footage that only one unavailable person can retrieve may be lost before an investigation begins.
Establish lawful surveillance and tenant privacy
Shared surveillance needs a defined purpose, a lawful basis and clear accountability. The organisation deciding why and how footage is processed will usually have controller responsibilities.
A landlord, managing agent and tenant may have different roles. Record the actual arrangement rather than assuming the equipment owner carries every obligation.
Set access and retention rules
Follow the ICO’s data-protection principles for surveillance when documenting the lawful basis, purpose and handling arrangements.
There is no universal CCTV retention period. Set one that reflects the purpose and the time normally needed to identify incidents. Preserve relevant footage separately when a reported event requires it.
Restrict viewing and exports to authorised users. Keep an access record, protect recordings and define the process for disclosure requests, including requests from police and individuals.
Tenants should not receive unrestricted access to footage of other occupiers merely because they contribute towards the shared system.
Limit unnecessary collection
Use clear signs and accessible privacy information identifying the controller and purpose. GOV.UK’s business CCTV requirements also address the ICO data protection fee and applicable exemptions.
Audio recording and biometric identification require separate justification. Where processing is likely to create a high risk to people’s rights, a data protection impact assessment is required.
Apply similar discipline to visitor records and access logs. Collect the information needed, restrict administrative accounts and delete records according to an agreed schedule.
Protect connected cameras, recorders and access platforms with maintained software, individual accounts and controlled remote access. A shared administrator password weakens both security and accountability.
Connect intruder alarms to a working response
An alarm system can detect an event without producing a useful response. A useful response needs a defined route between activation, assessment, attendance and recovery.
For vacant periods, monitored arrangements reduce reliance on somebody nearby hearing a sounder or noticing a phone notification.
Specify monitoring and separate alarm zones
Use reputable alarm companies with relevant certification. The National Security Inspectorate (NSI) and the Security Systems and Alarms Inspection Board (SSAIB) are recognised certification bodies; the NSI company directory identifies approved providers and their approval scope.
For continuous monitoring, specify an appropriately accredited Alarm Receiving Centre operating throughout the year. NSI Gold accreditation is relevant evidence, but the contract still needs response instructions and service arrangements.
Separate communal and tenant alarm zones where the design requires it. One tenant working late should not prevent protection of another tenant’s closed premises.
Include communications failure, backup power and authorised changes to opening hours in the design.
Define what happens after activation
A monitored alarm response should follow an agreed sequence:
- The receiving centre identifies the location, signal type and affected zone.
- The operator assesses available confirmation or video against the site instructions.
- The operator contacts the appointed responder and escalates according to the event.
- The responder attends, assesses conditions safely and reports the outcome.
- Management records repairs, temporary protection and any permission to reset the system.
Police attendance is not automatic for every activation. Eligibility, confirmation requirements and local response policies affect the route.
Keep keys, codes and access instructions current. A responder also needs the correct entrance, tenant details and authority to enter.
Security fogging may obstruct a burglar’s view where the risk assessment supports its use. Specialist design must account for occupants, escape arrangements and coordination with other systems.
Name both the person who receives the alarm and the person who can reach the affected area. Those may be different people.
Choose guarding, patrols and keyholding by function
Different services solve different problems. A permanent security presence can manage continuous activity, while mobile patrols provide intermittent inspection and keyholding provides a route for alarm attendance.
Selecting the cheapest hourly rate without defining the required function leaves gaps in coverage.
Use on-site guards where judgement is continuously needed
Manned guarding can suit busy reception areas, regular disputes, sensitive tenants, frequent deliveries or premises requiring immediate on-site decisions.
Assign duties clearly. A guard managing visitor queues cannot simultaneously patrol an extensive car park without leaving reception uncovered. Include breaks, relief cover, supervision and handover requirements.
Officers carrying out licensable activities need the appropriate authorisation. The government’s SIA licensing guidance explains when licensing applies.
Training and site knowledge remain necessary alongside the licence. Officers need instructions for tenant boundaries, emergency routes, evidence handling and escalation.
Use patrols and keyholding for defined gaps
Mobile patrols can inspect doors, boundaries, vacant areas and signs of damage during agreed visits. They do not provide continuous observation between attendances.
Compare manned guarding and mobile patrols against the periods and activities requiring protection.
Keyholding and alarm response can prevent untrained tenant staff being expected to investigate an overnight activation. Define geographical coverage, dispatch arrangements, safe attendance and the authority to arrange emergency repairs.
Require time-stamped attendance records and meaningful findings. A completed visit should establish what was inspected, what was found and what action followed.
Keep security compatible with fire and life safety
Security measures must preserve safe escape and the building’s fire strategy. Locked doors, turnstiles and vehicle barriers need assessment as part of the wider life-safety arrangements.
A security improvement that obstructs evacuation creates another risk.
Understand the legal duty for fire alarms
For England and Wales, the Regulatory Reform (Fire Safety) Order 2005 requires suitable fire precautions, including detection and warning where necessary.
There is no single fire-alarm specification imposed on every commercial property. The suitable system follows the fire risk assessment, layout, occupancy and use. Most commercial premises need an electrical warning system; more complex buildings may require automatic detection and coordinated controls.
Scotland and Northern Ireland have separate fire-safety legislation. Building regulations, premises type and local enforcement arrangements also affect requirements.
The responsible person must carry out and regularly review the workplace fire risk assessment. Multiple responsible persons sharing premises need to cooperate and coordinate their precautions.
Test interfaces and emergency escape
A competent designer should determine how controlled doors behave during fire alarm activation, power failure and system faults. Avoid a blanket instruction that every door must unlock under every failure.
Some openings provide escape, some protect fire compartments and others control access into restricted areas. Their functions need coordinated design.
Test the actual interfaces, including release arrangements and any manual override. Record the result rather than assuming separate contractors have covered the connection between their systems.
Security staff should know the building’s evacuation arrangements and their assigned role. They should not improvise a different response because a security incident occurs at the same time.
Fire detection, intruder detection and CCTV support different purposes, even where a common platform displays their events.
Build emergency communication around shared occupancy
A building-wide incident needs an appointed lead, clear messages and a way to reach every affected tenant. Separate company procedures can conflict when they share entrances, stairs and assembly areas.
Prepare for intrusion, aggression, suspicious items, major power loss and events affecting continued occupation, alongside the established fire arrangements.
Assign authority and communication channels
Identify who can order evacuation, restrict access, contact emergency services and authorise re-entry within the relevant plan. Include cover for evenings, weekends and management absences.
Use communication channels that match the building. A tenant email list may support routine updates but will not reliably reach cleaners, visitors or contractors during an urgent event.
Combine suitable alarms, announcements, direct contact and staff instructions. Messages should state the required action and usable route without speculation about an unconfirmed threat.
Keep essential contacts and instructions available if the normal network fails. Accessible communication and assistance arrangements should reflect the people using the premises.
Practise coordinated response and recovery
Run exercises involving property management, security and tenant representatives. Test a shared entrance becoming unavailable, an incident outside normal hours and a failure affecting access control.
Include people working alone, occupants needing assistance and visitors whose host has left. The exercise should expose missing authority and contact gaps, not merely demonstrate that a message can be sent.
After a real event, record the timeline, immediate safeguards and authority for reopening. Secure evidence and assign repairs before returning to normal operation.
Define temporary arrangements for tenants who cannot use their premises. Access to alternative workspaces, essential equipment and deliveries may need coordination while the affected area remains restricted.
Make shared spending and procurement transparent
Separate communal protection from work serving one tenant’s premises. Shared gates, fencing, surveillance and guarding may be recoverable through the service charge where the lease permits. A tenant’s internal alarm or shutter repair may fall under different obligations.
Issue a concise budget note before procurement. State the risk addressed, proposed service level, contract term, mobilisation cost, recurring charges and review date.
There is no dependable average cost for an unspecified multi-tenant security system. Door count, cable routes, coverage, operating hours and response arrangements materially change the scope.
When procuring a business security system, compare quotations on the same basis. Hardware-only pricing cannot be compared fairly with an installed system that includes monitoring, maintenance and support.
Include software licences, connectivity, replacement credentials, batteries, call-outs, training and eventual replacement. Guarding costs also depend on coverage hours, relief requirements and supervision.
Set acceptance criteria before installation or mobilisation. Require evidence that permissions work, alarms reach the correct destination and staff can operate the systems.
For commercial security guard services, define the required duties and reporting alongside coverage. A staffed post is only part of the service.
Keep ownership of records, administrator access and exit arrangements clear. The building should retain operational control when a provider changes.
Test systems and review security performance
Maintenance should establish that each control performs its intended function. A powered recorder, an illuminated reader or a completed patrol form provides only partial evidence.
Set the maintenance schedule using the current risk assessment, the equipment, applicable standards, manufacturer instructions and fire strategy.
Separate routine checks from specialist servicing
Daily operational checks can cover door closure, visible damage, recording status and unresolved faults. Many security arrangements also benefit from weekly or monthly functional tests, but these are not universal intervals for every system.
Fire alarms and emergency lighting have their own testing and servicing requirements. Common non-domestic arrangements include weekly fire-alarm user tests and monthly emergency-lighting function tests, alongside specialist servicing and longer-duration tests.
Use competent contractors for work requiring technical inspection. Coordinate tests with monitoring centres and affected tenants so a planned activation does not prompt an unnecessary response.
Test controlled failure conditions safely. Include loss of connectivity, backup power, expired credentials and escalation when the first contact is unavailable.
Measure results and close outstanding actions
Review provider performance monthly against agreed measures. Useful evidence includes completed patrols, unfilled coverage, incident reporting times, unresolved defects and compliance with escalation instructions.
Distinguish acknowledgement, dispatch and arrival. A fast acknowledgement does not establish that assistance reached the building promptly.
Review false alarms and repeated door-held-open events for underlying causes. Poor hardware, unsuitable procedures and everyday workarounds may matter more than deliberate misuse.
Hold coordinated tenant reviews and update instructions when operating conditions change. Maintain training records, incident reports, maintenance certificates and action logs in a controlled location.
Close each action only when the result has been demonstrated. Record the repair, the functional test and the person accepting completion.
A fault report remains open until the affected security function has been restored or an authorised temporary arrangement is recorded.
Frequently asked questions
What is the best security system for a multi-tenant building?
The most suitable arrangement combines controlled entrances, tenant-specific permissions, appropriate CCTV, monitored alarms and an agreed response. The balance depends on occupancy, operating hours and consequences of failure. An integrated platform can help operators coordinate events, but integration does not replace maintained doors, trained staff or clear authority. Assess those requirements before choosing a product.
Can tenants use their own security systems?
Tenants can have separate systems where lease and building arrangements permit. Their installation should not compromise shared fire precautions, communications infrastructure or other occupiers’ privacy. Record connections to communal systems, access needed by responders and responsibility for maintenance. Independent equipment still needs coordination where its activation affects the rest of the building.
Should staff respond to an overnight alarm?
Staff should not be expected to investigate a potentially unsafe situation simply because they hold keys. A planned keyholding service can provide controlled attendance and escalation. Where employee attendance forms part of the arrangements, assess lone-working risks, define limits and provide suitable instructions. Nobody should enter where circumstances indicate a possible crime or immediate danger.
How often should the overall security plan change?
Review the professional assessment annually and after material operational changes. Update individual instructions as soon as a relevant change occurs, including altered contacts, tenant departures, new access permissions or temporary works. Quarterly contact reviews and routine performance meetings help maintain the plan between full assessments. An annual review does not justify leaving known errors unresolved.
Make every security layer accountable
Effective multi-tenant security connects a defined risk to a working control, a responsible role and an appropriate response. Equipment provides protection only within those arrangements.
Keep the building plan current, preserve tenant boundaries and require evidence that faults have been resolved. Shared accountability closes the gaps that individual systems leave behind.
Start with the weakest shared entrance, the unanswered contact or the unclear instruction. Those ordinary failures often determine whether the wider security arrangement works.
0 Comments