Security leaders who inherit the physical function often find a guard contract nobody has reviewed in years, patrols that run at the same times every night, and a fence line that has not been walked since it was installed. Guarding and the perimeter are the outer layers of site protection, and they fail quietly: the officer is present but not briefed, the fence is intact but unwatched, the lighting works but faces the wrong way. This guide covers how to set requirements for a guard force, design patrols, specify fences, gates and perimeter intrusion detection, and apply crime prevention through environmental design (CPTED). It is written for CISOs and converged security leads taking on physical security, and for facilities and security managers who need to put the outer layers on a measurable footing. It is defensive throughout and goes deeper on the outer layers than the Physical Security Guide for Security Teams.
Source note: guidance below is summarised from NPSA, ProtectUK, SIA, NIST and CPTED sources listed in the references as checked in November 2026; licensing rules vary by country. Confirm against the official text before relying on it.
Key takeaways
- Write an operational requirement before buying anything. Define what each perimeter and guarding measure must detect, delay or deter, and how fast a response must arrive.
- Officers deter by being alert, not by being present. ProtectUK notes that alert, professional guard forces make hostile reconnaissance harder; that needs briefing, training and supervision written into the contract.
- Patrols must be regular but unpredictable. Fixed routes at fixed times give an observer a timetable; vary times and record what each patrol checked.
- A fence only delays. Pair it with detection (perimeter intrusion detection, monitored CCTV, lighting) and a response, or it is just a boundary marker.
- CPTED is cheap and durable. Clear sightlines, defined territory, controlled approaches and maintenance reduce opportunity before any technology is installed.
The outer layers and what each must do
NPSA explains that controlling access at the perimeter gives greater standoff between a threat and the people and assets inside, which reduces risk and widens the response options. Each outer layer should have a stated job.
| Layer | Deter | Detect | Delay | Respond |
|---|---|---|---|---|
| Site boundary and fence | Defines private space; signage | Only with PIDS or monitored CCTV | Primary job | None by itself |
| Gates and checkpoints | Visible control | Identity and vehicle checks; search | Barriers, closed when not operating | Officer challenge; lockdown |
| Perimeter intrusion detection | Limited | Primary job | None | Triggers verification and dispatch |
| Lighting | Removes cover | Supports officers and CCTV | None | Supports response |
| Guard force and patrols | Visible, alert presence | Observation, challenge, alarm verification | Limited | Primary job |
| CPTED features | Ownership cues, sightlines | Natural surveillance | Natural access control | Indirect |
The weakest outer layer is usually the response. A perimeter alarm that takes 20 minutes to verify and another 20 to attend protects nothing that an intruder can reach in five. Design the delay to exceed the detect plus respond time for your critical assets.
Setting requirements for a guard force
NPSA lists guarding and response force requirements as a core element of perimeter and checkpoint design, alongside protecting the guards themselves with suitable guard houses where the threat warrants. NIST SP 800-53 Rev. 5 enhancement PE-3(3) Continuous Guards goes further for high assurance sites: employ guards to control defined physical access points to the facility where the system resides 24 hours a day, 7 days a week.
Licensing and vetting
- Licensing: in the UK, the Security Industry Authority (SIA) is the regulator of the private security industry. SIA guidance says officers guarding premises under a contract for services need a security guard licence; check each officer against the SIA register of licence holders and consider whether your supplier holds Approved Contractor Scheme status.
- Vetting: require pre-employment screening to the depth the site needs, and include officers in insider risk processes. See the Personnel Security and Background Screening Guide.
- Elsewhere: licensing rules vary by country and US state; confirm the local requirement with counsel before contracting.
What to put in the contract
| Requirement | Specify | Evidence |
|---|---|---|
| Assignment instructions | Site-specific duties per post: access checks, challenge procedure, alarm response, escalation, lockdown | Signed, version controlled instructions at each post |
| Training and briefing | Induction, site familiarisation, hostile reconnaissance awareness, first aid, regular rehearsal and exercises | Training records; exercise reports |
| Staffing | Posts, hours, minimum numbers, relief cover, maximum shift length | Rosters reconciled to invoices |
| Patrol standard | Areas, frequency range, randomisation, checkpoints to verify | Electronic patrol records |
| Alarm handling | Verification time, dispatch time, police escalation criteria | Alarm log with timestamps |
| Supervision and audit | Supervisor visits, out of hours spot checks, client audit rights | Audit reports; corrective actions |
| Identity and access | Officer badges, keys and system accounts issued per person, removed on day of departure | Access review records |
Roles and responsibilities should be clearly defined and backed by policies, procedures, training, rehearsal and exercising, as ProtectUK sets out. An officer who has never practised a lockdown will not run one under pressure.
Designing patrols
ProtectUK advises routine searching and patrolling of internal and external areas, scheduled regularly but at varying times so they are not predictable. Turn that into a patrol plan.
- Map what a patrol must check: fence line condition, gates and crash gates, doors and windows, plant and comms rooms, roof access, vehicle areas, signs of tampering with cameras or detectors.
- Set frequency by risk: high consequence areas more often, with a minimum and maximum interval rather than a fixed time.
- Randomise: vary start times, direction and route order. Avoid shift change times as the only patrol slots.
- Record evidence: use electronic checkpoints or a patrol system so you can prove coverage and spot drift; record observations, not just arrival.
- Act on findings: a damaged fence or propped door found on patrol should open a ticket with an owner and a close date.
- Review quarterly: compare patrol records with incidents and alarm data and adjust routes.
Tailgating at staffed entrances is a guarding problem as much as a turnstile one. See the Tailgating and Piggybacking Guide.
Fences, gates and checkpoints
ProtectUK guidance is that boundaries should clearly define public and private space so the occupier can control activity on its property, that fences should be inspected regularly to confirm they are in good repair and fit for purpose, and that access points should be kept to a minimum with boundaries clearly signed.
- Fence selection: choose height and construction from the threat in the operational requirement. NPSA's Forced Entry Standards guidance covers forced entry protection for building elements; for high security sites, ask your security adviser for tested products rather than relying on supplier claims.
- Clear zones: keep vegetation, stored materials and parked vehicles away from both sides of the fence so they cannot be used to climb or hide.
- Gates: gates are the weakest point of most fences. Larger sites may have crash gates, which ProtectUK says need a strict security regime so they cannot be breached.
- Checkpoints: NPSA lists the measures for an access point: design it to limit reconnaissance, use surveillance and lighting, control access for people, vehicles and deliveries, search and screen where the threat requires, provide hostile vehicle mitigation, use pedestrian barriers that can close the point when it is not operating, and plan emergency egress and contingencies for a blocked entry.
- Vehicles: control vehicle access at entry points and consider searching or screening vehicles in response to specific threats. Hostile vehicle mitigation is specialist design work; in the UK, take advice from your local counter terrorism security adviser.
Threats at the access point
| Threat (NPSA) | Primary countermeasure | Owner |
|---|---|---|
| Hostile reconnaissance | Design to limit observation; alert officers; vary routines | Security manager |
| Forced entry | Rated barriers and gates; delay greater than response time | Facilities and security |
| Attack on staff at the point | Protected guard house; duress alarm; staffing levels | Guard contractor and client |
| Smuggling of weapons or items | Search and screening regime | Security operations |
| Unauthorised entry by deception, tailgating, duress or insider help | Identity checks, one person per credential, challenge culture, access logs reviewed | Security operations |
| Sabotage of security systems | Tamper detection, protected cabling, system health monitoring | Security systems owner |
Perimeter intrusion detection and lighting
NPSA describes perimeter intrusion detection systems (PIDS) as a technology force multiplier that monitors the perimeter continuously and supports early detection. Its guidance groups them into barrier mounted, electric fence, ground based and free standing systems.
| PIDS family | Where it fits | Design considerations |
|---|---|---|
| Barrier mounted | Sensors on an existing fence | Fence condition and rigidity affect alarm quality; inspect with the fence |
| Electric fence | Higher threat sites where permitted | Local safety and planning rules; signage; maintenance access |
| Ground based | Buried or covert detection along a line | Ground conditions, drainage and excavation over cables |
| Free standing | Sterile zones between fences or open boundaries | Line of sight, terrain and vegetation control |
- Verification: every PIDS zone should map to a camera view so operators can confirm or dismiss an alert quickly. ProtectUK stresses that CCTV is only effective if properly monitored and maintained. See the IP Camera and CCTV Security Guide.
- Lighting: external lighting deters intruders, aids detection and improves officer and CCTV effectiveness, but design it to limit light pollution for neighbours. CPTED guidance favours dusk to dawn operation, overlapping fixtures with no shadow pockets, and shielded cutoff fixtures that reduce glare.
- Systems as networked assets: PIDS controllers, cameras and alarm panels are networked devices with their own credentials and firmware. Treat them as OT and IoT. See the Intrusion Alarm Systems Security Guide.
- Installers: in the UK, ProtectUK names NSI and SSAIB as the approved inspectorates for security systems; use certified installers where police response is needed.
Crime prevention through environmental design (CPTED)
CPTED uses the layout, landscaping, lighting and upkeep of a site to reduce opportunity. The City of Las Vegas CPTED Handbook sets out five principles.
| Principle | Aim | Practical measures |
|---|---|---|
| Natural surveillance | To see and be seen | Trim shrubs to 2 ft (about 60 cm) or less and tree canopies to 6 ft (about 1.8 m) or higher; see-through fencing; remove blind corners; lighting good enough to recognise a person at 100 ft (about 30 m) |
| Natural access control | Guide movement | Clearly defined, lit entrances; fencing and gates; defensive planting under accessible windows |
| Territorial reinforcement | Show ownership | Mark transitions between public, semi-public, semi-private and private zones with landscaping, fencing and signage |
| Activity support | Encourage legitimate use | Place staffed or busy functions where they overlook vulnerable areas |
| Maintenance | Signal that someone cares | Prompt repair, graffiti removal, lighting replacement, landscaping kept to the sightline standard |
For corporate sites, the most valuable CPTED moves are usually sightlines to entrances and car parks from staffed areas, a single obvious visitor approach, and a maintenance standard that keeps both working. Visitor routing links to the reception process in the Physical Access Control Systems Security Guide.
How to implement
- Assess: walk the perimeter by day and night with the site assessment checklist; record gaps, sightlines, lighting faults and gate use. See the Physical Security Site Assessment Checklist.
- Write the operational requirement: for each zone, the threat, what must be detected, the delay needed and the response time available. NPSA's Operational Requirements process gives the structure.
- Fix the basics: repair fences, clear vegetation, restore lighting, reduce the number of open gates, and rewrite assignment instructions.
- Pilot technology: install PIDS or camera verification on one stretch; run it alongside existing patrols for a defined period and measure nuisance alarms before relying on it.
- Re-tender or renegotiate guarding: move to an outcome-based contract with the measures in this guide, audit rights and service credits.
- Exercise: test intrusion response, lockdown and evacuation at least annually, including out of hours, and feed results into the Physical Intrusion Response Playbook.
- Roll back safely: keep existing patrols in place until new detection proves reliable; never remove a guarded post on the strength of a sensor that has not completed its pilot.
Small and large organisations
- Single office or small site: CPTED measures, good lighting, monitored alarms with a keyholding or response service, and a clear lockup routine usually beat a static guard on cost and effect.
- Campus, logistics or critical infrastructure: layered fences with PIDS, a staffed control room, 24/7 guarding at defined points (as PE-3(3) describes) and a formal guarding contract with performance measures.
Detection and measurement
- Monitor: PIDS zone alarms, gate and barrier events, patrol checkpoint records, officer incident reports and lighting faults, correlated in one log with access control and CCTV events.
- Alarm verification time: median time from PIDS alarm to confirmed or dismissed.
- Response time: median time from confirmed alarm to officer on scene, compared with the delay the barrier provides.
- Patrol compliance: percentage of scheduled patrols completed within the planned window, and variation in start times.
- Nuisance alarm rate: alarms per zone per week not caused by an intrusion; rising rates erode operator trust.
- Perimeter defect closure: days from defect found to fixed, for fence, gate and lighting faults.
- Exercise results: red team or exercise attempts detected at the perimeter. See the Social Engineering and Physical Penetration Testing Guide.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev. 5 | PE-3(3) Continuous Guards | Guards controlling defined access points 24/7 |
| NIST SP 800-53 Rev. 5 | PE-3(7) Physical Barriers | Limit access using physical barriers |
| NIST SP 800-53 Rev. 5 | PE-6 Monitoring Physical Access; PE-6(1) Intrusion Alarms and Surveillance Equipment | Monitoring, alarms and surveillance supporting detection |
| NIST CSF 2.0 | PR.AA-06; DE.CM-02 | Physical access managed and enforced; physical environment monitored for adverse events |
| ISO/IEC 27001:2022 Annex A | 7.1 Physical security perimeters; 7.4 Physical security monitoring | Defined perimeters and continuous monitoring |
| MITRE CAPEC | CAPEC-390 Bypassing Physical Security | Attack pattern the outer layers are designed to stop |
Common failure patterns
- Guarding bought on hourly rate alone: no assignment instructions, no training evidence and no audit rights, so the client cannot tell whether the service works.
- Predictable patrols: the same route at the same time each night, visible to anyone watching from outside the fence.
- Detection without response: PIDS alarms go to an unstaffed screen, or nuisance alarms have taught operators to acknowledge without looking.
- Neglected fence line: gaps under fences, vegetation and stored pallets that give climbing aids, and crash gates left unlocked after deliveries.
- Officer accounts and keys never removed: contractor officers rotate often, and badges, master keys and security system logins outlive their assignment. Fold them into the Joiner-Mover-Leaver Guide process.
- Lighting that blinds cameras: unshielded fixtures that create glare and shadow pockets, defeating both CCTV and natural surveillance.
Practitioner checklist
- Write an operational requirement per perimeter zone covering detect, delay and respond times.
- Issue site-specific assignment instructions for every guarded post and review them annually.
- Check every contract officer's licence where licensing applies and include officers in screening and insider risk processes.
- Run patrols to a randomised schedule with electronic evidence of coverage.
- Inspect fences, gates and clear zones on a set cycle and track defects to closure.
- Map every PIDS zone to a camera view and measure alarm verification time.
- Apply CPTED sightline, lighting and maintenance standards across grounds and car parks.
- Exercise intrusion response and lockdown at least annually, including out of hours.
- Remove officer badges, keys and system accounts on the day an officer leaves the site.
Standards and references
- NPSA: Perimeters and checkpoints
- NPSA: Perimeter intrusion detection systems guidance
- ProtectUK: Physical security, perimeter, guarding and patrols
- NIST: SP 800-53 Rev. 5
- NIST: Cybersecurity Framework 2.0
- Security Industry Authority: Regulator of the UK private security industry
- Security Industry Authority: Find out if you need an SIA licence
- City of Las Vegas: CPTED Handbook
- MITRE CAPEC: Bypassing Physical Security
Related NHI Mgmt Group resources: Physical Security Guide for Security Teams · Physical and cyber security convergence · Intrusion Alarm Systems Security Guide · Physical Intrusion Response Playbook