What Should a Financial Institution Ask Its Landlord About Physical Security?

Financial institutions operating from leased offices are often dependent on security controls they do not directly own.

These may include:

• building perimeter security;
• lobby access;
• vehicle access;
• loading bays;
• CCTV;
• lifts;
• security officers;
• security control rooms;
• emergency communications;
• lockdown procedures; and
• evacuation arrangements.

Because of this, the ABS Physical Security Guidelines for Financial Institutions 2.0 (Revised 2025) includes a dedicated Building Management Engagement Guide/Checklist.

ABS explains that the checklist is intended to help financial institutions understand and assess the level of physical security preparedness implemented by the building owner or management. It also makes clear that the checklist is not intended to replace a security risk assessment.

For a financial institution, this means physical security should not stop at the office entrance.

The security of the wider building can directly affect the security of the tenant.

Why should a financial institution assess the landlord’s security?

ABS states that financial institutions in tenanted premises should engage the building owner or management to understand the building’s security and safety design when planning their own security requirements.

This is important because many of the first layers of protection may sit outside the tenant’s direct control.

For example, an FI may install strong access control at its office entrance, but still depend on the landlord for:

• detection of suspicious persons entering the building;
• control of vehicles entering the basement;
• building-level CCTV;
• lift access;
• emergency announcements;
• security personnel;
• lockdown;
• evacuation; and
• communication with authorities.

A landlord security review therefore forms part of the FI’s wider risk picture.

Is the ABS Building Management Checklist a substitute for a security risk assessment?

No.

ABS explicitly states that the Building Management Engagement Guide is not intended to be a security risk assessment or to replace any proprietary assessment used by the financial institution.

The checklist should therefore be used to gather information and identify dependencies.

The FI should then assess what those findings mean for its own risks.

1. Is the building classified as Critical Infrastructure or a High Profile Development?

The ABS checklist begins by asking whether the building is classified as a Critical Infrastructure or High Profile Development under the Infrastructure Protection Act framework.

This is an important early question because the answer may affect:

• applicable security requirements;
• the type of risk assessments undertaken;
• specialist consultant requirements; and
• the building’s overall security programme.

Consultant’s perspective

This is one of the first questions to establish during a pre-lease or project security review because it can change the regulatory and technical context of the premises.

2. Does the building have a designated security manager?

ABS asks whether building management engages a designated security manager to manage the security of the building and applicable risk assessments.

For the tenant, this helps establish:

• who is accountable for building security;
• who should receive security-related queries;
• who owns the building’s risk assessments; and
• who coordinates during security incidents.

A building may have many facilities contacts, but the FI should know who specifically owns security.

3. Does the building periodically conduct security risk assessments?

The ABS checklist asks whether the building has a programme to periodically conduct:

• Threat, Vulnerability and Risk Assessments; or
• Physical Security Risk Assessments.

This gives the tenant some indication of whether building security is being actively reviewed or simply maintained as originally designed.

Useful follow-up questions

A financial institution may also wish to understand:

• when the last assessment was carried out;
• whether major building changes trigger reassessment;
• whether material findings relevant to tenants are communicated; and
• whether the building has an ongoing risk register.

These are sensible follow-ups, but are not individually prescribed by the ABS checklist.

4. How is the building perimeter protected?

ABS asks whether the building perimeter has adequate measures to detect or monitor intrusions at access points, including CCTV or intrusion detection.

For an FI, this matters because the building perimeter may be the first security layer protecting the tenancy.

Questions to ask

• Where are the building perimeter entry points?
• Are they monitored?
• Is CCTV used?
• Is intrusion detection used?
• Who responds to perimeter alarms?
• Are blind areas known?

The precise controls should reflect the building’s risk assessment.

5. Is perimeter lighting adequate?

ABS asks whether the building has assessed perimeter lighting as sufficient to deter and detect intrusion.

Lighting is important not only for physical visibility but also for effective CCTV performance.

A poorly illuminated area may technically have camera coverage while still providing poor usable images.

6. Are external glass façades and windows protected?

The checklist asks whether perimeter glass façades and windows have been assessed for protection against physical attack.

This is particularly relevant where:

• public roads;
• drop-off points;
• walkways; or
• publicly accessible areas

are close to the building façade.

The required protection level should come from the building’s risk assessment and applicable guidance.

7. Can exterior doors resist forced entry and support lockdown?

ABS asks whether exterior doors are protected against forced entry and are capable of being locked down during exigency.

This is a particularly important question for financial institutions because the building may need to shift rapidly from normal operating conditions to a more restrictive security state.

Consultant’s perspective

The tenant should understand:

• who has authority to initiate lockdown;
• which doors are affected;
• whether tenants are informed before or during activation;
• how life safety is maintained; and
• how normal access is restored afterwards.

8. Does the building have vehicle-ramming protection?

The ABS checklist asks whether measures exist to protect pedestrian drop-off lobbies and driveways from vehicle ramming, giving bollards as an example.

This does not mean all buildings require identical vehicle barriers.

The need for and design of such measures should follow the assessed threat and relevant technical requirements.

9. How secure are the car park and loading bay?

ABS specifically covers car parks and loading bays.

The checklist asks whether these areas have:

• sufficient lighting;
• adequate measures to detect suspicious or unauthorised persons and vehicles; and
• enhanced screening procedures during heightened security, including for potential VBIED threats.

These areas are important because they may provide routes into the building that bypass the main lobby.

10. How secure are pedestrian entrances and exits?

ABS asks whether pedestrian entrances and lobbies have sufficient lighting for surveillance and safety.

It also asks whether there are adequate measures to detect unauthorised or suspicious persons at pedestrian entrances and exits.

Questions for the landlord

A tenant may want to understand:

• whether access cards are required;
• whether turnstiles are used;
• whether guards supervise entrances;
• whether visitors are screened;
• whether tailgating is monitored;
• and what happens when suspicious behaviour is observed.

11. Can the building increase screening during heightened security?

Yes.

The ABS checklist asks whether enhanced procedures exist to provide additional screening for threats such as weapons or PBIEDs at entry points during heightened security conditions.

This is useful for FIs because a tenant may not control the building lobby but may depend on the landlord to increase security when the threat level rises.

12. Is building CCTV actively monitored?

ABS asks directly:

Are the CCTVs monitored by the security personnel?

For a tenant, this is an important distinction.

A building can have extensive camera coverage but still operate primarily as a recording system.

The FI should understand whether the landlord provides:

• active monitoring;
• event-based monitoring;
• retrospective recording only; or
• some combination.

13. Can the control room communicate with field officers?

ABS asks whether security personnel in the Security Control Room can communicate with field security officers and building-management staff.

This is central to effective response.

Detection without a communication and response channel has limited value.

14. What is the building’s CCTV retention period?

The checklist asks whether the organisation has stipulated a minimum CCTV video-retention period and whether periodic validation checks are carried out.

It does not give one universal retention number.

For a tenant relying on landlord CCTV, useful questions include:

• What is the retention period?
• Is it consistently achieved?
• How is footage requested after an incident?
• Who authorises release?
• How quickly can footage be retrieved?

15. Are security systems regularly maintained?

ABS asks whether the building has a regular maintenance regime to ensure that systems such as:

• CCTV;
• access control; and
• intrusion detection

remain operational.

It specifically gives examples such as checking:

• CCTV image quality;
• recording; and
• whether the approved field of view has changed.

This is more meaningful than simply asking whether the maintenance contract is current.

16. Will critical security systems still work during a power or communications failure?

ABS asks whether essential security equipment remains available during utility interruptions such as power or communications failures.

Examples include:

• electronic control systems;
• CCTV recorders;
• network switches; and
• PA systems.

Consultant’s perspective

For a financial institution relying heavily on landlord infrastructure, this is a key resilience question.

The FI should understand which security systems remain operational and for how long when normal utilities fail.

17. Is the building using licensed security personnel?

The ABS checklist asks whether the building’s security personnel are from a PLRD-licensed security agency.

Where the tenant relies on building guards as part of its security response, this is an important due-diligence point.

Current licensing details should still be verified through the relevant authority where needed.

18. Are building security officers adequately trained?

ABS asks whether the security personnel’s training programme equips them with the skills required to perform their duties and respond to applicable threats.

The question is therefore not just:

“Are there guards?”

but:

“Are the guards capable of performing the required security functions?”

19. Are security officers tested through exercises and drills?

The checklist asks whether there is a programme in which security personnel are regularly tested for competency in managing security incidents through exercises or drills.

This is an important distinction between theoretical training and demonstrated operational capability.

20. Are additional officers deployed during heightened security?

ABS asks whether additional security personnel are deployed at building ingress and egress points during heightened conditions to carry out enhanced procedures such as screening.

A tenant should understand whether the building has the ability to scale its security posture when threat conditions change.

21. How does building management communicate security changes to tenants?

The checklist asks how building management communicates current or new security measures and procedures to tenants.

This may sound administrative, but it is operationally important.

If new screening, access restrictions or threat-response measures are introduced, tenants need a reliable way to receive and distribute that information.

22. How does the building communicate with SPF and neighbouring buildings?

ABS asks how building management communicates with relevant government agencies such as the Singapore Police Force and shares relevant information with neighbouring buildings during a security incident.

This is particularly relevant during incidents that affect more than one building or public area.

23. How does the building communicate with tenants during an incident?

The checklist asks how building management communicates with tenants during a security incident.

The FI should know the actual communication method.

For example:

• PA announcement;
• SMS;
• email;
• tenant messaging platform;
• security hotline;
• building app;
• or direct contact with nominated representatives.

Those are examples of possible channels, not a list prescribed by ABS.

24. How are tenants informed when the security threat level increases?

ABS asks how building management communicates an increase in security threat level or an imminent security threat to tenants.

This should ideally be established before an incident occurs.

25. How does the building notify tenants to evacuate or lockdown?

The checklist asks how tenants are notified to evacuate or lockdown during a security incident.

For an FI, this needs to align with its own:

• employee communication;
• visitor management;
• access-control procedures; and
• staff-accounting process.

26. How will tenants know when the situation has returned to normal?

ABS also asks what communication protocol is used when the building’s security status returns to normal.

This is frequently overlooked.

Incident procedures should not stop at activation.

There also needs to be a controlled return to normal operations.

27. Does the building train tenants on security incidents?

ABS asks whether there are programmes or briefings to educate tenants in detecting, reporting and responding to security incidents.

Consultant’s perspective

A good tenant security programme should participate in relevant building exercises rather than developing completely separate procedures with no coordination.

28. Can the building manage a mass-casualty incident?

ABS asks whether building SOPs address mass-casualty incidents, including:

• resource management;
• continuation of building security;
• management of tenants; and
• liaison with authorities.

This is particularly relevant for large commercial buildings with high occupant densities.

29. Does the building have both evacuation and invacuation procedures?

ABS asks whether building management has established both:

• evacuation; and
• invacuation, or shelter-in-place

procedures for tenants during security incidents.

This is important because evacuation is not always the safest response.

Depending on where the threat is located, moving people outside could place them closer to danger.

30. Do evacuation routes take the location of the threat into account?

ABS asks whether evacuation and invacuation routes are designed to direct tenants away from suspicious packages, objects or vehicles.

This means emergency routes cannot always be treated as static.

Security incidents may require alternative routing.

31. Does the building have minimum evacuation distances?

ABS asks whether building management has established minimum evacuation distances for different sizes of suspicious packages, objects or vehicles.

The ABS checklist does not itself provide those distances.

The FI should rely on the building’s approved procedures and applicable authority guidance.

32. Are there alternative assembly areas?

ABS asks whether alternate assembly areas, including virtual assembly areas, are available if the primary assembly area is exposed to the same threat.

This is particularly useful where a fixed external assembly point might place evacuees near the security incident.

33. Can the building shelter occupants instead of evacuating them?

ABS asks whether procedures exist to secure the building where a bomb, PBIED, VBIED or biological threat is nearby and evacuation is not considered appropriate.

Again, the appropriate action depends on the circumstances and authorised emergency procedure.

34. What happens if an unauthorised person enters the building?

ABS asks what actions building security personnel take when a tenant reports an unauthorised-entry incident.

It also asks whether the building verifies that only authorised persons enter controlled areas beyond public spaces.

These are fundamental access-control questions for a tenant relying on the landlord’s first security layer.

35. Are visitors registered and screened?

ABS asks whether visitors are registered and screened before being permitted beyond public spaces.

This should be coordinated with the FI’s own visitor-management requirements.

A visitor could potentially pass through two stages:

building registration → tenant registration/access

depending on the site design.

36. Can the building reduce entry and exit points during heightened security?

Yes.

The checklist asks whether procedures exist to limit ingress and egress points and carry out security screening during heightened security.

The FI should understand how this would affect employees, visitors and deliveries.

37. Does the building have suspicious-vehicle procedures?

ABS asks several questions relating to a potential Vehicle-Borne Improvised Explosive Device.

These include whether:

• security personnel know what to do when a suspicious vehicle is reported;
• they are trained to identify suspicious vehicles;
• the area can be cordoned off;
• tenants and visitors can be informed;
• systematic evacuation is available if necessary; and
• minimum evacuation distances are established.

38. Does the building have PBIED procedures?

ABS asks whether security personnel are trained to assess and identify suspicious persons potentially carrying a PBIED.

It also asks about:

• cordoning the area;
• communication with tenants and visitors; and
• evacuation routes leading away from the threat.

39. Does the building have a bomb-threat procedure?

ABS asks whether building management has:

• a bomb-threat checklist;
• an escalation procedure;
• emergency contact details;
• procedures for cordoning suspicious packages; and
• systematic evacuation procedures if the threat is assessed as credible.

This information should be understood by key tenant personnel such as security, facilities and reception teams.

40. What happens if a suspicious package or article is found?

The checklist asks what action building security personnel take when a suspicious article is reported.

It also asks whether SOPs include:

• assessment and escalation;
• cordoning and isolation; and
• appropriate procedures where biological contamination is suspected.

41. Does the building have armed-attack and lockdown procedures?

ABS asks what actions building security personnel take when an armed attack occurs either:

• within the building; or
• in the surrounding vicinity.

It also asks whether lockdown procedures include measures such as:

• homing elevators to the first floor; and
• securing building perimeter doors.

The checklist further asks whether tenants are advised to remain indoors and apply Run/Hide/Tell procedures.

42. Does the building have CBR and In-Place Protection procedures?

For Chemical, Biological and Radiological threats, the checklist asks whether tenants are trained and briefed on the building’s In-Place Protection Plan.

It also asks whether building management has procedures for:

• responding to a reported CBR incident;
• sealing or closing ingress and egress;
• shutting fresh-air ventilation vents; and
• communicating activation of the IPP to tenants.

The most important landlord questions for a normal corporate banking office

The ABS appendix contains 63 questions, but not every financial institution will need to treat each one with equal depth.

For a normal corporate-office tenancy, I would consider these particularly important:

1. What building-level risk assessments are carried out?
2. Is there a designated building security manager?
3. How are public entrances controlled?
4. Are building entrances and common areas covered by CCTV?
5. Is CCTV actively monitored?
6. What CCTV retention period does the building maintain?
7. How are visitors registered and screened?
8. How are lifts and restricted floors controlled?
9. How are loading bays and service entrances protected?
10. What security systems remain operational during power failure?
11. Who responds to unauthorised access or security alarms?
12. How does the building communicate emergencies to tenants?
13. What lockdown capability exists?
14. What evacuation and invacuation procedures exist?
15. How are heightened-security measures activated?
16. Are tenants included in security exercises?
17. How are suspicious packages or bomb threats handled?
18. What procedures exist for armed attacks?
19. What is the building’s relationship with SPF/SSWG?
20. Who is the 24-hour building security contact?

That is a consultant’s prioritised shortlist derived from the issues in Appendix 1, not a replacement for the actual ABS checklist.

Using the checklist before signing a lease

One particularly useful application of Appendix 1 is pre-lease security due diligence.

Before committing to a new office, an FI can assess the building’s security capabilities alongside other property considerations.

A practical sequence is:

Building security review

Understand the existing security infrastructure and procedures.

Tenant risk assessment

Determine whether the building controls adequately support the FI’s own risk profile.

Gap analysis

Identify where the FI will need additional tenant-specific measures.

Security design

Incorporate those measures into the fit-out before construction begins.

Consultant’s perspective

This is significantly easier and generally less expensive than discovering security limitations after the fit-out is complete.

What if the landlord’s security is insufficient?

The ABS guideline does not say that an FI must automatically reject a building because a particular control is absent.

Its wider approach remains risk-based.

The FI should assess:

• the vulnerability;
• the potential consequence;
• what existing controls exist;
• whether additional tenant controls can compensate;
• and whether the residual risk is acceptable.

Possible responses might include:

• adding tenant CCTV;
• strengthening office access control;
• introducing additional visitor procedures;
• increasing monitoring;
• modifying the office layout;
• implementing tenant-specific SOPs; or
• raising the matter formally with building management.

Those are examples of potential risk treatment, not measures prescribed in every case by ABS.

Building security responsibilities should be clearly divided

One of the most useful outcomes of a landlord security review is clarity over who owns what.

A practical responsibility matrix could identify:

This is a consultant’s example, not an ABS-prescribed matrix.

The objective is to avoid assumptions.

Common mistakes financial institutions make with landlord security

Assuming building security automatically meets the FI’s requirements

ABS repeatedly encourages the FI to assess building-managed security infrastructure as part of its own security programme.

Looking only at the office floor

Threats can originate at the building perimeter, lobby, basement, loading bay or shared spaces.

Never testing communications

During an emergency, the FI needs to know how the building will actually contact the tenant.

Not understanding CCTV dependency

If the FI expects landlord CCTV to support investigations, it should know the coverage, retention and retrieval arrangements before an incident occurs.

Ignoring security-system resilience

The landlord may have excellent electronic security under normal conditions but the FI also needs to understand what happens during power or communications failure.

Developing tenant SOPs independently

Tenant response procedures should complement building procedures rather than conflict with them.

Practical landlord-security checklist

A financial institution reviewing a building should be able to answer:

Governance

• Who is the building security manager?
• Does the building conduct periodic risk assessments?
• Is the building subject to any special security classification?
• Is there a 24/7 security contact?

Perimeter

• How is the perimeter monitored?
• Is CCTV deployed?
• Is lighting adequate?
• Are exterior doors protected?
• Can the building be locked down?
• Is vehicle-ramming protection required or provided?

Car Park and Loading Bay

• Are vehicles monitored?
• Are suspicious vehicles detected?
• Are loading bays controlled?
• Are heightened-security checks available?

Entrances

• How are people entering the building controlled?
• How are visitors screened?
• How are unauthorised persons detected?
• Can entry points be reduced during heightened security?

CCTV and Security Systems

• Is CCTV actively monitored?
• What is the retention period?
• Is footage periodically verified?
• Are systems regularly maintained?
• Can critical systems operate through utility interruptions?

Security Personnel

• Is the security agency appropriately licensed?
• Are officers trained for the applicable threat scenarios?
• Are competency drills conducted?
• Can additional personnel be deployed during heightened security?

Communication

• How are tenants notified of incidents?
• How are threat-level changes communicated?
• How are evacuation and lockdown instructions issued?
• How is the all-clear communicated?
• How does the building liaise with authorities?

Emergency Procedures

• Are evacuation and invacuation procedures available?
• Are alternative assembly areas identified?
• Are suspicious-package procedures documented?
• Are armed-attack procedures documented?
• Are lockdown procedures available?
• Are CBR and IPP procedures established?

That gives the FI a practical view of how much security it is inheriting from the building and what it still needs to provide itself.

Conclusion

For a financial institution occupying leased premises, landlord security is not simply someone else’s responsibility.

The financial institution may depend heavily on building-level controls for:

deterrence, detection, access control, emergency communication and response.

This is why the ABS Physical Security Guidelines includes a detailed 63-question Building Management Engagement Guide covering everything from perimeter security and CCTV to suspicious vehicles, bomb threats, armed attacks and CBR incidents.

The most important principle is:

Do not assess only the security inside the office. Assess the building security that the office depends upon.

For new premises, this assessment should ideally happen before the lease and before the security design is finalised.

For existing premises, it should form part of the ongoing Physical Security Risk Assessment and regular engagement with building management.