Physical Security for a New Office or Renovation: What Financial Institutions Should Review Before and During Fit-Out

Physical security should ideally be considered before an office layout is finalised, not added after the architectural design is complete.

The ABS Physical Security Guidelines for Financial Institutions 2.0 (Revised 2025) supports this approach in several ways. It says relevant threats should be considered during the pre-lease assessment for new sites or incorporated into new construction where possible. For existing buildings, vulnerabilities should be assessed and the associated risks addressed.

ABS also says financial institutions should consider conducting a Physical Security Risk Assessment when a building or premises is redeveloped or undergoes major modification, renovation or alteration.

The practical principle is:

Security decisions become easier, more effective and often less expensive when they are made before the walls, doors, ceilings and services have already been built.

Should physical security be considered before signing a lease?

Yes.

ABS specifically says relevant threats should be considered as part of the pre-lease assessment for new sites.

This is important because some physical-security issues cannot easily be fixed within the tenant’s office.

A prospective tenant may depend on building-controlled measures such as:

the external perimeter, main lobby, vehicle access, loading bay, building CCTV, lift access, common-area security, evacuation arrangements and building security officers.

Once the lease is signed, the FI may have limited ability to change those controls.

Consultant’s perspective

A physical-security review is therefore valuable before commercial commitment, particularly for important headquarters, operations centres, branches or other sensitive premises.

The objective is not necessarily to reject a building with security limitations.

It is to understand those limitations early enough to determine whether they are acceptable or can be mitigated.

Does ABS require a Physical Security Risk Assessment for a new office?

ABS says FIs should consider conducting a Risk Assessment for redevelopment and following major modification, renovation or alteration, as well as periodically.

The ABS language is therefore more nuanced than:

“Every office fit-out legally requires an ABS Risk Assessment.”

That is not what the source says.

However, the ABS framework clearly supports using the RA to identify:

assets, applicable threats, vulnerabilities, potential impact and the appropriate physical-security controls.

For a significant new office, that assessment provides the logical basis for the security design.

Why should the Risk Assessment happen before detailed design?

Because the RA helps determine what actually needs protection.

Without this step, the project can quickly become equipment-driven:

“How many cameras do we need?”

“Which doors need readers?”

“Should the server room use biometric access?”

Those questions are easier to answer after establishing:

what assets are important, what threats apply, which areas are sensitive, what vulnerabilities exist and what consequences would result from compromise.

The security system should follow the risk.

The risk should not be reverse-engineered to justify equipment that has already been selected.

Can renovation itself create new security vulnerabilities?

Yes.

ABS expressly says new vulnerabilities may arise from deterioration or discontinuation of existing capabilities, new or updated processes or regulations, and major modification, renovation or alteration of the building or adjoining infrastructure.

This is particularly important during office fit-outs.

A change that appears architectural may also alter physical security.

For example, relocating a wall may change a security boundary. Creating another entrance may require access control and surveillance. Moving reception may affect visitor screening. Building a new critical room may introduce new access requirements.

The project team should therefore assess security implications alongside architectural changes.

Does the type of financial institution premises matter?

Yes.

ABS states that physical-security countermeasures will vary according to factors including the FI’s location, assets and operations. It specifically notes that security measures for offices, retail branches and critical facilities such as data centres will differ.

A normal corporate office therefore should not automatically be designed like a data centre.

Likewise, a retail branch cannot simply inherit a corporate-office security design.

Security should be proportionate to the actual environment and risk.

Should the FI assess the entire building or only its tenancy?

For a tenanted office, looking only at the tenant boundary can miss important security dependencies.

ABS says FIs in tenanted spaces should engage the building owner or management to understand the building’s Security and Safety Design so they can plan their own security requirements.

This means the tenant security design should begin with questions such as:

How do people enter the building?

How do visitors reach the tenant floor?

How are lifts controlled?

What CCTV exists in common areas?

Who monitors incidents?

What does building security do?

How are emergencies communicated?

Only after understanding the building layer can the FI properly design the tenant layer.

What should be reviewed during pre-lease security due diligence?

Appendix 1 of the ABS guideline contains a detailed Building Management Engagement Guide, which can support discussions with landlords or building management.

For a new office project, a practical review can examine building perimeter arrangements, vehicle and loading access, entrances, lobby controls, visitor management, CCTV, security personnel, control-room capability, incident communications, evacuation and lockdown arrangements, and the building’s procedures for major security threats.

The appendix is an engagement checklist rather than a replacement for the FI’s own Risk Assessment.

Consultant’s perspective

A good project sequence is:

Building due diligence → FI Risk Assessment → Gap analysis → Security design → Fit-out → Testing and handover.

Should security influence the office floor plan?

Yes.

ABS’s Protection section makes it clear that infrastructure and architecture form part of the physical-security design.

The floor plan determines:

where public visitors can travel, where employees work, how restricted rooms are positioned, where critical equipment sits and how many access points need to be controlled.

A security-friendly layout can reduce dependence on technology.

For example, a restricted function located deep inside the controlled office may need less external exposure than the same function positioned beside a public reception or common corridor.

Should the new office have security zones?

ABS describes security-level zoning with role-based access privileges as good practice.

Its example distinguishes between public areas, visitor areas, normal employee areas and high-security restricted areas.

This is particularly useful during a fit-out because zoning can influence the architecture from the beginning.

A practical office might translate the principle into areas such as:

public/reception, controlled visitor space, employee workspace and restricted/critical rooms.

The names and number of zones can vary.

ABS does not require every FI to use one fixed four-zone numbering scheme.

Why should zoning be decided before access-control doors are selected?

Because access-control design should follow the boundary between security zones.

If the project team begins by placing card readers on architectural doors without first understanding the zones, the result can be inconsistent.

Some unnecessary doors may receive readers while important boundaries remain weak.

Consultant’s perspective

The better sequence is:

Define security zones → identify transitions between zones → determine who requires access → determine the appropriate control.

That creates a more coherent access-control design.

Does every internal office door need access control?

No.

ABS says internal access points should have security appropriate to the sensitivity of the area. It refers to complementary controls such as lighting, CCTV, secure locking and access control, with stronger measures for restricted or critical areas.

Therefore, the design should distinguish between an ordinary internal door and a boundary protecting a restricted space.

Installing a reader on every available door is not itself evidence of good security design.

When should 2FA be considered?

ABS says access points to restricted or critical areas should be designed with complementary controls such as 2-Factor Authentication, intrusion detection and/or audible alarm systems. It also notes that specially protected entrances such as gates, interlocking systems or portals may be needed depending on the Risk Assessment.

The source does not say that every office entrance or server-room door universally requires 2FA.

The security level should follow the sensitivity and assessed risk.

Should the number of entrances be minimised?

ABS says external entry points, including vehicle access, should be minimised and appropriately controlled.

For a tenant office, this principle can also be useful when reviewing the number of ways people can enter controlled space.

Multiple entrances can increase:

reader requirements, CCTV requirements, visitor-control complexity, alarm points and guard or monitoring responsibilities.

Consultant’s perspective

This does not mean emergency exits should be eliminated or life safety compromised.

It means unnecessary routine access paths should not be created without considering their security impact.

Should architects and interior designers consider physical security boundaries?

Yes.

ABS specifically says walls and partitions are important physical barriers separating public and restricted areas. It also discusses floor-to-ceiling slab partitioning as a way to increase resistance to access above ceilings or below raised floors.

This matters during fit-out because a secure door can be undermined by a weak surrounding partition.

Consultant’s perspective

The project should consider the complete security envelope:

wall + door + frame + locking + ceiling/floor interfaces + electronic detection

where justified by the risk.

A high-security reader does not transform a lightweight, easily bypassed room into a high-security space.

Does ABS require reinforced-concrete walls for every restricted room?

No.

ABS discusses reinforced construction as part of its wider protection guidance, but the required treatment depends on the Risk Assessment and other requirements.

Therefore, it should not be converted into:

“ABS requires all bank server rooms to have reinforced-concrete walls.”

The source does not support that universal statement.

When should CCTV planning begin?

CCTV should be considered while the layout is still being developed.

ABS says camera placement should be based on identified risk and lists locations such as entrances, lobbies, access-control and screening points, sensitive/restricted entrances, critical equipment rooms, technology rooms, data halls and security control rooms.

If CCTV is designed only after construction, the project may discover:

poor mounting positions, obstructed fields of view, unsuitable lighting, missing network routes or architectural features that prevent the desired view.

Consultant’s perspective

Camera design should therefore be coordinated with:

architecture, lighting, ceiling layout, door positions and furniture.

Should the CCTV design start with the number of cameras?

No.

ABS says camera placement should be based on risks identified.

The better question is:

“What security event or activity must be visible here?”

A camera schedule should follow the surveillance objective.

For example, the purpose at an office entrance may differ from the purpose inside a technology room.

Camera quantity is an output of the design, not the starting assumption.

Does ABS prescribe the resolution, FPS or retention for a new office CCTV system?

Not in the main ABS CCTV section.

As discussed in the standalone CCTV article, the guideline does not establish one universal minimum resolution, frame rate or retention period for all financial institutions.

ABS instead refers readers to more detailed technical guidance such as the SPF VSS Standard and GEBSS.

Therefore, project specifications should not claim:

“ABS requires 4MP, 15 FPS and 90 days”

unless another applicable source or the FI’s own specification establishes those values.

Should the access-control system be coordinated with fire and life safety?

Yes.

ABS states that access-control systems should not compromise fire-protection and safety systems and discusses integration of electronically controlled doors with fire protection for emergency egress in accordance with local fire code.

For a fit-out, this means access-controlled doors cannot be designed solely by the security integrator in isolation.

Consultant’s perspective

Door architecture should be coordinated among:

security, architect, fire consultant/QP where applicable, door contractor and M&E teams.

Security intent and life-safety behaviour need to agree before construction.

Should critical rooms be identified during space planning?

Yes.

ABS defines critical equipment as equipment supporting functions such as power, water, air supply, communications and networks, and fire-protection systems.

It says such equipment should, where practicable, be located away from higher-risk areas, concealed and protected, with protection such as CCTV, access control and intrusion detection and access limited to authorised personnel.

Consultant’s perspective

A fit-out is therefore an opportunity to avoid placing important technology or infrastructure rooms in unnecessarily exposed locations.

It is generally easier to select an appropriate room location during planning than to compensate later with additional security devices.

Should the server room be classified before deciding its security?

Yes.

The label “Server Room” by itself does not establish the required security level.

The FI should determine:

what systems it supports, what happens if those systems are unavailable, who needs access and whether the room should be considered sensitive or critical.

From there, the project can decide whether standard card access is adequate or whether controls such as:

2FA, intrusion detection or more extensive CCTV

are justified.

What about landlord-managed critical infrastructure?

ABS specifically recognises that critical equipment rooms may form part of building infrastructure managed by the landlord and says such rooms should be included in the FI’s Risk Assessment where they support FI operations.

This is highly relevant to new-office selection.

The tenant may build excellent internal systems but still depend on:

building power, communications infrastructure, cooling or other shared services outside its direct control.

These dependencies should be understood during due diligence.

Should visitor management be designed during the fit-out?

Yes.

Reception design, visitor circulation and access control are closely connected.

The project should establish where visitors:

arrive, register, wait, enter controlled space and meet their host.

If the reception and visitor route are designed without security input, visitors may need to cross employee-only areas merely to reach meeting rooms.

Consultant’s perspective

Where practical, visitor meeting facilities can be positioned so that normal visitors do not need deep access into employee or restricted zones.

This is an architectural implementation of the ABS visitor-management and zoning principles, not an explicit ABS room-layout rule.

Should the project consider after-hours security?

Yes.

ABS specifically says off-operational-hours security controls should be considered when internal access control is designed.

An office may operate very differently at:

2:00 PM and 2:00 AM.

The fit-out should therefore consider how after-hours access, alarms, monitoring and response will operate.

For example, an entrance that is continuously staffed during business hours may rely on different controls after the guard or receptionist leaves.

Should intrusion detection be included from the beginning?

Where the Risk Assessment justifies it, yes.

Restricted or critical areas may require complementary intrusion detection or audible alarms.

Designing this during fit-out allows the project to coordinate:

door contacts, motion detectors, alarm cabling, power, panel locations and monitoring arrangements.

Adding the system afterwards can create avoidable surface cabling or integration problems.

Should the project plan how alarms will be monitored?

Yes.

Installing detection devices without deciding who will receive and respond to them leaves the security process incomplete.

The FI should determine whether monitoring will occur through:

an on-site control room, landlord security, an off-site in-house team or a third-party monitoring provider.

The architecture and communications requirements can then be designed accordingly.

Should security systems be designed for future changes?

Yes.

ABS notes elsewhere that security systems have finite life spans and should allow periodic updates to maintain operational readiness.

Consultant’s perspective

During a fit-out, this can influence matters such as:

network capacity, controller capacity, spare panel capacity, cable pathways, equipment-room space and the ability to add future cameras or doors.

ABS does not prescribe specific spare-capacity percentages, so those should be project design decisions rather than presented as ABS requirements.

What should happen if the design changes during construction?

Security impact should be reassessed.

ABS explicitly recognises that modification and renovation can create new vulnerabilities.

Consultant’s perspective

Security should therefore be included in the project’s change-control process.

Examples of architectural changes that may require security review include:

a relocated door, revised partition, new access route, moved reception, relocated critical room or altered ceiling layout affecting CCTV.

A small architectural change can sometimes create a large security-design consequence.

Should security drawings be coordinated with the architectural drawings?

Yes, as a practical project requirement.

The ABS guideline itself does not prescribe drawing standards, but implementation of its requirements depends heavily on coordinated design.

Consultant’s perspective

Security drawings should be checked against the latest:

architectural door schedule, floor plans, reflected ceiling plans, room names and M&E layouts.

This helps prevent common issues such as cameras mounted where ceilings change, card readers on the wrong side of doors or equipment locations that clash with architectural finishes.

When should the security contractor be appointed?

ABS does not prescribe a procurement timeline.

Consultant’s perspective

However, security design should be substantially resolved early enough for the fit-out to accommodate:

containment, cabling, power, network points, door interfaces, fire interfaces and equipment locations.

If the security contractor or consultant becomes involved too late, the project may rely on visible retrofits or compromises that could have been avoided.

Should the FI simply accept the landlord’s standard security specification?

Not automatically.

ABS repeatedly says landlord-managed security infrastructure should be assessed as part of the FI’s wider security programme.

The landlord may provide:

base-building CCTV, turnstiles, lift control and security officers.

But the FI should establish whether those controls meet its own risk needs.

Consultant’s perspective

A useful approach is to separate:

What the building provides

from

What the FI still needs to provide.

That avoids both unnecessary duplication and dangerous assumptions.

What should be tested before the office is occupied?

The ABS maintenance guidance supports operational testing rather than assuming that installed systems work correctly.

For a new office, this principle can be applied through structured commissioning.

A security handover should confirm that:

CCTV produces the intended views and recordings, access-controlled doors enforce the expected permissions, alarms reach the correct monitoring destination, duress or other relevant alarms work where installed, and security-system interaction with operational procedures is understood.

This is a consultant’s commissioning framework rather than an ABS-prescribed handover checklist.

Should CCTV field of view be signed off before handover?

This is good practice and aligns closely with ABS’s later maintenance guidance requiring confirmation of approved camera fields of view.

Consultant’s perspective

A useful handover can record an approved reference image for each important camera.

Future maintenance reviews can then compare the live or recorded view with the approved design.

That makes it easier to identify whether renovation, furniture or accidental camera movement has degraded coverage.

Should an access-control door be tested as a complete door?

Yes, from a practical security perspective.

The project should not finish testing after confirming that the reader flashes green.

The security objective depends on the complete door assembly and operating logic.

Consultant’s perspective

Commissioning should consider:

authorised access, denied access, locking, door closure, door state, alarms where configured and emergency behaviour where applicable.

The exact test requirements should follow the project design and relevant technical or life-safety requirements.

Should the FI conduct another review after the office is occupied?

Potentially, yes.

Even a well-designed system may operate differently once real employees, visitors, deliveries and business processes begin using the space.

Consultant’s perspective

An early post-occupancy security review can identify practical issues such as:

tailgating at particular doors, visitor bottlenecks, unexpected after-hours access, camera obstruction or access groups that do not match actual operations.

ABS does not prescribe a specific post-occupancy review interval, so this should be treated as implementation good practice rather than a formal ABS requirement.

A practical security workflow for a new FI office

A useful way to structure the project is shown below.

This is a consultant’s project-delivery framework based on the ABS principles; ABS does not present the process in this exact table.

Common mistakes during financial institution fit-outs

A common mistake is bringing physical security into the project only after the architectural layout is already frozen. That can make security unnecessarily expensive or force compromised solutions.

Another is designing the tenant office without reviewing the building’s security arrangements. ABS specifically tells tenanted FIs to engage building management and understand the building’s Security and Safety Design.

Another is specifying technology before completing the Risk Assessment. That encourages the project to ask how many cameras and readers it needs instead of first establishing the required security outcomes.

It is also easy to protect the door but overlook the surrounding physical boundary. ABS explicitly treats walls and partitions as part of the protective system.

Finally, construction changes can undermine approved security designs. ABS recognises major modification, renovation and alteration as potential sources of new vulnerabilities.

Practical New Office and Renovation Security Checklist

Before handover, an FI should be able to answer:

1. Was physical security considered during pre-lease assessment, and has the building’s security and safety design been reviewed with landlord or building management?
2. Has an appropriate Physical Security Risk Assessment been carried out or reviewed for the new premises or major renovation?
3. Have critical assets and restricted areas been identified before finalising the layout?
4. Are public, visitor, employee and restricted areas logically zoned?
5. Are the number and location of entrances appropriate, with the required controls at each security boundary?
6. Have walls, partitions, doors and frames been assessed together rather than relying only on electronic access control?
7. Are CCTV locations based on defined security objectives, with appropriate views of entrances, access points, restricted areas and critical rooms?
8. Are access-control permissions role-based and proportionate to the sensitivity of each space?
9. Are stronger controls such as 2FA, intrusion detection or specially protected entrances used only where the risk justifies them?
10. Have critical technology or equipment rooms been appropriately located and protected?
11. Are landlord-controlled critical systems and security measures understood as dependencies?
12. Are reception and visitor routes designed so visitors do not gain unnecessary access to employee or restricted areas?
13. Have after-hours access, alarm monitoring and response been defined?
14. Are architectural, security, IT, fire/life-safety and M&E designs coordinated?
15. Are security-impacting construction changes formally reviewed?
16. Have CCTV, access control and alarm systems been functionally tested before occupation?
17. Have system responsibilities between the FI and landlord been clearly documented?
18. Are drawings, device schedules, configurations and operating procedures updated to reflect the final installed condition?
19. Have relevant employees and security personnel been trained on the new systems and procedures?
20. Is there an ongoing maintenance, testing and periodic security-review programme after occupancy?

Conclusion

The ABS Physical Security Guidelines strongly supports addressing physical security early in the property and fit-out process.

ABS says relevant threats should be considered during pre-lease assessment for new sites, while major modification, renovation and alteration are circumstances in which an FI should consider conducting or revisiting its Risk Assessment.

For tenanted offices, the FI should also understand the building’s existing Security and Safety Design and coordinate with building management before deciding what tenant-level controls are required.

The resulting design can then address the complete security environment:

architecture, security zoning, entry points, walls and partitions, CCTV, access control, critical rooms, alarms, monitoring, people and procedures.

The key principle is:

Do not design the office first and add security afterwards. Define the risks and security zones early enough for physical security to become part of the architecture and operating model.