Score your building before someone else does.
Sixty-two checks. Seven domains. One number you can take to an owner. No tools. No vendor. No walkthrough required.
Command: Walk it at night, not at noon
Most property teams assess their building during business hours, when it is staffed, lit, and behaving. That is the one configuration an intruder will never meet. Every check here can be verified by walking, looking, or asking one question. The domains are ordered the way an intruder meets them, not the way an org chart is drawn.
Seven Domains
62 checks · scored 0 to 2 · max 124
Approach & Perimeter
What a stranger sees before they touch the building. Sightlines, lighting at the hours that matter, and whether the property line is legible to someone who does not belong.
Lobby & Visitor Control
Whether your front door is a control point or a hallway. Badge issuance, escort policy, and what actually happens when someone walks past reception without stopping.
After Hours & Loading Dock
The building you do not staff. Dock discipline, freight elevator control, and the gap between when the desk goes home and when the building actually locks.
Parking & Transition Zones
Where tenants feel least safe and incidents concentrate. Stairwells, garage lighting at stall level, and the walk from the last camera to the car.
Vendor & Contractor Access
Everyone with a key who is not on your payroll. Key and code inventory, offboarding when a contract ends, and whether anyone has audited the master key list.
Tenant Interface & Reporting
Whether you find out. Reporting paths tenants will actually use, near miss capture, and how fast a report reaches someone who can act.
Converged Exposure
Where the building becomes a network. Live jacks in common areas, the access control system patch state, and who holds remote admin access to both.
What your number means
Total your score against 124. The band tells you whether you are closing gaps or building a program.
Open building
Controls exist on paper or not at all. Start with domains 02 and 03, which is where an unauthorized person actually walks in.
Controls without discipline
The hardware is installed and the habits are not. Your cheapest gains are procedural, not capital.
Functioning, with blind spots
Usually domain 05 or 07, because vendor access and converged exposure sit outside most property teams remit.
Mature posture
Self-assessment has reached its limit. What remains is what you cannot see from inside.
This is a self-assessment, not an audit. It tells you where you stand and what to fix first. It does not test whether your controls survive someone actively trying to defeat them. That is what SOP-01 Facility Audit Protocol documents.
Secure the Checklist
Facility Risk Review Checklist downloads immediately. No waiting on email.