How should security teams balance lockdown and evacuation when a threat is moving through a site?

They should use zone-based control rather than a building-wide blanket response. Lock down areas where the threat is unknown or present, while guiding people in safer zones toward controlled evacuation routes. Integrated access control, video, and audio can help teams verify where the threat is and open or close paths as conditions change.

Why zone-based control is the right balance

When a threat is moving through a site, the goal is not simply to “lock everything” or “evacuate everything.” A blanket response can trap people in the wrong place, create crowding at exits, or force movement through uncertain areas. Zone-based control lets security teams match the response to what is known in each part of the site, which is the practical way to reduce exposure without overcommitting to one action too early.

The key distinction is between areas that are likely compromised and areas that remain usable for controlled movement. In the first case, containment matters more than movement. In the second, evacuation may be safer than sheltering in place. That is why teams need a live picture of who is where, what paths remain open, and how quickly the status of each zone can change.

Integrated access control, video, and audio are useful because they support the decision, not just the response. Security teams can verify whether a corridor, stairwell, or lobby is still safe before routing people there, rather than relying on a static plan that assumes conditions stay stable.

How teams should decide where to lock and where to move

The decision should start with the threat’s location and uncertainty. If the threat is confirmed in a zone, lock that zone down and block movement into it. If the threat is unconfirmed but could be nearby, treat the area as higher risk and avoid sending people through it until it is cleared. If a zone is demonstrably clear, use it as part of a controlled evacuation path.

This is also a communications problem. People do not need every detail, but they do need simple, current instructions tied to their zone. Guidance should tell occupants whether to stay put, move to a safer internal area, or evacuate by a specific route. The objective is to reduce improvisation, because improvised movement is what often turns a localized threat into a site-wide problem.

Teams also need to think in terms of paths, not just rooms. A zone may be safe to occupy but unsafe to cross, especially if it depends on a shared hallway or atrium. The practical rule is to keep local containment where the threat is present and preserve only the movement paths that can be actively monitored and controlled.

What makes a zone-based response work in practice

Zone-based control works best when the site has pre-defined sectors, clear authority to open or close routes, and a way to update instructions quickly as conditions change. The response should be designed so that operators can narrow the perimeter as more is learned, rather than forcing every decision to be made at the building level.

That flexibility matters because threat movement is rarely linear. A response that is correct at minute one may be wrong at minute five. Teams need to be able to shift from containment to evacuation, or from evacuation back to holding patterns, as the picture changes. The best plans assume uncertainty and allow controlled adjustment instead of one irreversible action.

For a deeper security perspective on real-world incident patterns, The 52 NHI Breaches Report is useful because it shows how quickly an initial compromise can spread once control boundaries are weak. At the site level, the same lesson applies: containment only works if boundaries are real and actionable.

Risk and Threat Considerations

The main risk is overreacting in a way that creates new harm. A site-wide lockdown can strand occupants near the threat, while a broad evacuation can push people through unknown areas or into choke points. The danger is not just the threat itself, but the response failing to distinguish between exposed and safe zones.

Failure mechanism: Teams treat the whole site as one condition, so they either freeze movement where evacuation is needed or evacuate people through routes that have not been verified. In both cases, the response loses locality and increases uncertainty.

Impact: Poorly scoped movement decisions can increase crowding, delay escape, create exposure to the threat’s path of travel, and make it harder to regain control if conditions worsen.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5, NIST CSF 2.0 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	AC-3 — Access Enforcement	Zone-based lock and route control depend on enforcing who can move where.
Recommendation — Apply AC-3 to enforce movement restrictions by zone and route.
NIST CSF 2.0	PR.AA-05 — Access Permissions and Authorizations	The question is about controlling access and movement during an active threat.
Recommendation — Use PR.AA-05 to restrict access paths by threat zone and occupancy status.
CIS Controls v8	CIS-6 — Access Control Management	Security teams need controlled access and route governance during a live incident.
Recommendation — Use CIS-6 to govern and revoke unsafe movement paths during the incident.
ISO/IEC 27001:2022	A.5.26 — Response to information security incidents	The scenario is an incident response decision about containment and evacuation.
Recommendation — Coordinate zone response actions under A.5.26 incident handling procedures.

Practitioner Guidance

What to prioritise: Prioritise zone status over global site status. The first question is not “lock down or evacuate,” but “which zones are unsafe, which are clear, and which corridors can be trusted right now?”

What to verify: Verify that operators can confirm zone conditions from multiple sources before changing instructions. If access control, video, and human reports conflict, treat the zone as uncertain until the discrepancy is resolved.

Decision rule: If a route has not been actively verified, do not use it for evacuation. If a zone is confirmed threatened, do not keep people in it just to preserve convenience or uniformity.

Practitioner takeaway: The correct balance is dynamic control, not symmetry, meaning you contain where danger is credible and evacuate only where movement can still be made safe.