Physical Security System Maintenance and Testing for Financial Institutions under the ABS Guidelines

Installing a physical security system is not the end of the security process.

Cameras can move out of position. Recording capacity can change. Doors can stop locking correctly. Alarm devices can fail. Access privileges can become outdated. Physical barriers can deteriorate. Renovations can unintentionally create new blind spots or security gaps.

The ABS Physical Security Guidelines for Financial Institutions 2.0 (Revised 2025) therefore gives specific attention to Preventive Maintenance and Servicing.

ABS states that preventive checks and service maintenance of security equipment and systems should be carried out regularly so their performance is maintained at an optimum level.

The underlying principle is:

A security control only provides protection if it still works as intended when it is actually needed.

Does ABS require security systems to be maintained?

Yes.

Section 2.3.4 of the guideline specifically states that preventive checks and service maintenance should be conducted regularly on security equipment and systems.

This applies broadly to the FI’s security technology rather than only one system.

The wider guideline discusses systems such as:

CCTV, electronic access control and intrusion-detection/alarm systems.

The objective is not simply to keep the equipment powered on.

It is to maintain the performance of the security system.

What is preventive maintenance?

ABS uses the term Preventive Maintenance and Servicing and states that preventive checks should be conducted regularly.

Preventive maintenance is work carried out before a known failure has occurred.

Consultant’s perspective

For a physical security system, this could include checking:

camera condition, storage health, door hardware, readers, alarm devices, power supplies and communication links.

The detailed maintenance tasks should follow the equipment, system design and maintenance programme. ABS does not prescribe a universal technical maintenance checklist for every product.

What is corrective maintenance?

The main preventive-maintenance section focuses on regular servicing, while the retail-branch appendix specifically distinguishes between:

routine preventive maintenance

and

corrective maintenance where issues are detected.

Corrective maintenance therefore deals with defects already identified.

For example, if a camera no longer records correctly or an alarm device fails testing, the fault should be rectified rather than merely recorded for the next routine service.

How often must security systems be maintained?

ABS says preventive checks should be conducted regularly, but it does not establish one universal maintenance interval such as monthly, quarterly or annually in the general maintenance section.

The appropriate frequency should therefore reflect:

the equipment, manufacturer’s recommendations, system criticality, operating environment, FI maintenance standards and risk.

This is an important distinction.

A statement such as:

“ABS requires quarterly maintenance for all security systems”

would not be supported by this guideline.

Is checking that a system is “online” enough?

No.

The ABS material goes considerably further than basic system availability.

Its Building Management Engagement Guide asks whether there is a regular maintenance regime ensuring CCTV, access control and intrusion detection remain operational.

For CCTV, it specifically refers to checking:

image quality, recording and whether the approved field of view has changed.

So a camera showing a green “online” icon does not necessarily mean it is providing the intended security outcome.

What should be checked on a CCTV system?

Appendix 2 gives particularly practical guidance for retail branches.

It calls for periodic CCTV playback checks to confirm:

image quality, retention period and approved field of view.

These three checks answer different questions.

Image quality asks whether the recorded image is actually usable.

Retention asks whether recordings remain available for the organisation’s required period.

Field of view asks whether the camera is still looking at the intended area.

All three matter.

Why should CCTV playback be checked instead of only viewing live video?

Because live video does not confirm that usable recording exists.

A camera can display correctly in real time while there is a problem with:

recording, storage, retention or playback.

Appendix 2 specifically refers to playback of CCTV as part of its periodic operational checks.

Consultant’s perspective

A meaningful check should therefore retrieve historical video, not merely confirm that the live camera image appears on a monitor.

That is especially important because CCTV frequently becomes valuable after an incident.

Does ABS require a particular CCTV retention period?

No universal number is stated.

ABS’s Building Management Engagement Guide instead asks whether the organisation has established a minimum period of CCTV retention and whether periodic checks are performed to validate it.

Appendix 2 similarly calls for playback checks confirming the retention period.

Therefore, the ABS position is more accurately understood as:

The organisation should establish its required retention period and periodically verify that the CCTV system is actually achieving it.

It would be incorrect to say that this guideline itself universally mandates 30 days, 60 days or 90 days.

Why can actual CCTV retention change?

The guideline does not provide a storage-engineering explanation, but this is an important practical issue.

Consultant’s perspective

Actual retention can change because of factors such as:

additional cameras, different resolution or bitrate, frame-rate changes, recording-mode changes or reduced usable storage.

A system originally designed for a particular retention period may therefore provide less retention after later modifications.

This is why retention should be verified, not assumed.

Should CCTV field of view be checked periodically?

Yes.

Both Appendix 2 and the Building Management Engagement Guide specifically refer to checking the intended or approved camera field of view.

This can reveal a camera that is technically operating but no longer covers the intended security area.

Consultant’s perspective

FOV problems may arise from:

camera movement, new partitions, furniture, signage, doors, plant growth, displays, equipment or renovation works.

A maintenance programme should therefore verify the security purpose of the image, not simply camera connectivity.

Should camera image quality be checked?

Yes.

ABS explicitly refers to verification of image quality during CCTV operational checks.

The wider CCTV section also notes that factors such as lighting, camera angle and environmental conditions can affect useful image feedback.

Consultant’s perspective

A camera may produce a technically visible image while still failing its intended surveillance objective.

For example, an entrance camera may show a person entering but provide insufficient useful facial detail because of:

backlighting, angle or obstruction.

The maintenance check should therefore relate the image back to the original surveillance objective.

Does ABS require access-control systems to be tested?

Yes.

Appendix 2 specifically includes verification of the door access system among its periodic operational checks.

That means maintenance should go beyond checking that the access-control server and controller are online.

Consultant’s perspective

A complete functional test might confirm whether:

the reader reads the credential correctly, access permissions are enforced, the lock operates, the door closes and secures properly, and the expected event is recorded.

This is an implementation method rather than a prescribed ABS test sequence.

Should the physical door itself be inspected?

Yes, where relevant.

Appendix 2 distinguishes Structural and Physical Measures from technology systems and recommends periodic inspection of physical measures such as:

burglary-resistant doors, day gates and vault rooms.

That is an important distinction.

A perfectly functioning card reader provides limited protection if the:

door, frame, locking hardware or surrounding physical barrier

is damaged or easily bypassed.

What should be tested on an access-controlled door?

ABS does not provide a complete door commissioning checklist in its maintenance section.

Consultant’s perspective

A useful operational inspection can look at the whole secured opening rather than only the electronic reader.

That includes the door, frame, locking device, door closer, reader, request-to-exit device where applicable, door contact and any alarm or monitoring function.

Where the door participates in fire or emergency-egress arrangements, those functions should be managed and tested according to the applicable requirements rather than inferred solely from the ABS guideline.

Does ABS require duress buttons to be tested?

Yes, in the retail-branch appendix.

ABS specifically identifies testing of duress buttons and alarm systems as part of periodic operational security-system checks.

This is especially important because a duress device may rarely be used during normal operations.

A device that has not been activated for a long period should not simply be assumed to work during an actual emergency.

What should a duress-button test verify?

ABS specifies testing but does not provide an exact end-to-end test script.

Consultant’s perspective

A meaningful test should verify the full chain:

Button activation → Alarm transmission → Monitoring receipt → Correct alarm identification → Escalation / response

This distinction is important.

Testing only whether an input changes state at the local panel does not prove the emergency response process will work.

Should intrusion alarms be tested?

Yes.

Appendix 2 refers to testing the alarm system, and the general preventive-maintenance section applies to security equipment and systems more broadly.

Consultant’s perspective

Testing should reflect the intended alarm function.

A door contact should correctly detect the relevant door event.

A motion detector should detect movement where designed.

The event should reach the appropriate monitoring location.

The correct location and alarm description should be displayed.

The appropriate response path should then be validated where safe to do so.

Is maintenance the same as effectiveness testing?

No.

ABS distinguishes normal maintenance from periodic testing intended to validate the effectiveness of the security measures in place.

This is an important difference.

Maintenance asks:

Is the equipment functioning correctly?

Effectiveness testing asks:

Does the complete security measure actually achieve what it was designed to achieve?

For example, a camera may technically work but fail to provide useful identification.

An access-controlled door may accept and reject credentials correctly but still be easily bypassed through a weak adjacent partition.

An intrusion alarm may detect movement but fail to reach the monitoring centre.

Does ABS say effectiveness testing must not disrupt banking operations?

Yes.

Appendix 2 says periodic effectiveness testing should be carried out in a controlled setting and should not cause disruption to banking operations.

That means security testing itself must be planned responsibly.

Consultant’s perspective

Tests involving:

duress alarms, monitoring centres, lockdown logic or emergency notifications

should be coordinated so responders understand that the activity is a controlled test and no unnecessary emergency response is triggered.

Does ABS recommend security audits?

Yes, in Appendix 2.

The retail-branch maintenance guidance specifically recommends periodic security audits to review security measures and operations.

An audit is broader than equipment servicing.

It can assess whether the overall security arrangement still matches the branch’s:

layout, operations, risks and procedures.

Is a maintenance visit the same as a security audit?

No.

A maintenance technician may focus on whether the installed equipment operates correctly.

A security audit examines whether the security arrangement itself remains appropriate and effective.

Consultant’s perspective

For example:

A maintenance engineer may confirm that all ten cameras are functioning.

A security audit may discover that renovation has created a new entrance that none of those ten cameras adequately covers.

Both activities are useful, but they answer different questions.

When should security be reviewed after renovation?

The retail-branch appendix says additional security reviews may be arranged when there are changes to the layout or function of the branch.

The main Physical Security Risk Assessment section goes further and says FIs should consider conducting an RA following major modification, renovation or alteration, as well as periodically.

This is important well beyond retail branches.

A fit-out change can alter:

security zones, CCTV views, door-access arrangements, escape routes, visitor flow or the location of critical assets.

Does moving furniture require another full Physical Security Risk Assessment?

ABS does not say every minor furniture movement requires a new RA.

The main guideline refers to major modification, renovation or alteration, while Appendix 2 recommends additional security reviews when layout or function changes.

The scale of review should therefore be proportionate.

Consultant’s perspective

A small furniture change might simply require an FOV check.

A major office reconfiguration could justify a wider security review.

A relocation or major redevelopment may justify a new Physical Security Risk Assessment.

Should security systems be designed to allow future updates?

Yes.

ABS notes that security systems have relatively moderate life spans and advises designing systems so periodic changes and updates can be made to maintain operational readiness.

This means system maintainability should be considered during initial design.

A security platform that works on Day 1 but cannot be practically expanded, upgraded or supported later can become an operational risk.

Does ABS address cybersecurity of physical security systems?

Yes, at a high level.

ABS says financial institutions should apply appropriate hardening measures when designing security systems so they are protected against cyber attacks.

The guideline does not provide detailed cybersecurity configuration requirements in this section.

Those details require the FI’s applicable technology-security standards and other relevant guidance.

However, the important point is that electronic physical-security systems should not be treated as purely physical devices with no cyber exposure.

Does maintenance include user accounts and permissions?

Yes.

The preventive-maintenance section says there should be plans ensuring designated persons use the appropriate systems with controls such as user profiles and user rights.

This means maintenance and governance should also consider who can access the security system itself.

Consultant’s perspective

For systems such as CCTV and access control, periodic reviews may therefore consider:

administrator accounts, operator permissions, inactive users and vendor access.

The detailed review frequency and account-management workflow are not prescribed by ABS.

What happens to security data when equipment is replaced or fails?

ABS specifically addresses this.

The maintenance plan should include procedures for the removal and destruction of data, including examples such as CCTV recordings stored on faulty recorder hard disks removed by vendors. Applicable personal-data-protection guidance should also be followed.

This is a particularly important operational point.

A failed hard disk is not merely faulty equipment.

It may still contain security recordings.

Can a maintenance vendor simply take away a failed CCTV hard disk?

The ABS guideline highlights precisely this type of scenario.

It says procedures should address removal and destruction of data, including faulty recorder hard disks handled by vendors, and should comply with applicable personal-data-protection guidance.

Consultant’s perspective

The FI should therefore establish a clear process before equipment containing recordings or other security data leaves the premises.

That process could involve controlled destruction, data sanitisation or another approved handling method according to the FI’s requirements.

ABS does not prescribe the specific destruction technology.

What if the security systems are maintained by the landlord?

ABS explicitly addresses this.

For systems managed and maintained by building management, the FI should assess them as part of the infrastructure supporting its security programme within the risk assessment.

This is consistent with the guideline’s treatment of landlord-managed:

CCTV, access control, intrusion detection, visitor management and other building controls.

The FI should not assume that because the landlord owns the system, its maintenance is irrelevant to the tenant’s security risk.

What should an FI ask its landlord about security maintenance?

A tenant should understand whether building-managed CCTV, access control and intrusion systems are maintained regularly and whether they remain operational.

ABS’s Building Management Engagement Guide specifically asks whether there is a regular maintenance regime and whether critical security-monitoring equipment remains available during utility interruptions such as loss of power or communications.

Consultant’s perspective

Useful evidence may include:

maintenance arrangements, fault escalation, system availability, recent test results and contingency arrangements.

The FI does not necessarily need to maintain the landlord’s equipment itself, but it should understand the reliability of the security controls it depends on.

Should security systems continue working during power failures?

The Building Management Engagement Guide asks whether essential equipment used for security monitoring remains available during power and communications interruptions.

This is framed as a due-diligence question rather than one universal technical backup-duration specification.

Consultant’s perspective

A resilience review should identify what happens to:

CCTV recording, access control, alarms, monitoring communications and other critical security equipment

when normal utilities fail.

The specific backup design and duration must come from the system and project requirements, not be invented from this ABS checklist.

Should maintenance cover security-system communication failures?

It should be considered where system functionality depends on communications.

The ABS checklist expressly asks about continued security-monitoring capability during communication interruptions.

The intrusion-alarm section elsewhere also calls for communication redundancy in high-risk areas.

This means maintenance should consider not only field devices but also the communications path that allows security events to reach the monitoring function.

Does ABS prescribe a maintenance log?

The guideline does not prescribe one standard maintenance-log format.

Consultant’s perspective

A useful maintenance record can capture:

This is a consultant’s documentation example, not an ABS-required form.

Should faults be risk-prioritised?

ABS does not provide a maintenance-specific fault-priority matrix.

However, its wider risk-treatment framework prioritises higher-severity risks.

Consultant’s perspective

A failure affecting a camera in a low-risk general corridor may not require the same response as failure of:

a vault alarm, main entrance access controller, critical-room camera or monitoring communications link.

Maintenance escalation can therefore reasonably reflect the security importance of the failed control.

Should temporary security measures be introduced while equipment is faulty?

ABS does not prescribe a temporary-compensating-control procedure in the maintenance section.

However, its wider layered and risk-based approach supports consideration of residual risk while a control is unavailable.

Consultant’s perspective

Depending on the fault, temporary measures could include:

additional patrols, temporary monitoring, alternative access procedures or other proportionate controls.

Those are examples, not requirements stated by ABS.

Should repaired systems be retested before the fault is closed?

ABS does not explicitly describe a fault-closeout process.

Consultant’s perspective

A repair should ideally end with confirmation that the intended security function has been restored.

For example, after replacing an alarm sensor, the closeout should confirm not only that the new device powers up, but that its alarm reaches the intended monitoring and escalation path.

This converts corrective maintenance into verified restoration of the control.

What is the difference between inspection, maintenance, operational testing and security review?

These terms are related but serve different purposes.

This table is a consultant framework derived from the different maintenance and review activities discussed in ABS. It is not a classification table contained in the guideline.

Common mistakes in security maintenance

A common mistake is checking only whether equipment is powered on. ABS explicitly points towards checking actual CCTV image quality, recording and field of view.

Another is assuming the originally designed CCTV retention period still exists years later. ABS specifically asks for periodic retention validation.

Another is testing only the local device rather than the complete operating chain. A duress button that activates locally but never reaches the monitoring centre is not an effective security control.

Physical measures are also sometimes overlooked. Appendix 2 specifically includes periodic checks of burglary-resistant doors, day gates and vault rooms.

A further mistake is ignoring renovation. ABS recognises major renovation or alteration as a reason to reconsider the Physical Security Risk Assessment, while the branch appendix calls for additional reviews following layout or functional changes.

Finally, security data should not be forgotten when failed equipment is removed. ABS specifically calls for procedures covering the removal or destruction of CCTV data on equipment such as faulty recorder hard disks.

A practical physical security maintenance programme

A financial institution can structure its programme around five complementary activities.

First, establish an inventory of the security controls being relied upon and identify the security purpose of each critical system.

Second, schedule preventive maintenance according to the equipment and its criticality.

Third, conduct operational tests that confirm the actual security function, including recorded CCTV playback, access-control operation, alarm transmission and response where applicable.

Fourth, track faults through corrective maintenance until the intended protection is demonstrably restored.

Finally, conduct periodic security reviews to confirm that changes in premises, operations, threats or layout have not made the original security design obsolete.

This follows the functional intent of the ABS guidance while leaving the detailed maintenance intervals and technical procedures to the FI’s specific systems and requirements.

Practical Physical Security Maintenance Checklist

A financial institution should be able to answer:

1. Is there a regular preventive-maintenance programme for CCTV, access control, intrusion detection and other security systems?
2. Is the maintenance frequency appropriate to the system and its criticality?
3. Are faults recorded, assigned and closed after corrective maintenance?
4. Are CCTV cameras checked through recorded playback rather than live view alone?
5. Is recorded image quality still suitable for the intended surveillance purpose?
6. Is the required CCTV retention period periodically validated?
7. Is the approved camera field of view still correct and unobstructed?
8. Are access-controlled doors functionally tested?
9. Are duress and intrusion alarms periodically tested?
10. Does alarm testing verify the event reaches the intended monitoring and response process?
11. Are physical protections such as secure doors, gates and vault structures periodically inspected?
12. Are security systems periodically tested for effectiveness rather than only technical operation?
13. Are tests carried out in controlled conditions without unnecessary disruption?
14. Are system user profiles and rights properly controlled?
15. Are procedures defined for security data stored on faulty or retired hardware?
16. Are landlord-managed systems included in the FI’s security assessment?
17. Does the FI understand how security systems perform during power or communications interruptions?
18. Are security systems capable of being updated as technology and requirements change?
19. Are appropriate cyber-hardening considerations included for electronic security systems?
20. Does renovation, major alteration or change in premises function trigger an appropriate security review or RA?

Conclusion

The ABS Physical Security Guidelines makes clear that maintaining physical security is an ongoing process.

At a general level, ABS says preventive checks and service maintenance should be carried out regularly to keep security equipment and systems performing at an optimum level.

It also recognises that security systems have finite life cycles and should be capable of periodic updates to maintain operational readiness.

The retail-branch appendix adds particularly practical examples, including:

CCTV playback to verify image quality, retention and field of view; door-access verification; duress and alarm testing; preventive and corrective maintenance; physical inspections; security audits; and controlled effectiveness testing.

The central principle is:

Do not assume a security control still works simply because it was installed and commissioned successfully years ago. Verify periodically that it still delivers the security outcome it was designed to provide.