Heightened Security Measures for Financial Institutions under the ABS Guidelines

Financial institutions should not assume that their physical security arrangements will remain exactly the same under every threat condition.

The ABS Physical Security Guidelines for Financial Institutions 2.0 (Revised 2025) specifically distinguishes between peace-time security and heightened or enhanced security conditions.

ABS says financial institutions should develop different detection approaches for these conditions. During heightened security, additional measures may be introduced on top of normal CCTV, intrusion detection, access control, active monitoring and employee vigilance.

This reflects an important principle:

A financial institution does not necessarily need maximum security at all times, but it should be capable of increasing its security posture when the threat level changes.

ABS itself says its recommended security levels are intended to provide a foundation from which additional protective measures can be deployed as threat levels increase rather than assuming maximum protection is always required as the normal baseline.

What is meant by “heightened security”?

ABS uses the terms heightened security conditions and enhanced security conditions when discussing a situation where additional security measures may be necessary beyond normal business-as-usual arrangements.

The guideline does not define one universal numerical threat-level system that every FI must adopt.

Instead, the FI’s Security SOPs should take into account:

the threat scenarios identified through its risk assessment and the different Security Threat Levels needed to determine the appropriate responses and resources.

Consultant’s perspective

The practical distinction is between:

normal operations, where routine security controls are adequate,

and

enhanced operations, where the risk is sufficiently elevated that additional controls or resources are activated.

The exact trigger should be defined by the FI’s security governance and applicable official advisories.

Does ABS require maximum security all the time?

No.

The introduction to the guideline specifically says the recommended protection measures do not assume or recommend that maximum protection is always required as a standard.

Instead, the intent is to help FIs prepare to strengthen their security posture when the threat level requires it.

This is consistent with the overall risk-based philosophy of the document.

A normal corporate banking office therefore should not automatically operate as though it were permanently under an imminent threat.

At the same time, the organisation should already know what additional actions it can take if conditions change.

What security measures normally operate during peace-time?

ABS describes peace-time detection as involving normal security systems such as:

CCTV surveillance, intrusion alarms and access-control systems, supported by active monitoring through an SCR, SCC or third-party monitoring centre.

These technical measures are supplemented by on-site security personnel and employees watching for suspicious persons or items.

The key point is that heightened security does not replace the normal controls.

It adds to them.

What additional measures does ABS suggest during heightened security?

ABS gives several clear examples.

Where the FI owns or has full control of the premises, heightened-security measures may include:

limiting entry and exit points, activating lockdown procedures, deploying additional security personnel, carrying out bag screening, conducting vehicle screening, and broadcasting information to employees to increase awareness.

These are examples rather than a mandatory package that every FI must activate in every heightened condition.

The exact combination should follow the FI’s internal risk assessment and the circumstances of the threat.

Does heightened security mean closing some entrances?

Potentially, yes.

ABS specifically identifies limiting entry and exit points as one possible heightened-security measure.

Its Building Management Engagement Guide reinforces this by asking whether the building has procedures to restrict the number of ingress and egress points and perform security screening during a heightened-security situation.

The objective is to reduce the number of access points that need to be actively controlled and screened.

Consultant’s perspective

If ten entrances remain open during an elevated threat, security resources may be diluted.

Temporarily concentrating entry through fewer controlled points can allow more effective:

identity verification, screening, observation and response.

Any such arrangement must still remain consistent with applicable fire and life-safety requirements.

Is restricting entrances the same as a lockdown?

Not necessarily.

ABS includes limiting entry and exit points and refers to lockdown procedures within the same discussion, but the operational meaning can differ.

Reducing entrances may mean:

“The building remains open, but only selected entrances are in use.”

A lockdown may mean much more restrictive control depending on the threat.

Consultant’s perspective

An FI should define these terms in its SOP rather than assuming everyone interprets them the same way.

For example:

Restricted Access Mode

Normal business continues but fewer entrances are available.

Controlled Entry Mode

Only authorised staff and approved visitors are permitted.

Lockdown

Entry or movement is significantly restricted because of an active threat.

These are example operating definitions, not ABS-defined categories.

Does ABS require lockdown procedures?

ABS identifies lockdown procedures as one example of increased security measures that an FI with sufficient control over its premises may implement during heightened conditions.

Its building-management checklist also asks how tenants would be notified to evacuate or lockdown during a security incident.

This makes lockdown an important planning consideration even if it is not used routinely.

What should a lockdown procedure define?

ABS does not provide one complete lockdown template in the heightened-security section.

A practical procedure should establish:

what triggers lockdown, who can authorise it, which doors or zones are affected, how staff are informed, how visitors are managed, how building management is coordinated with and how normal operations are restored.

The procedure should also avoid creating conflict with emergency egress and life-safety requirements.

That is consultant implementation guidance rather than an ABS-prescribed procedure.

Can additional security officers be deployed during heightened security?

Yes.

ABS specifically gives the deployment of additional security personnel as an enhanced-security measure.

The Building Management Engagement Guide asks whether additional security personnel are deployed at ingress and egress points during heightened conditions to perform enhanced procedures such as screening.

This is a useful distinction because the FI may not need the same manpower deployment every day.

Consultant’s perspective

Instead of permanently maintaining the maximum guard force, the FI or building could have a scalable model where additional officers are brought in when the security posture increases.

That can provide greater security without treating the highest threat level as normal operations.

What would additional guards actually do?

ABS specifically links additional personnel with enhanced screening and control of entry and exit points.

Depending on the FI’s procedures, additional personnel might support:

screening, observation, access control, patrols, visitor management, queue control, lockdown support or incident response.

Those functions should be defined in the SOP before the threat level rises.

A common operational mistake is to say:

“Deploy two extra guards during heightened security”

without specifying what those guards are actually expected to achieve.

Does ABS recommend bag screening?

Yes, as a potential heightened-security measure.

ABS specifically states that bag checks or screening may be carried out during enhanced conditions, depending on the FI’s risk assessment.

This does not mean ABS requires routine bag searches at every financial institution under normal conditions.

The measure is presented as something that may be introduced when threat conditions justify it.

Should every person entering the office be screened during heightened security?

ABS does not give a universal instruction saying every employee, visitor and contractor must always receive the same screening.

The screening model should reflect:

the threat, risk assessment, premises type, building procedures and the FI’s level of control over the location.

Consultant’s perspective

A financial institution might differentiate between:

employees with verified credentials, visitors, contractors, delivery personnel and other persons seeking access.

The precise screening procedure should be established before activation rather than invented at the entrance when the threat level changes.

Does ABS recommend vehicle screening?

Yes.

ABS includes vehicular checks or screening among possible measures for heightened security.

This is particularly relevant where the FI or building controls:

car parks, loading areas, driveways, drop-off points or other vehicle-access routes.

The need should be tied to the relevant threat assessment.

What if the FI is located high up in an office tower?

The FI may have little or no direct control over vehicle screening because basement or driveway access belongs to building management.

This is exactly why ABS distinguishes between premises that are:

owned or fully controlled by the FI

and premises where the FI has limited control, such as multi-tenant buildings or co-location data centres.

The FI should therefore coordinate with building management rather than attempt to create a tenant-level vehicle-security arrangement that does not match the building’s controls.

What should an FI in a multi-tenant building do during heightened security?

ABS directly addresses this situation.

Where an FI occupies a multi-tenant building, co-location data centre or another premises where it has limited control, it should work with building management so that its internal security plans complement the building-management security plans during heightened or enhanced security conditions.

This is one of the most important parts of the guideline for corporate financial offices in Singapore.

The tenant cannot independently control:

• main building entrances;
• basement access;
• common lobbies;
• lifts;
• public areas;
• external perimeter security; or
• building-wide lockdown.

Those functions normally require landlord coordination.

Should the FI duplicate the landlord’s heightened-security measures?

Not necessarily.

The objective is for the two security plans to complement each other.

For example, building management may control screening at the main lobby while the FI increases controls at the tenant entrance.

Consultant’s perspective

A coordinated model could look like:

This is a consultant’s example, not an ABS-defined responsibility matrix.

Should the FI know how the landlord changes its security posture?

Yes.

The Building Management Engagement Guide asks how building management communicates:

current or new security measures, security incidents, increased threat levels and evacuation or lockdown instructions to tenants.

Therefore, a tenant should understand before an incident:

who will contact the FI, which communication channels are used and who within the FI receives the information.

How should employees be notified during heightened security?

ABS specifically says employee broadcasts may be undertaken during enhanced security to increase awareness and help mitigate potential threats.

The guideline does not prescribe one technology for these broadcasts.

Potential channels might include:

corporate messaging platforms, SMS, email, internal apps, PA announcements or security alerts.

Those are examples of possible communications methods, not ABS requirements.

What should an employee security broadcast say?

ABS does not provide a fixed message template.

Consultant’s perspective

A useful message should tell employees:

what has changed, what they are expected to do, which entrances are open or closed, whether visitors are restricted, whether screening is operating and where to obtain further instructions.

The message should be clear enough to change behaviour.

A vague message such as:

“Security has been heightened. Please remain vigilant.”

may increase awareness but does not necessarily tell staff what operationally changes.

Should employees know the organisation’s threat level?

ABS expects SOPs to account for different Security Threat Levels, and it supports communication to employees during heightened conditions.

However, ABS does not state that every employee must necessarily know the internal numerical or colour designation used by the FI.

What matters operationally is that employees understand the actions relevant to them.

What should employees do differently during heightened security?

ABS does not provide one universal employee behaviour checklist in this section.

It does, however, state that employees are part of the detection process and should be trained to identify suspicious persons, activities and items.

Consultant’s perspective

During heightened security, employees may be expected to be particularly attentive to:

unfamiliar persons, tailgating, suspicious items, unusual behaviour, attempts to bypass access procedures or unusual vehicle activity.

The exact instructions should be relevant to the prevailing threat and defined in the FI’s SOP.

Does access control need to change during heightened security?

Potentially.

ABS does not prescribe a universal reprogramming of access-control systems whenever the threat level changes.

However, limiting ingress and egress points, lockdown procedures and enhanced screening can all affect how access control is operated.

Consultant’s perspective

Possible operational changes might include:

temporarily disabling selected entrances, limiting visitor credentials, restricting after-hours access or applying stronger controls at particular zones.

Those are examples only and should be driven by the risk assessment and SOP.

Should visitor management change during heightened security?

Potentially, yes.

ABS does not state a specific heightened-security visitor workflow in the Visitor Management section, but the wider heightened-security guidance allows for tighter entry control and screening.

A reasonable FI procedure might therefore introduce stricter:

visitor pre-registration, identity verification, escorting or restrictions on non-essential visits

when threat conditions justify it.

These are consultant examples, not a universal ABS requirement.

Can visitor access be suspended entirely?

The ABS guideline does not state that visitor access must automatically stop whenever heightened security is declared.

Whether visits continue should depend on the threat, business need, building instructions and risk assessment.

Consultant’s perspective

An FI could have several predefined options, from normal visitor access through enhanced screening to temporary suspension of non-essential visitors.

The advantage of defining these options in advance is that management does not need to design the policy in the middle of an incident.

Should deliveries be restricted?

ABS does not specifically prescribe delivery restrictions in the heightened-security section.

However, deliveries are an external access route involving people, goods and sometimes vehicles.

Consultant’s perspective

Where the threat warrants it, the FI or building may consider changes to:

delivery times, loading-bay access, courier entry, parcel acceptance or screening.

These are operational options rather than ABS requirements.

Should CCTV monitoring increase during heightened security?

ABS says heightened detection should operate in conjunction with peace-time security measures, which include CCTV, intrusion alarms, access control and active monitoring.

It does not prescribe a universal rule saying every camera must be watched continuously once security is heightened.

Consultant’s perspective

Monitoring procedures may instead prioritise:

building entrances, perimeter approaches, vehicle-access points, critical rooms or other locations related to the prevailing threat.

The objective is enhanced situational awareness, not merely displaying more cameras.

Should alarm thresholds change during heightened security?

The guideline does not explicitly instruct FIs to change alarm sensitivity or programming.

Any such technical change would therefore be consultant or system-design judgement, not an ABS requirement.

However, the broader principle of enhanced detection may justify reviewing which events receive priority during an elevated threat.

Should guard patrol frequency increase?

ABS does not explicitly say that guard patrol frequency must increase during heightened conditions.

It does, however, support deploying additional security personnel and enhanced security operations.

Consultant’s perspective

An FI may choose to increase patrols of vulnerable or critical areas if that directly addresses the identified threat.

The patrol change should be purposeful rather than simply increasing activity for appearance’s sake.

What triggers heightened security?

The ABS guideline does not provide one universal activation threshold.

It says enhanced measures may be implemented during heightened security or as advised by the authorities, while the actual measures should depend on the FI’s internal risk assessment.

Possible triggers therefore need to be established within the FI’s own security governance.

Consultant’s perspective

Triggers might include:

an official security advisory, a credible threat directed at the organisation, a threat affecting the building or neighbourhood, intelligence indicating increased risk or a major security incident.

These examples are not a list prescribed by ABS.

Who should have authority to raise the security level?

ABS does not prescribe a particular job title.

The FI should define the decision-making authority within its SOP.

This might involve the:

Security Manager, Head of Corporate Security, Crisis Management Team or another designated management function.

The important issue is that the authority is predetermined and understood.

Should there be predefined Security Threat Levels?

ABS says SOPs should consider different Security Threat Levels and plan the appropriate resources and responses.

This supports creating a structured activation framework.

However, ABS does not prescribe:

a three-level model, four-level model, colour code or naming convention.

The FI can therefore choose a system that fits its organisation.

What might a practical Security Threat Level framework look like?

A simple consultant-designed framework might be:

This is an example framework only. ABS does not define these four levels.

Should every site use the same heightened-security plan?

Not necessarily.

ABS recognises different types of premises such as:

office buildings, retail branches, data centres and multi-tenant facilities.

The FI’s ability to implement enhanced measures also depends on whether it owns or controls the site.

A bank branch with street frontage may have very different heightened-security options from a tenant on Level 30 of a commercial tower.

How does heightened security affect a retail branch?

ABS’s heightened-security section applies broadly, while its retail-branch appendix separately addresses branch protection.

For a retail branch, enhanced security could potentially involve:

more controlled customer entry, increased guarding, heightened observation, screening or greater coordination with mall/building security.

These are consultant applications of ABS’s general heightened-security measures, not a specific retail-branch checklist in this section.

How does heightened security affect a data centre?

A data centre may have much greater FI control over:

perimeter access, vehicle entry, visitor admission, screening and internal zones.

ABS specifically notes that organisations owning or fully controlling their premises can implement more direct enhanced measures.

A co-location data centre, however, is specifically mentioned as an environment where the FI may have limited control and should coordinate with the facility operator.

Should heightened-security measures be documented in the Security SOP?

Yes.

ABS says Security SOPs should address:

different threat scenarios, different Security Threat Levels, required responses and resources.

The plan should therefore not simply say:

“Increase security when required.”

It should describe what actually changes.

What should a Heightened Security SOP contain?

A useful procedure should identify:

the activation trigger, authority to change the security level, measures activated at each level, additional personnel required, entrance restrictions, screening arrangements, communications, visitor restrictions, building-management coordination, monitoring priorities and the process for returning to normal conditions.

This is a consultant’s recommended structure based on the ABS requirements rather than a prescribed ABS template.

How should an FI return to normal security?

The main heightened-security section does not describe a detailed stand-down process.

However, the Building Management Engagement Guide asks how building management communicates when its security status returns to normal.

Consultant’s perspective

The FI should therefore define:

who authorises stand-down, how temporary controls are removed, how employees are notified, how closed entrances are reopened and whether any incident or activation review is required.

Without a stand-down process, temporary emergency controls can remain inconsistently applied.

Common mistakes when interpreting the ABS heightened-security guidance

“The FI should operate at maximum security all the time.”
No. ABS expressly says maximum protection is not assumed as the standard operating posture.

“Heightened security just means telling staff to be vigilant.”
No. ABS gives concrete operational examples including reduced entry points, additional personnel, bag checks, vehicle checks and employee communications.

“The tenant can create its own lockdown without the landlord.”
Not always. ABS specifically tells FIs in multi-tenant environments to coordinate their plan with building management.

“Bag screening is required every day.”
ABS describes it as a possible heightened-security measure, not a universal normal-operating requirement.

“Every office needs the same heightened-security procedure.”
No. Premises ownership, control, layout and risk all matter.

“A threat level is useful even if nothing operational changes.”
The ABS approach links threat levels to the resources and responses required.

A practical heightened-security checklist

When developing an enhanced-security plan, an FI should be able to answer:

1. What conditions trigger a higher Security Threat Level, who has authority to activate and stand down the heightened posture, and how is the decision documented?
2. Which normal security measures continue unchanged, and which controls increase?
3. Which entrances or exits can be restricted without compromising life safety?
4. Is there a defined lockdown procedure, and how does it interact with the building’s procedure?
5. Are additional guards available, and what specific duties will they perform?
6. Is bag screening required at the relevant level, who performs it and at which locations?
7. Is vehicle screening relevant, and is it controlled by the FI or landlord?
8. Do visitor, contractor and delivery procedures change?
9. Are CCTV and monitoring priorities altered during the heightened condition?
10. How are employees notified of the change and told what actions are required?
11. How does building management communicate threat-level changes, lockdown or evacuation?
12. Are the FI’s procedures compatible with the landlord’s plan?
13. Are different plans needed for offices, branches, data centres or co-location facilities?
14. Have the heightened-security procedures been exercised before they are needed?
15. Is there a clear procedure for returning the site to normal operations?

Conclusion

The ABS guideline does not expect a financial institution to operate permanently at its highest possible security level.

Instead, it promotes a scalable physical security posture.

During normal conditions, FIs may rely on their routine combination of CCTV, access control, intrusion detection, monitoring, security personnel and employee awareness.

When conditions become heightened, ABS says additional measures may be layered on according to the risk assessment, including:

limiting entry and exit points, lockdown procedures, additional security personnel, bag screening, vehicle screening and employee broadcasts.

For FIs in multi-tenant premises, coordination with building management becomes especially important because many of the controls required for enhanced security may sit outside the tenant’s direct authority.

The key principle is:

Heightened security should not mean improvising more security on the day of a threat. The additional controls, resources, authority and communications should already be defined before they are needed.