Security SOPs for Financial Institutions under the ABS Guidelines: What Procedures Should an FI Have?

Physical security systems are only part of a financial institution’s security programme.

CCTV, access control, intrusion alarms and security personnel still need clear operating procedures that explain:

• what should happen;
• who should do it;
• when action should be taken; and
• how incidents should be escalated.

The ABS Physical Security Guidelines for Financial Institutions 2.0 (Revised 2025) specifically states that financial institutions should maintain a current and updated set of Security Standard Operating Procedures (SOPs).

Those SOPs should cover both normal day-to-day security operations and escalated security incidents. They should also complement the building owner’s procedures and consider the threat scenarios identified through the FI’s risk assessment and different Security Threat Levels.

This means a Security SOP manual should not be a generic document sitting on a shelf.

It should describe how the organisation actually operates its physical security programme.

Does ABS require financial institutions to have Security SOPs?

ABS states that financial institutions should ensure that a current and updated set of Security SOPs is available.

The guideline also states that these SOPs should address a range from:

day-to-day security operations

through to:

management of escalated security incidents.

The SOP framework should therefore cover both routine security and emergency response.

What should Security SOPs cover?

ABS does not provide one prescribed table of contents for an FI’s entire SOP manual.

However, several operational procedures are explicitly discussed throughout the guideline.

These include areas such as:

• security operations;
• door-access review;
• visitor management;
• guard tours;
• monitoring and escalation;
• different Security Threat Levels;
• incident response;
• evacuation and personnel accountability;
• coordination with building management; and
• post-incident review.

The document therefore gives enough direction to build a structured Security SOP framework without suggesting that every FI must use one identical manual.

Should Security SOPs be based on the risk assessment?

Yes.

ABS specifically says SOPs should consider the threat scenarios assessed in the risk assessment.

This is important.

A financial institution should not simply download a generic set of procedures and assume they are suitable.

The procedures should reflect:

• the type of premises;
• critical assets;
• identified threats;
• building environment;
• security systems;
• staffing model; and
• response capabilities.

Consultant’s perspective

A good sequence is:

Risk Assessment → Security Design → Security SOPs → Training → Exercises → Review

The SOP should explain how the controls identified through the risk assessment are actually operated.

Should the FI’s SOPs align with the landlord’s procedures?

Yes.

ABS states that the FI’s Security SOPs should incorporate relevant building SOPs so that the FI’s procedures complement the building owner’s response during security incidents.

This is particularly important in a multi-tenant commercial building.

A tenant may control:

• its office access control;
• tenant CCTV;
• internal alarms; and
• employee communications.

But building management may control:

• the lobby;
• lifts;
• external entrances;
• loading bays;
• building security officers;
• PA announcements;
• evacuation;
• lockdown; and
• liaison with emergency services.

The two procedures therefore need to work together.

Why is building coordination so important?

ABS repeatedly recognises that many financial institutions operate from leased premises.

During a serious security incident, conflicting procedures can create confusion.

For example:

the FI should not tell employees to evacuate through a route that building management has closed because of a threat.

Likewise, the FI’s internal lockdown procedure should not be developed without understanding how building access and emergency egress will operate.

ABS also states that emergency procedures should be coordinated with relevant building procedures so the FI can manage elevated threat levels beyond business-as-usual conditions.

Should SOPs change according to the Security Threat Level?

Yes.

ABS specifically says SOPs should consider different Security Threat Levels so that the organisation can plan the appropriate response and resources required.

This means the FI should not necessarily operate in exactly the same way under all threat conditions.

Consultant’s perspective

A simple operational model could be:

Normal

Routine access control, monitoring and guard operations.

Heightened

Additional security personnel, tighter access, enhanced screening and greater employee awareness.

Emergency

Lockdown, evacuation, invacuation or other incident-specific response.

This is an example model rather than a threat-level classification prescribed by ABS.

What should a day-to-day Security SOP include?

ABS does not prescribe a fixed structure, but routine procedures could logically include:

• opening and closing;
• access-control administration;
• visitor registration;
• contractor access;
• alarm handling;
• CCTV monitoring;
• security patrols;
• key management;
• incident reporting;
• after-hours access;
• control-room operation; and
• escalation.

These subjects are consistent with operational areas discussed throughout the ABS guideline.

The exact SOP set should follow the FI’s premises and risk assessment.

Should access-control administration have an SOP?

Yes, this is strongly supported by the guideline.

ABS specifically says door-access privileges should be reviewed regularly to ensure employees’ physical access rights remain valid.

For sensitive or critical areas, the FI should also review access logs for possible violations or suspicious activity.

A practical access-control SOP should therefore establish:

• who can approve access;
• who administers credentials;
• how access is changed;
• how access is removed;
• how leavers are handled;
• how critical-area access is approved;
• how access logs are reviewed; and
• how suspicious access events are escalated.

The detailed workflow is a consultant’s implementation recommendation rather than an ABS-prescribed template.

Does ABS specify how often access rights should be reviewed?

The guideline says access privileges should be reviewed regularly, but does not prescribe one universal interval in the cited section.

The FI should therefore establish its own review frequency according to risk and governance requirements.

The procedure should also include event-driven changes such as:

• employee resignation;
• termination;
• department transfer;
• role change; or
• removal of a business need for access.

Should visitor management have its own SOP?

Yes.

ABS has a dedicated Visitor Management section.

The visitor process should address identification, screening, recording visitor information, issuing visitor passes and escorting visitors where necessary.

Because visitor details are personal data, ABS also requires their collection, use, disclosure and disposal to comply with PDPA.

A Visitor Management SOP should therefore explain how those requirements are carried out consistently.

Should contractor access be covered?

ABS does not provide a separate detailed contractor-management SOP.

However, contractors can create greater security risk than normal visitors because they may require access to:

• critical equipment rooms;
• ceilings;
• security panels;
• electrical systems;
• telecommunications rooms; or
• other restricted areas.

Consultant’s perspective

The visitor procedure can therefore be supplemented with a contractor-access procedure covering:

• approval;
• identity checks;
• access zones;
• escort requirements;
• work permits where applicable;
• temporary credentials;
• after-hours work;
• completion checks; and
• credential return.

This is a practical extension of the ABS visitor and access-control principles.

Should guard patrols have a procedure?

Yes.

ABS specifically discusses Guard Tour Management.

It says guard-tour procedures should provide a systematic approach to patrolling and ensure adequate security coverage of strategic or vulnerable locations such as:

• entry points;
• critical equipment rooms;
• staircases; and
• service areas.

The procedure should include:

• patrol timing;
• routes; and
• checkpoints.

ABS also says that guard-tour frequency and routes should be varied as a good practice to reduce predictability.

Should guard patrols always follow the same route?

No.

ABS specifically recommends varying guard-tour frequency and routes to avoid predictability.

This is useful because a completely predictable patrol can potentially be observed and exploited.

A patrol SOP should therefore define:

• areas that must be covered;
• required frequency;
• checkpoints;
• incident reporting; and
• acceptable variation in route and timing.

What if building management controls the guard-tour system?

ABS says that where guard-tour management is provided by building management, the FI should assess that arrangement as part of the wider infrastructure supporting its security programme.

This follows the same approach ABS takes towards building-managed:

• CCTV;
• access control;
• visitor management; and
• intrusion detection.

The FI should understand what it depends on rather than simply assuming the landlord’s arrangement is sufficient.

Should alarm monitoring and escalation have an SOP?

Yes.

Although the SOP section itself does not list every alarm workflow, the Monitoring section requires an escalation plan for detected threats.

A practical Security SOP should therefore define how operators handle events such as:

• intrusion alarm;
• forced door;
• door held open;
• duress alarm;
• suspicious access event;
• CCTV incident; and
• security-system failure.

The process should clearly define:

Detection → Verification → Classification → Escalation → Response → Documentation

Who should be notified when an alarm occurs?

The ABS guideline does not prescribe one universal contact tree.

The escalation should reflect:

• the event;
• site;
• severity;
• time of day; and
• response resources.

A practical escalation matrix might include:

This is an implementation example, not an ABS-prescribed matrix.

Should SOPs cover system failures?

The guideline does not provide one dedicated “system failure SOP” section.

However, physical-security operations depend on CCTV, access control, alarms and communications.

A practical FI security manual should therefore cover security degradation scenarios such as:

• CCTV failure;
• access-control outage;
• monitoring-link failure;
• alarm-system fault;
• loss of power;
• communications outage; or
• building-security-system failure.

Consultant’s perspective

The important question is:

“If a security control fails, what temporary measure replaces it until it is restored?”

This could involve additional guards, manual access records or temporary patrols depending on the situation and risk.

These are operational recommendations rather than explicit ABS prescriptions.

Should there be different SOPs for different types of premises?

Yes, where the risk and operations differ.

ABS recognises that financial institutions may operate from:

• offices;
• retail branches;
• data centres; and
• other facilities.

It also says escalation arrangements should differ according to the type of premises.

A single generic procedure may therefore not work equally well across every location.

For example, the response to an intrusion alarm at:

a normal office, retail branch or data centre

may require different response resources and escalation.

What should emergency-response SOPs cover?

ABS divides response into three broad phases:

1. Preparation
2. Incident Response
3. Post Incident Recovery.

During preparation, the FI should develop plans and procedures for identified security threats and establish:

• roles and responsibilities;
• points and methods of activation;
• threat-specific procedural guidance; and
• arrangements for accounting for people and assets.

Building-management procedures should also be aligned with the FI’s response plans.

Should roles and responsibilities be written into the SOP?

Yes.

ABS specifically says personnel roles and responsibilities should be assigned as part of incident preparation.

During incident response, ABS again says roles, responsibilities and actions should be clearly defined, including liaison and coordination with relevant external authorities.

A procedure should therefore answer:

• Who declares the incident?
• Who leads the response?
• Who communicates with building management?
• Who accounts for employees?
• Who contacts authorities?
• Who communicates with management?
• Who documents the event?

Does ABS require threat-specific response protocols?

Yes.

ABS says response protocols should be developed and simulated for several specific situations:

• Active Assailant;
• Bomb Threat;
• Mail Delivered Threats;
• Chemical, Biological and Radiological Threats;
• Person-Borne Improvised Explosive Device;
• Vehicle-Borne Improvised Explosive Device; and
• Hostage Situation.

These should not necessarily all be combined into one vague document called “Emergency Response”.

Each scenario can require different behaviour.

Should Active Assailant response have its own procedure?

Yes.

ABS specifically lists Active Assailant among the threat scenarios for which response protocols should be developed and simulated.

The guideline’s dedicated section uses the Run, Hide, Tell approach.

A full Active Assailant article can address that subject separately.

For the Security SOP manual, the key issue is ensuring the organisation has:

• a recognised response protocol;
• employee awareness;
• communication procedures; and
• coordination with building security.

Should there be a bomb-threat SOP?

Yes.

ABS explicitly identifies Bomb Threat as one of the scenarios requiring a developed and simulated response protocol.

Its Building Management Engagement Guide also asks whether the building maintains:

• a bomb-threat checklist;
• an escalation procedure;
• emergency contact information;
• procedures for suspicious packages; and
• evacuation procedures where the threat is assessed as credible.

The FI’s bomb-threat SOP should therefore coordinate closely with the building’s procedure.

Should suspicious mail have its own SOP?

Yes.

ABS specifically identifies Mail Delivered Threats among response scenarios requiring protocols.

It also says mailroom personnel should be trained to identify, respond to and escalate mail-related threats and suspicious items.

Where mailroom personnel are outsourced, the FI should ensure they are appropriately trained and understand the building’s emergency plan.

This is particularly important because mail-related threats may involve chemical, biological, radiological or explosive risks.

Should CBR threats have a procedure?

Yes.

ABS specifically identifies Chemical, Biological and Radiological Threats among the scenarios requiring response protocols.

The building and FI may need to coordinate matters such as:

• sheltering;
• access restrictions;
• ventilation;
• communication;
• emergency services; and
• accounting for affected personnel.

Detailed CBR instructions should follow the applicable official emergency guidance rather than be invented solely from a generic SOP template.

What about PBIED and VBIED threats?

ABS separately identifies both:

• Person-Borne Improvised Explosive Device (PBIED); and
• Vehicle-Borne Improvised Explosive Device (VBIED)

as scenarios for which response protocols should be developed and simulated.

These are particularly relevant to:

• perimeter security;
• building entrances;
• vehicle access;
• loading areas; and
• evacuation or invacuation decisions.

For most tenanted FIs, much of the external response will depend on building-management procedures.

Should hostage situations be covered?

Yes.

ABS lists Hostage Situation among its response-protocol scenarios.

The detailed ABS guidance discusses individual behaviour during a hostage incident.

For the FI’s organisational SOP, the focus should also include:

• notification;
• coordination with authorities;
• access control around the affected area;
• employee communication; and
• post-incident support.

Should the FI have evacuation and invacuation procedures?

Yes, emergency planning is a major part of the ABS response framework.

ABS’s Building Management Engagement Guide also explores both:

• evacuation; and
• invacuation, or sheltering in place.

An FI located in a commercial building should therefore understand:

• when the building expects occupants to evacuate;
• when occupants may be required to remain inside;
• what communication will be used;
• what routes should be followed; and
• how employees and visitors will be accounted for.

Should staff accountability be part of the SOP?

Yes.

ABS specifically says that response planning should include accounting for assets and people.

It also states that staff must be accounted for efficiently when evacuation is activated and that the responsible department should have protocols to commence employee accounting quickly.

A practical accountability procedure might use:

• floor wardens;
• employee applications;
• HR records;
• visitor-management records;
• assembly-point reporting; or
• another suitable method.

Those are possible implementation methods rather than ABS-prescribed tools.

Should SOPs include external-authority liaison?

Yes.

During incident response, ABS says roles, responsibilities and actions should be clearly defined, including coordination and liaison with relevant external authorities.

The SOP should therefore establish who is authorised to interact with:

• Police;
• SCDF;
• building management; and
• other relevant responders.

It should avoid a situation where several people independently provide inconsistent information during an emergency.

Should employees receive training on the SOPs?

Yes.

ABS states that staff awareness and training are important so protocols and relevant information are communicated to the appropriate personnel.

Elsewhere, the guideline says employees should receive security awareness and training appropriate to their roles.

That means not every employee necessarily needs the same level of procedural detail.

For example:

General employee

May need to understand suspicious activity reporting and emergency actions.

Reception

Needs detailed visitor and incident procedures.

Security

Needs alarm, monitoring and escalation procedures.

Facilities

May need security-system and building coordination procedures.

Emergency team

Needs detailed incident-command and accountability responsibilities.

Should SOPs be tested through drills?

Yes.

ABS recommends regular security simulation exercises to identify and address gaps in procedures.

It also states that regular security-related exercises and drills should be conducted so employees and role holders remain familiar with emergency procedures.

This is important because a procedure can look good on paper but fail during an actual incident.

How often should exercises be conducted?

The cited SOP and protocol sections do not prescribe one universal drill frequency for every financial institution.

The organisation should establish an exercise programme appropriate to:

• site risk;
• threat scenarios;
• organisational requirements; and
• applicable building or regulatory obligations.

Different procedures may also be tested at different intervals.

Should exercises involve building management?

Where the FI depends on building-level response, yes.

ABS specifically emphasises alignment with building operating protocols and procedures.

Consultant’s perspective

A tenant-only drill has limited value if the actual emergency depends heavily on:

• landlord security;
• building PA;
• lift operation;
• access control;
• evacuation routes; or
• lockdown.

Joint exercises can reveal coordination gaps that internal tabletop exercises may miss.

What should happen immediately after a security incident?

ABS says swift action is required to mitigate incident damage.

Roles, responsibilities and actions should be clearly defined.

The incident responder or Emergency Response Team should:

• identify the cause of the incident or breach;
• contain the incident; and
• take action to reduce further impact while avoiding compromise of subsequent investigations.

This means incident SOPs should address both immediate safety and preservation of the integrity of follow-up investigation.

Should there be a post-incident review procedure?

Yes.

ABS states that after an incident, FIs should analyse root causes and identify:

• response gaps; and
• vulnerabilities in the physical security plan.

Stakeholder input should be sought, and parties involved in the response may assess their own performance.

The FI may also conduct another Physical Security Risk Assessment where appropriate.

What happens to lessons learned?

ABS says corrective actions should be developed and implemented to address identified gaps and improve security measures.

The lessons learned should then be incorporated into the FI’s policies and procedures.

This creates a continuous improvement cycle:

Plan → Train → Exercise → Respond → Review → Improve

Does ABS prescribe the exact format of the Security SOP manual?

No.

The guideline requires a current and updated set of Security SOPs but does not prescribe one exact document structure.

A practical manual could be organised as follows:

This is a consultant’s recommended structure based on the topics in ABS, not an ABS-mandated table of contents.

Can some procedures be combined?

Yes.

There is no reason every subject needs to be a separate document.

For example, a smaller corporate FI may combine several procedures into one Physical Security Operations Manual.

A larger organisation may instead maintain separate documents for:

• access control;
• visitor management;
• control-room operations;
• emergency response;
• retail branches; and
• specific high-risk facilities.

The important issue is whether the required procedure is:

clear, current, accessible and usable.

Common mistakes when developing Security SOPs

Writing the SOP before understanding the risk

ABS expects threat scenarios to come from the risk-assessment process.

Copying generic procedures from another office

A data centre, branch and corporate office can require very different response models.

Ignoring the landlord

ABS specifically says tenant procedures should complement building procedures.

Having procedures that do not match the actual systems

For example, an SOP may say security will verify an alarm through CCTV even though there is no camera covering that location.

Having no escalation ownership

A procedure should make clear who has decision authority.

Failing to train employees

A document nobody understands will not provide effective response.

Never exercising the SOP

ABS specifically encourages simulations and drills.

Never updating procedures after an incident

ABS expects lessons learned to be incorporated into policies and procedures.

Practical ABS Security SOP checklist

A financial institution should be able to answer:

• Is there a current set of Security SOPs?
• Who owns and approves them?
• Do they reflect the current risk assessment?
• Are normal and heightened-security conditions addressed?
• Are building-management procedures incorporated?
• Are access-control procedures documented?
• Are access privileges regularly reviewed?
• Are visitor procedures documented?
• Are contractor procedures required?
• Are guard patrols documented?
• Are patrol routes and frequencies appropriately varied?
• Are CCTV and alarm escalation procedures documented?
• Does every significant alarm have a response owner?
• Are after-hours procedures defined?
• Are security-system failure procedures defined?
• Are evacuation and invacuation procedures understood?
• Is employee accountability addressed?
• Are Active Assailant procedures available?
• Are Bomb Threat procedures available?
• Are Mail Threat procedures available?
• Are CBR procedures available?
• Are PBIED and VBIED procedures considered?
• Is Hostage Situation response addressed?
• Are external-authority contacts and responsibilities clear?
• Are employees trained according to their roles?
• Are procedures tested through exercises?
• Are post-incident reviews performed?
• Are lessons learned incorporated back into the SOPs?

Conclusion

The ABS Physical Security Guidelines makes it clear that financial institutions should maintain current and updated Security SOPs covering routine security operations as well as escalated incidents.

Those procedures should:

• follow the threat scenarios identified in the risk assessment;
• account for different Security Threat Levels;
• complement building-management procedures;
• define roles, responsibilities and escalation;
• be communicated to relevant employees;
• be tested through exercises; and
• be updated after incidents and lessons learned.

The key principle is:

A physical security system tells the organisation that something has happened. The Security SOP tells people what to do about it.