Corporate facility security assessment
Corporate facility threat and vulnerability assessment for clearer security priorities
A new site or recent security concern can expose gaps in your facility-security baseline. ICA's scoped onsite walkthrough and interviews connect site findings with a prioritized risk register and improvement roadmap.
MIS
CISSP
CHISL
CPHIMS
CDH-E
Will Long Sr. · Founder
MIS · CHISL · CDH-E · CISSP · CPHIMS
Nearly 40 years in IT & cybersecurity
Former VP & CISO, Children’s Health System of Texas
Tim Pelikan · Co-Founder
Credential details pending confirmation
30 years in cybersecurity & data risk
Interviews & industry conversations
Coffee With Closers
Cybersecurity With Discern
“ICA provides distinctive security professionals who excel at building strong client relationships, demonstrate exceptional organization, and deliver practical, risk-based consulting recommendations to our clients.”
Michael Cox, CIPP/US
Chief Privacy Consultant & Founder, SoCal Privacy Consultants
Partner endorsement of ICA’s advisory work
Give facility decisions a current security baseline
A new building brings unfamiliar access patterns. A recent concern can challenge assumptions about existing protections. An insurance review may also prompt your COO or facilities director to revisit a baseline that no longer reflects how the site operates.
This assessment helps corporate security and property-management teams identify facility-security gaps and practical risk reduction options. Use the findings to decide which concerns deserve attention first and where to focus improvement spending. The assessment objective should reflect the decision you need to make about the site.
Review the site in its operating context
Coverage starts with agreed buildings, operating hours, and critical areas. An occupied office, a shared property, and a site with regular deliveries present different access needs. Scoping establishes the areas your organization controls and the conditions that matter to its security.
The walkthrough considers site conditions and existing protective measures. Depending on the agreed coverage, relevant areas may include building approaches, reception, delivery access, and restricted workspaces. Interviews help explain how employees and visitors use the site. Tenant responsibilities and landlord-controlled areas need clear boundaries so the report does not imply coverage of spaces the assessment could not access.
Combine an authorized walkthrough with operational interviews
The proposed method is an onsite walkthrough supported by interviews with people who understand the facility. Facilities staff explain the building's routines; corporate security describes existing protections and known concerns. Property management can clarify shared-area responsibilities and access restrictions.
Agreed supporting materials, such as site plans or current access procedures, provide context for observations. The review considers gaps alongside protective measures already in place. Findings should distinguish observed conditions from information reported in interviews and areas left unreviewed. This gives leadership a clearer basis for interpreting the recommendations. Any unavailable access or evidence should remain visible in the assessment's coverage limitations.
Turn site findings into improvement priorities
The agreed engagement scope defines the detail of three typical planning outputs.
Site findings report: Records the areas reviewed and identified facility-security gaps. Facilities and security owners can use it to understand the basis for recommended changes.
Prioritized risk register: Organizes identified risks in priority order. It gives leadership a common reference for discussing attention, resources, and responsibility.
Improvement roadmap: Connects findings to recommended risk reduction options. Use it to plan the sequence of improvements and discuss dependencies with the people responsible for the property.
These outputs support decisions; implementation remains a separate responsibility.
Prepare access, site context, and the right participants
Cost and timing depend on the number of buildings, operating hours to consider, and access to critical areas. Site complexity and participant availability also shape the engagement. Agree the objective, coverage, and expected deliverable detail before work begins.
Preparation includes identifying an authorized site contact and arranging access with the relevant property owners or managers. Define escort requirements and safety arrangements for restricted areas. Bring people who can explain daily operations and existing concerns. Sensitive site plans and security details should be handled through an agreed sharing method. The walkthrough should respect the site's operational and safety requirements.
Keep advisory review separate from testing and installation
This is an advisory assessment of site conditions and protective measures. Covert entry testing, guard services, and installation sit outside its scope. It also does not include operational protection or emergency deployment.
A focused review of access, visitor handling, or protective-system procedures may require a separately scoped assessment. Adversarial validation is a different engagement requiring specialist partner coordination, written authorization, and agreed safety controls. The facility report identifies improvement options; it does not certify the property, establish code compliance, or guarantee that every threat has been identified.
Questions about the facility assessment
Who is this assessment designed for?
It is intended for COOs, facilities directors, corporate-security teams, and property managers who need a current facility-security baseline. Common triggers include a new site, a recent concern, or an insurance review.
Can the scope include several buildings or shared areas?
Coverage is agreed by building, operating hours, and critical areas. Shared spaces require clear ownership and access arrangements. A review of selected areas should not be treated as an assessment of an entire property portfolio.
Will the assessment attempt to bypass our security?
The base approach uses an authorized walkthrough and interviews. It does not attempt covert entry or intrusive testing of protective systems. Controlled adversarial testing requires a separate specialist-led engagement with written authorization and rules of engagement.
What determines cost and timing?
Building count, site complexity, operating patterns, and restricted-area access affect the work. Availability of knowledgeable participants and agreed supporting materials also matters. These factors need review before cost and timing can be confirmed.
How does this differ from a protective-systems assessment?
This assessment establishes a broader site-security baseline. A Physical Access, Visitor & Protective Systems Assessment focuses on those controls and operating procedures. Its scope and delivery capability require separate confirmation.
Does the improvement roadmap include carrying out the changes?
The roadmap recommends priorities and risk reduction options. Installation, guard provision, and remediation execution are outside this assessment. Your organization decides which actions to pursue and who will implement them.
Define the facility review your next decision needs
Discuss the site and the concern driving your review. A clear scope connects an authorized walkthrough to useful findings, a prioritized risk register, and an improvement roadmap. Give facilities, corporate security, and leadership a shared basis for deciding what to address first.
Give facility decisions a current security baseline
A new building brings unfamiliar access patterns. A recent concern can challenge assumptions about existing protections. An insurance review may also prompt your COO or facilities director to revisit a baseline that no longer reflects how the site operates.
This assessment helps corporate security and property-management teams identify facility-security gaps and practical risk reduction options. Use the findings to decide which concerns deserve attention first and where to focus improvement spending. The assessment objective should reflect the decision you need to make about the site.
Review the site in its operating context
Coverage starts with agreed buildings, operating hours, and critical areas. An occupied office, a shared property, and a site with regular deliveries present different access needs. Scoping establishes the areas your organization controls and the conditions that matter to its security.
The walkthrough considers site conditions and existing protective measures. Depending on the agreed coverage, relevant areas may include building approaches, reception, delivery access, and restricted workspaces. Interviews help explain how employees and visitors use the site. Tenant responsibilities and landlord-controlled areas need clear boundaries so the report does not imply coverage of spaces the assessment could not access.
Combine an authorized walkthrough with operational interviews
The proposed method is an onsite walkthrough supported by interviews with people who understand the facility. Facilities staff explain the building's routines; corporate security describes existing protections and known concerns. Property management can clarify shared-area responsibilities and access restrictions.
Agreed supporting materials, such as site plans or current access procedures, provide context for observations. The review considers gaps alongside protective measures already in place. Findings should distinguish observed conditions from information reported in interviews and areas left unreviewed. This gives leadership a clearer basis for interpreting the recommendations. Any unavailable access or evidence should remain visible in the assessment's coverage limitations.
Turn site findings into improvement priorities
The agreed engagement scope defines the detail of three typical planning outputs.
Site findings report: Records the areas reviewed and identified facility-security gaps. Facilities and security owners can use it to understand the basis for recommended changes.
Prioritized risk register: Organizes identified risks in priority order. It gives leadership a common reference for discussing attention, resources, and responsibility.
Improvement roadmap: Connects findings to recommended risk reduction options. Use it to plan the sequence of improvements and discuss dependencies with the people responsible for the property.
These outputs support decisions; implementation remains a separate responsibility.
Prepare access, site context, and the right participants
Cost and timing depend on the number of buildings, operating hours to consider, and access to critical areas. Site complexity and participant availability also shape the engagement. Agree the objective, coverage, and expected deliverable detail before work begins.
Preparation includes identifying an authorized site contact and arranging access with the relevant property owners or managers. Define escort requirements and safety arrangements for restricted areas. Bring people who can explain daily operations and existing concerns. Sensitive site plans and security details should be handled through an agreed sharing method. The walkthrough should respect the site's operational and safety requirements.
Keep advisory review separate from testing and installation
This is an advisory assessment of site conditions and protective measures. Covert entry testing, guard services, and installation sit outside its scope. It also does not include operational protection or emergency deployment.
A focused review of access, visitor handling, or protective-system procedures may require a separately scoped assessment. Adversarial validation is a different engagement requiring specialist partner coordination, written authorization, and agreed safety controls. The facility report identifies improvement options; it does not certify the property, establish code compliance, or guarantee that every threat has been identified.
Questions about the facility assessment
Who is this assessment designed for?
It is intended for COOs, facilities directors, corporate-security teams, and property managers who need a current facility-security baseline. Common triggers include a new site, a recent concern, or an insurance review.
Can the scope include several buildings or shared areas?
Coverage is agreed by building, operating hours, and critical areas. Shared spaces require clear ownership and access arrangements. A review of selected areas should not be treated as an assessment of an entire property portfolio.
Will the assessment attempt to bypass our security?
The base approach uses an authorized walkthrough and interviews. It does not attempt covert entry or intrusive testing of protective systems. Controlled adversarial testing requires a separate specialist-led engagement with written authorization and rules of engagement.
What determines cost and timing?
Building count, site complexity, operating patterns, and restricted-area access affect the work. Availability of knowledgeable participants and agreed supporting materials also matters. These factors need review before cost and timing can be confirmed.
How does this differ from a protective-systems assessment?
This assessment establishes a broader site-security baseline. A Physical Access, Visitor & Protective Systems Assessment focuses on those controls and operating procedures. Its scope and delivery capability require separate confirmation.
Does the improvement roadmap include carrying out the changes?
The roadmap recommends priorities and risk reduction options. Installation, guard provision, and remediation execution are outside this assessment. Your organization decides which actions to pursue and who will implement them.
Define the facility review your next decision needs
Discuss the site and the concern driving your review. A clear scope connects an authorized walkthrough to useful findings, a prioritized risk register, and an improvement roadmap. Give facilities, corporate security, and leadership a shared basis for deciding what to address first.