Site security self-assessment: score your property’s planning in 43 questions

The answer in brief

This self-assessment scores your property’s security planning in 43 questions across seven sections. Answer each one Yes, Partly, No or Not applicable, and the tool shows a percent for each section and for the whole list, with the No answers gathered at the end so you can see where to start.

HALO orders the list by what each measure does, in the order an incident unfolds: know the site, deter, detect, delay, respond, train people, then recover and review. That order is our own way of organizing the list, not a named standard. It shows which job is weak, so a property with strong signs and lighting but no written emergency steps sees that gap clearly.

The questions draw on public guidance from CISA, OSHA, Cal/OSHA, the California Bureau of Security and Investigative Services (BSIS), Ready.gov and two Bay Area CPTED sources, all read in November 2026. Every question is also written out below the tool, so the list works on paper too.

How the score is worked out

Each answer earns points, and Not applicable takes the question out of the total so it neither helps nor hurts. A section’s percent is the points earned divided by the points possible on the questions you answered. The overall percent uses every answered question at once, so it is not an average of the seven section scores.

2. Deter: show that the property is claimed and cared for

Deterrence is the message a property sends before anyone tests it: this space belongs to someone and that someone pays attention. The crime prevention through environmental design (CPTED) guidance from the Town of Danville and the Menlo Park Police Department rests on clear borders and steady upkeep, and these five questions come from that idea.

• 2.1 Can a visitor see where public space stops and your property starts, from fencing, plantings, paving or signs? Why it matters: A clear border tells people someone is responsible for the space.
• 2.2 Are private-property, hours-of-use or similar signs posted where people come onto the site? Why it matters: Signs tell people the property is managed.
• 2.3 Can the street address be read from the street by day and after dark? Why it matters: Responders find the site faster; Danville's handbook suggests lit numbers at least 4 inches high.
• 2.4 Is graffiti cleaned off quickly and broken fixtures repaired? Why it matters: Neglect suggests nobody is watching and invites more misuse.
• 2.5 Are shrubs kept low and tree canopies raised so they hide no one and block no views? Why it matters: Danville's handbook suggests shrubs near 3 feet and canopies near 7 feet for clear sightlines.

4. Delay: slow down unwanted entry

Delay buys time between someone deciding to get in and reaching what they want. CISA describes security in depth as outer, middle and inner layers, and the questions here test each layer: one public entrance, locked side doors, solid locks, a visitor process, key control and vehicle barriers where people gather.

• 4.1 Have you named the outer layer (lot, fence line), middle layer (grounds, building shell) and inner layer (rooms such as server and file rooms)? Why it matters: Layers slow or discourage anyone trying to reach what matters most.
• 4.2 Do walkways, plantings and signs lead visitors to one main public entrance? Why it matters: Fewer public entrances are easier to watch.
• 4.3 Are doors not in use kept locked, delivery and trash doors included, in line with fire code? Why it matters: A side door left open is an entry point nobody controls.
• 4.4 Are exterior doors solid, with a sturdy deadbolt or commercial lock, and do the windows lock? Why it matters: Harder targets slow forced entry; Danville suggests a deadbolt with at least a 1-inch throw.
• 4.5 Is there a visitor process, such as sign-in, a pass or an escort to the right area? Why it matters: Known visitors are easier to tell apart from people who should not be there.
• 4.6 Do you know which areas stay locked and who holds keys or cards for them, and has that list been reviewed lately? Why it matters: CISA asks which spaces stay locked and whether locks need a fresh look.
• 4.7 Where people gather near a driveway or road, such as entrances or outdoor seating, is there something that stops a vehicle, like bollards, planters or barriers? Why it matters: Vehicle attacks give little warning, and measures should fit the site and how it is used.

6. People and practice: training, reporting and everyone on site

A plan nobody has practiced is a document, not a habit. This section asks whether staff have been walked through the plan, whether drills happen, whether reports are safe to make and whether contract officers and other employers on site know their roles. Two items apply to California employers under Labor Code 6401.9 (SB 553).

• 6.1 Is each employee taken through the emergency plan when hired, when their duties change and when the plan changes? Why it matters: OSHA's emergency action plan rule calls for a review at those three points.
• 6.2 Have you run at least one drill or tabletop exercise in the past year? Why it matters: CISA suggests physical-security exercises at least once a year.
• 6.3 Can staff report threats, worrying behavior or suspicious activity without fear of retaliation, and does someone follow up? Why it matters: Reports help only when people make them and someone acts on them.
• 6.4 California employers: is there a written workplace violence prevention plan specific to this site, unless an exemption applies? Why it matters: Most California employers have needed one since July 1, 2024, and a company-wide plan must still fit each site.
• 6.5 California employers: was workplace violence training given when the plan began, and repeated within the past year? Why it matters: Labor Code 6401.9 calls for training at the start and every year.
• 6.6 If you use contract security officers, does each hold a current BSIS guard registration and carry the card on duty? Why it matters: California requires registration for people hired to protect persons or property.
• 6.7 Do contract officers, cleaning crews and other employers working on site know their part in your plans? Why it matters: Sites with several employers need to line up training and incident reporting.

For the plan’s 13 required parts, the incident log and the rules on teaching staff the plan, see our SB 553 workplace violence prevention plan guide.

On question 6.6: HALO officers hold BSIS guard cards.

Notes by property type

The questions fit any commercial or residential property, but some carry more weight at certain sites. Use these notes to decide where a Partly deserves a closer look.

• Hotels. CISA counts lodging among commercial facilities that run on open public access without highly visible barriers. Give extra weight to 3.3 (the desk sees arrivals), 4.5 (visitor process) and 5.4 (who calls 911 and who tells staff). Our hotel security page covers lobby and overnight coverage.
• Apartments and HOAs. Apartment and condominium buildings sit in CISA’s real estate subsector, and Danville’s residential survey is written for homeowners and apartment residents. Weight 2.1 (borders), 2.3 (a lit, readable address), 2.5 (trimmed shrubs and trees) and 3.1 (entry and parking lighting). The four California employer items apply only where the HOA or manager employs staff on site, and the law leaves out some small sites closed to the public. See HOA and gated community security.
• Medical campuses. OSHA’s guidelines for health care and social service workers support weighting 4.5 (sign-in, passes and a restricted-visitor list), 5.6 (maintained panic buttons and personal alarms), 3.5 (cameras inside and out, and staff knowing whether video is watched) and 3.1 (parking lighting, with escorts to cars). California health care facilities covered by Title 8 section 3342 follow that rule instead of Labor Code 6401.9, so they mark 6.4, 6.5, 7.1 and 7.3 Not applicable here and check 3342 on its own. See hospital and healthcare security.
• Retail. OSHA’s late-night retail recommendations support weighting 3.3 (a visible register), 3.4 (clear windows and low shelving), 3.5 (cameras), 4.3 (delivery and trash doors locked when not in use), 5.6 (panic buttons) and 3.1 (parking lighting and escorts late at night). Handling money is a listed risk factor, and crowded outdoor areas tie to 4.7. See retail theft prevention.
• Industrial sites and warehouses. Danville’s commercial survey says loading areas should be visible with no hiding places, and working alone or at night are listed risk factors. Weight 1.5, 3.1, 4.1, 4.3 and 6.7, the last because docks and yards often host several employers at once. See warehouse security.

For an office building, our office security checklist turns these sections into a plan for the lobby, parking, deliveries and after hours.

Get help

A self-score shows where your planning stands; a walk of the site with a security professional shows what the gaps look like on the ground. HALO’s on-site security review is free with a guard quote, and you can bring your printed results to it. Our guide to preparing for a security risk assessment lists what else to have ready. When you are set, request a quote and tell us which sections scored lowest.