Physical Security Risk Assessment: The Checklist For The Hours You’re Not There

A physical security risk assessment is a structured walkthrough of your property that identifies what you’re protecting, what could go wrong, where you’re exposed, and what to fix first. Most of them get run at 10 a.m. with the lights on and the staff in the building. That’s the problem. FBI Uniform Crime Reporting data shows that when the time of a commercial burglary is known, more of them happen at night than during the day, and the split runs the opposite direction for houses. If your assessment only covers the hours you’re standing there, it can’t see the risk that costs you. We run site assessments across Houston construction sites, warehouses, vacant buildings and shopping centers. This is the checklist we use, including the part most assessments skip.

What is a physical security risk assessment?

A physical security risk assessment is an evaluation of a property’s assets, threats, vulnerabilities and existing controls, ending in a prioritized list of fixes. It covers access points, perimeter, lighting, cameras, access control, staffing, procedures and emergency response. Federal guidance treats risk as a function of threat, consequence and vulnerability, so a finding is only a priority when all 3 are present. That last sentence does a lot of work. A gap that nobody is likely to exploit, in a place where nothing valuable sits, is not a priority no matter how obvious it looks on a walkthrough. The Interagency Security Committee standard for federal facilities frames risk this way, and it’s the closest thing the United States has to an official physical security assessment methodology.

The hours your assessment probably skips

Here’s what the federal data actually says about when commercial property gets hit. FBI Uniform Crime Reporting Table 23 breaks burglary down by location type and time of occurrence. It’s the only federal table that does both at once. In the 2019 reporting year, agencies reported 157,327 nonresidential burglaries at night against 125,554 during the day. For residences, the counts flipped: 290,909 during the day against 195,884 at night. Run the math on the offenses where the time was actually known and you get this:

Property type	Burglaries at night	Burglaries during the day
Nonresidential (commercial)	55.6%	44.4%
Residential	40.2%	59.8%

Percentages calculated from FBI UCR Table 23 counts, 2019 reporting year, excluding offenses where the time was unknown. Table 23 covers 13,848 reporting agencies, not the full national estimate. Houses get burgled while the owners are at work. Commercial buildings get burgled after close. Every “most burglaries happen during the day” statistic you’ve read was measuring somebody’s living room. The scale is still real. The FBI counted an estimated 661,800 burglaries nationally in 2025, and burglary made up 12.6 percent of all property crime. The rate fell to 193.6 per 100,000 people from 231.0 in 2024, so this is a shrinking problem, not a vanishing one. In Houston, police recorded 4,655 burglaries in the first 6 months of 2026, down 21.8 percent from 5,953 over the same stretch in 2025. The last year the FBI published an average dollar loss per burglary was 2019, at $2,661. Nothing since. On a construction site with a container of copper wire in it, that number is not the one that matters. What our own incidents look like. Across the 5 write-ups we keep on file, here’s when the officer made contact:

Incident	Site type	Time
Vehicle circling the perimeter, occupants checking gates	Construction site	2:15 a.m.
2 people carrying materials toward the fence line	Construction site	11:40 p.m.
Copper wire being pulled from a storage container	Construction site	3:30 a.m.
Forced entry attempt at a boarded opening	Vacant commercial building	1:45 a.m.
Unauthorized vehicle at the loading dock after hours	Distribution warehouse	11:20 p.m.

Five for five between 11:20 p.m. and 3:30 a.m. Five for five on a site with nobody on it. A daytime walkthrough would have caught the poorly lit fence line in incident 2, maybe. It would not have caught the vehicle doing laps at 2:15 a.m., because at 10 a.m. that vehicle is a delivery truck. Two of those 5 are written up in full in our notes on commercial building security in Houston, and the shift itself is covered in what an overnight post actually involves. What matters here is the pattern, not any single night.

How often should you run a physical security risk assessment?

Every page on this topic says “at least annually.” None of them names a standard that says so. The federal standard that does exist says something different: the Interagency Security Committee requires risk assessments “once every five years for Level I and II facilities and once every three years for Level III, Level IV, and Level V facilities,” across 5 facility security levels. That’s for federal buildings, and your warehouse isn’t one. But it’s the only published interval with an issuing body behind it, and it’s 3 to 5 times longer than the advice you’ll find everywhere else. Annual is a reasonable habit. It’s not a rule. What should actually pull you back into an assessment is a change, not a date:

• A new site, a new building, or an expansion into space you haven’t walked
• An incident, including a near miss that cost you nothing
• A change in what’s on site, like a delivery of high-value materials or equipment
• A change in hours, especially going from occupied to unoccupied overnight
• A change in the neighborhood, including a new vacant property next door
• A new insurance, lender or general contractor requirement
• A construction phase change, which on an active site can mean every few weeks

On an active build, the exposure changes faster than any calendar interval can track. When the copper goes in, your risk profile changes that afternoon. That’s the trigger, not the anniversary.

The 7-step process, and what changes after dark

The process itself is settled. Here it is, with the after-hours version of each step next to it, because running these 7 steps once during business hours only gets you half an assessment.

1. Define the scope

Name the property, the buildings, the yard, the parking, and the hours. Write the hours down. Most scoping documents don’t, and that’s how the empty hours fall out of the assessment.

2. Identify what you’re protecting

Equipment, materials, inventory, vehicles, tools, data, and people. Then ask which of those is still on site at 2 a.m. Usually it’s most of the property value and none of the people, which changes what a loss actually costs you.

3. Identify realistic threats

Theft, trespass, vandalism, copper and metal theft, squatting, arson, and unauthorized access. Rank by what has actually happened on this site or on sites like it within a few miles, not by what’s dramatic.

4. Identify vulnerabilities

This is the walkthrough. See the checklist below. Do it twice, once in daylight and once after dark.

5. Rate each finding

Likelihood times impact, with consequence weighted. A gate that doesn’t latch on the side of the yard where the generators sit outranks a gate that doesn’t latch on the side with the porta-johns.

6. Recommend fixes in priority order

Immediate, near-term, and planned. Immediate means this week.

7. Document it

Written findings, photos, dates, and who owns each fix. If an insurer, a lender or a general contractor ever asks whether you assessed the site, the document is the answer. A verbal walkthrough is not. On active builds we work from the standing site security forms so findings and nightly reports sit in the same file. Step 4 is where most assessments quietly fail. The rest of the process is only as good as what the walkthrough saw.

The walkthrough checklist, day and night

Run each line twice. The daylight pass tells you what’s there. The dark pass tells you what works. For a shorter version aimed at an occupied office building, our 7 commercial building security tips covers the same ground in less depth.

Area	Check in daylight	Check after dark
Perimeter and fencing	Gaps, damage, gate hardware, whether the fence line is actually continuous	Where a person can stand unseen, whether gates are locked or just closed
Lighting	Fixture placement and coverage on paper	Which fixtures actually work, where the dark pockets are, whether light reaches the fence line
Access points	Doors, windows, dock doors, roof hatches, gates, and who holds keys	Which ones are unlocked after close, which ones nobody checks
Cameras	Placement, coverage, resolution, storage retention	Whether they see anything usable in the dark, whether anyone is watching, how long until someone looks
Access control	Credential list, who has access to what, revocation process	Whether the system is armed, whether a code walks out with a fired employee
High-value storage	Where copper, tools, fuel, catalytic converters and equipment sit	Whether that location is lit, visible, and covered by patrol
Vehicles and equipment	Keys, immobilizers, parking layout	Whether equipment is parked to block access or just parked
Signage	Trespass notices, camera notices, boundary marking	Whether signage is legible under the lighting you actually have
Staffing and patrol	Who is on site, when, and what they check	Whether patrols are documented and verifiable, or just claimed
Emergency procedure	Call list, escalation, lockdown, evacuation	Who gets called at 3 a.m., and whether they answer

Two lines there are worth expanding. Cameras record. They don’t respond. Camera coverage tells you who took the wire. It doesn’t stop the wire from leaving. The distance between a recording and a response is the same distance that sits between a private officer and a police call. That distinction is worth being honest about, and it applies to us too. We sell officers, so read the next section before you take our word on anything. “Documented patrol” needs a definition. A patrol that produced a report is not the same as a patrol that happened. GPS guard tour systems timestamp and geotag each checkpoint, which is the difference between a claim and a record. If you’re already paying for patrol coverage, confirming what your patrol reports actually prove is a 10-minute job with a real answer at the end.

Risk assessment vs threat assessment vs vulnerability assessment

These get used interchangeably. They aren’t the same thing, and knowing which one you’re buying matters when a vendor quotes you.

Assessment type	What it looks at	The question it answers	What you get
Threat assessment	What could come at you	Who or what might cause harm here, and how likely is it?	A ranked threat list
Vulnerability assessment	Where your protection is thin	Where are we exposed right now?	A gap list
Physical security risk assessment	All 3 factors together	Which exposures actually matter, and what do we fix first?	A prioritized action plan

A risk assessment contains the other 2. If someone quotes you a “risk assessment” and delivers a list of unlocked doors with no ranking and no consequence analysis, you bought a vulnerability assessment.

What a construction site assessment checks that an office one doesn’t

Most published checklists are office checklists. Doors, badges, visitor logs, reception. Reliable’s core sites are construction, warehouse, vacant buildings and retail centers, and 3 of those 4 spend most of the week unoccupied. Here’s what changes.

Construction sites

The site changes shape every few weeks, so the assessment has a shelf life measured in phases, not years. There’s no permanent infrastructure to hang security on, so lighting and perimeter are temporary and usually incomplete. The highest-value target is often the least protected: copper wire, wiring spools, and fuel, sitting in a container in an unlit corner. Our 3:30 a.m. copper incident was exactly that. Access control means gates and a sign-in sheet, and deliveries arrive from carriers nobody has vetted. Assess it as a site that will be empty and dark for 14 hours a day, because it will be. Reliable covers construction site security across Houston, and phase-by-phase reassessment is built into how those posts get staffed.

Warehouses and distribution

The loading dock is the exposure. It’s the one part of the building designed to open wide, and it’s often the part with the weakest after-hours control. Assess dock doors as doors, not as equipment. Check trailer staging, yard access, and whether the dock area is lit and covered after the last shift leaves. Our 11:20 p.m. incident was an unauthorized vehicle at a dock after operating hours. That’s the pattern. If you want the full warehouse guard scope, it starts at the dock.

Vacant commercial buildings

Nobody reports anything, because nobody’s there. Damage compounds for weeks before anyone notices. The threats shift from theft to copper stripping, squatting, arson and liability. Boarded openings are the first thing tested, which is what happened in our 1:45 a.m. incident. Assess for how fast you’d find out, not just for how hard it is to get in. The same logic runs through occupied commercial property, where an officer posted overnight in a Houston building is covering the same empty hours.

Retail and shopping centers

The only one of the 4 with a daytime risk profile that matters as much as the night one. Assess the sales floor, the stockroom, the loading area and the parking lot as 4 different problems with 4 different hours. Parking lot incidents don’t follow store hours.

Who should conduct your assessment in 2026?

Anyone with real physical security experience can run one. The question worth asking is who benefits from the recommendation. Look at who publishes the assessment guides ranking on this topic. Camera manufacturers. Access control vendors. Integrators. Their assessment framework ends where their product line begins, and that isn’t dishonest, it’s just gravity. An access control company assesses your access control. We have the same bias pointed the other way. We sell officers. So an assessment we run will find things an officer solves, and you should read our recommendations knowing that. What we’d say regardless: on an occupied office with staff, badges and a receptionist, cameras and access control probably do more for you per dollar than a guard post does. On an unoccupied site holding equipment overnight, a recording is evidence and a person is a response. Pick based on which one your site is. Three ways to get an assessment without the conflict: 1. Run it yourself with the checklist above. Free, and you know the site better than any vendor will after 90 minutes. 2. Hire an independent consultant who sells no hardware and no staffing. You pay for the assessment, which is the point. 3. Get 2 assessments from vendors who sell different things and read where they disagree. The disagreement is the useful part. If you take a vendor assessment, ask one question: what would you recommend if we didn’t buy anything from you? The answer tells you what kind of company you’re dealing with.

What can a Texas security officer legally do on your property?

If your assessment recommends guard coverage, you should know what that actually buys you, because the industry oversells it constantly. The short version of what guards can and can’t do is that the powers are narrower than the uniform suggests. A commissioned officer is an armed officer, and that’s all “commissioned” means. Under the Texas Occupations Code, a security officer commission is defined as an authorization issued by the department that entitles a security officer to carry a firearm. It grants no arrest power, no detention authority, and no peace officer status. Anyone telling you a commissioned officer has more legal authority than a non-commissioned one is describing a firearm, not a power. Arrest authority is a private citizen’s authority. Texas Code of Criminal Procedure Article 14.01(a) lets any person arrest without a warrant when the offense is committed in their presence or view and it’s a felony or an offense against the public peace. The broader power to arrest for any offense committed in view belongs to peace officers under 14.01(b). A licensed guard does not have it. This is the single most oversold thing in the guard industry. Training levels are set by rule. Level II training is required of every security officer, commissioned or not. Level III is the additional course required for a commission, and it covers the firearm component. Level IV applies only to the personal protection officer endorsement, not to ordinary armed guard work. Uniform and identification rules are strict. Officers must display the employing company’s name, the word “Security,” and the officer’s last name on the outermost garment. Section 1702.130 prohibits any title, insignia, identification card, uniform or statement intended to give the impression of a connection to federal, state or local government, and prohibits the designation “police” outright. Verify the license before you sign anything. Texas requires a security services contractor license to provide guard services. You can check any company’s license in the Texas DPS Online Private Security public search at tops.portal.texas.gov. Ours is B07315701. Look it up, and look up anyone else you’re considering. Insurance minimums are set in statute. Section 1702.124 requires $100,000 per occurrence for bodily injury and property damage, $50,000 per occurrence for personal injury, and a $200,000 total aggregate. Those are floors, not benchmarks. Ask for the certificate and read the limits. One more thing that belongs in the assessment file. OSHA has no specific workplace violence standard. It states plainly that there are currently no specific OSHA standards for workplace violence, and recommends instead that employers assess their worksites to identify ways to reduce the likelihood of incidents, then build a prevention program using engineering controls, administrative controls and training. Your assessment document is what shows you did the first part.

Turning the findings into a plan

An assessment that produces a document and no change was an expensive walk around the building. Four moves turn findings into a plan. Fix the immediate items this week. Broken locks, dead lights, unsecured openings, gates that don’t latch. These are cheap and they’re the ones that show up in incident reports. Two of our 5 incidents involved a poorly lit area or an unsecured storage container. Neither required a purchase order to fix. Layer the rest. Perimeter, lighting, signage, cameras, access control, procedure and staffing each do one job. A camera without a responder records. A responder without lighting can’t see. That chain is the point of the 4 goals of physical security design: deter, detect, delay, respond, in that order. Coverage on the hours you’re empty is the layer most sites are missing. Name an owner and a date for every item. “Someone should look at the back gate” survives about 4 days. “Marcus, back gate hardware, by Friday” survives. Re-run it when the site changes. Not annually because a year passed. When the phase changes, when the inventory changes, when the hours change, or after anything happens. If the finding is that you’re exposed overnight, the fix is coverage during those hours, and it doesn’t have to be a long commitment to test. We staff on month-to-month, short-term and weekly terms, so a 3-week trial on a single overnight post is a real option rather than a 12-month contract. Reliable holds Texas DPS license B07315701, runs 150 officers across more than 100 Houston sites. Want a second set of eyes on the walkthrough? Call us, tell us what the site is and what hours it sits empty, and we’ll put a written proposal in front of you at no charge. If the honest answer is that you need better lighting and not an officer, we’ll say that.

FAQs

What is a physical security risk assessment? A physical security risk assessment is a structured evaluation of a property’s assets, threats, vulnerabilities and existing controls that ends in a prioritized list of fixes. It covers access points, perimeter, lighting, cameras, access control, staffing and emergency procedures. Federal guidance treats risk as a function of threat, consequence and vulnerability, so a gap only ranks as a priority when something valuable is behind it and someone is likely to go for it. How often should you do a physical security risk assessment? There’s no universal rule, despite how often “at least annually” gets repeated. The Interagency Security Committee standard requires federal facilities to reassess once every 5 years at Facility Security Levels I and II, and once every 3 years at Levels III through V. For commercial property, the better trigger is change: a new site, an incident, a shift in what’s stored on site, a change in operating hours, or a new construction phase. Do more commercial break-ins happen at night or during the day? At night, and it’s the reverse of the pattern for homes. In FBI Uniform Crime Reporting Table 23 for 2019, agencies reported 157,327 nonresidential burglaries at night against 125,554 during the day, which is 55.6 percent at night among offenses where the time was known. Residential burglaries ran the other way at 40.2 percent at night. Houses get hit while people are at work; commercial buildings get hit after close. What’s the difference between a risk assessment and a vulnerability assessment? A vulnerability assessment finds weaknesses. A risk assessment finds weaknesses, then weighs each one against how likely it is to be exploited and what it would cost if it were, and ranks them. A full physical security risk assessment contains a threat assessment and a vulnerability assessment inside it. If you get a list of gaps with no ranking, you bought the smaller product. Who should conduct a physical security risk assessment? Someone with physical security experience, and ideally someone who doesn’t profit from the recommendation. Most published assessment frameworks come from camera and access control manufacturers, so they tend to conclude with cameras and access control. Guard companies, including ours, have the same bias in the other direction. Running the checklist yourself first is free, and getting 2 vendor assessments from companies that sell different things shows you where the honest disagreement is. What can a security guard legally do in Texas? Less than most people assume. A Texas security officer commission authorizes carrying a firearm and nothing more, under Section 1702.002 of the Texas Occupations Code. Arrest authority is the same as any private citizen’s under Code of Criminal Procedure Article 14.01(a), limited to a felony or an offense against the public peace committed in the officer’s presence or view. Officers must display the company name, the word “Security” and their last name, and are prohibited from using the designation “police.” Does a security risk assessment help with insurance or compliance? It gives you documentation, which is usually what’s being asked for. OSHA has no specific workplace violence standard and instead recommends that employers assess their worksites and build a prevention program. Insurers, lenders and general contractors often ask whether a site has been assessed. A dated written report with photos and assigned owners answers that; a verbal walkthrough doesn’t.