Ask a scaling company if it secures its offices & assets, and you'll usually get a confident answer. Ask how it secures each location and all of a sudden the answer gets a lot more complicated.
It probably looks something like this. Headquarters has a good access control platform and a lobby that someone designed on purpose. The second office was opened by a workplace team in a hurry and runs on different security systems. The international site came with an acquisition and has cameras recording to a box in a closet. The newest one opened without cameras or access control at all, because the lease timeline moved up and everyone agreed to "just add them later."
None of these decisions were crazy at the time. Together they describe a program with no standard, and a program with no standard has a predictable set of problems. Audits turn into scavenger hunts, and every new site becomes a fresh negotiation with leadership.
I've built and inherited enough of these programs to have a strong opinion. Before you open the next site, write your standards down.
What a Security Standard Actually Is
A security standard is a short, specific description of what every site of a given type must have, approved by the business before anyone even needs it.
Short matters. If it runs a hundred pages, it will sit unused in a policy folder and only referenced when you need to defend a decision. Specific matters more. "Appropriate access controls" gives nobody anything to build to. Compare it with "All exterior doors and doors to restricted spaces on the company access control platform, with badge events retained for at least 30 days and exportable on request."
Not all square footage is created equal. It helps if your standards are risk-based and tiered to differentiate business critical offices & assets from the nice-to-haves. This demonstrates the ability to be cost-conscious while still protecting the enterprise.
Most of the value comes from deciding this once, before the next lease is signed, instead of re-arguing it site by site.
Why the Business Should Approve It
A standard written by the security team and filed in the security wiki carries about as much weight as a suggestion. A standard approved by the people who own the money carries a lot more.
When the the CFO, CISO, and the Head of Real Estate have agreed in advance that every Tier 2 site gets badge access, visitor management, and CCTV, opening a new Tier 2 site becomes a budgeting exercise instead of a debate. Physical Security stops arguing for the same controls every quarter. Finance can forecast the cost of expansion, Security & Privacy stay confident in the protection and compliance, and Workplace knows what to put in the lease build-out before construction. Getting ahead of this is far cheaper than retrofitting and arguing with landlords about add-ons after.
This is also where physical security gets to speak the business's language. Framed that way, the conversation moves away from cameras and toward the predictable cost of opening a compliant, secure office.
Where the Gaps Show Up
No standard fits every site, and the gaps are where most programs get hurt. A site opens without cameras because the lease moved. An acquired office runs a different badge platform for a year. A landlord won't allow a reader on a shared door. Everyone knows, nobody signed for it, and the first time it gets written down is in a post-incident review.
Acquisitions make this worse. I’ve supported international M&A strategy across numerous companies. The first things to break are usually identity offboarding processes and hardware integrations across sites built to different specs. Without a standard, integration becomes a string of judgment calls made under deadline by whoever is closest to the problem.
How long does it take to deactivate a person's credential at each office? Who owns it? How is it done? The variety of answers you'll get to these questions may surprise you.
What It Does For Audits and Deals
For a company working toward SOC 2, ISO 27001, or sector specific regulations, a standard turns the physical security section from narrative into evidence. Instead of explaining how each office happens to work, you point to the standard, show the sites that meet it, and show the signed exceptions for the ones that don't. Auditors and customer security teams generally respond well to a program that knows where its gaps are.
For a CFO it does something even better. It makes physical security forecastable. That alone changes how the function gets treated in planning.
Who Owns It
Security writes the standard. The CFO, CISO, and Head of Real Estate/Workplace approve it. The business owner of each site owns any gaps from it. If any of those roles are missing at your company, that's the first finding.
Getting from a pile of sites to an approved standard is a sequencing problem. Determine which sites, which tiers, which gaps get funded first, and who signs for the rest. Build these with the business owners in the room, and it will save you a lot of money, time, and headaches down the road.
Each new site is a chance to fix this or to make it worse. These are the questions I hear most from teams about to write their first standard.
-
A physical security standard is a short, specific description of what every site of a given type must have. The business approves it before the next site opens. A good standard names the actual controls, such as which doors go on the access control platform and how long badge events are kept. Vague language like "appropriate access controls" gives nobody anything to build to.cription text goes here
-
Start by sorting your sites into tiers based on risk, so business-critical offices and assets get more protection than the rest. Then write down the specific controls each tier requires, keeping it short enough that people actually use it. Get the CFO, CISO and Head of Real Estate to approve it before the next lease is signed. After that, every new site gets built to the standard instead of argued over. text goes here
-
Security writes the standard. The CFO, CISO and Head of Real Estate or Workplace approve it, and the business owner of each site owns any gaps from it. A standard approved only by the security team carries about as much weight as a suggestion. When the people who control the budget sign it, opening a new site becomes a budgeting exercise.
-
Write down each gap and have the site's business owner sign for it. Common gaps include a site that opened without cameras, an acquired office on a different badge platform, or a landlord who won't allow a reader on a shared door. A recorded, signed gap can be planned and funded. A gap nobody wrote down usually surfaces for the first time in a post-incident review.
-
A standard turns the physical security section of an audit from explanation into evidence. You point to the standard, show the sites that meet it, and show the signed exceptions for the ones that don't. Auditors and customer security teams generally respond well to a program that knows where its gaps are. SOC 2 physical access controls under CC6.4 are much easier to show when every site is built to the same written baseline.
-
Identity offboarding processes and hardware integrations usually break first, because the sites were built to different specs. Without a standard, integration turns into a string of judgment calls made under deadline. A useful first test is to ask how long it takes to deactivate a person's credential at each office, and who owns that step.
