Maintenance and facilities planning for safer, more resilient buildings

a[data-rs-seo-link]{text-decoration:underline!important;color:#1a56db!important;cursor:pointer!important;}a[data-rs-seo-link]{text-decoration:underline!important;color:#1a56db!important;cursor:pointer!important;}

Why maintenance and facilities belong in security planning

Maintenance and facilities work is often measured by comfort, uptime, and repair cost. In a safety and security program, its role is broader: routine upkeep helps keep doors locking, cameras recording, alarms transmitting, fire protection systems ready, emergency lighting visible, and electrical equipment reliable when a building is under stress. OSHA’s safety management guidance recommends tracking controls, inspecting and evaluating them after installation, and conducting routine preventive maintenance of equipment, facilities, and controls to help prevent incidents related to equipment failure. (osha.gov)

The practical point is straightforward: a facility that buys technology but does not maintain it has not reduced risk as much as it may appear to on paper. A card reader with a loose strike, a camera blocked by seasonal landscaping, a sprinkler valve left in the wrong position, or a panel with undocumented bypasses can weaken the larger security plan. Maintenance planning therefore needs to connect with risk assessment, life safety obligations, contractor management, and post-incident documentation.

Facility management standards support this broader view. ISO 41001:2018 describes a facility management system as one intended to support organizational objectives, meet the needs of interested parties, and address applicable requirements across different types and sizes of organizations. (iso.org) In practice, maintenance is the evidence that a security plan is being sustained, not merely installed.

Map what must work before deciding how often to test

Effective maintenance programs start with consequence, not convenience. Instead of asking what can be checked quickly, facilities teams should first identify which assets must work during a fire, intrusion, workplace violence event, severe weather incident, power loss, medical emergency, or evacuation. OSHA’s hazard identification guidance specifically notes that nonroutine tasks, including maintenance and startup or shutdown activities, can present hazards and should be considered during hazard assessment. (osha.gov)

Build an asset register around risk

An asset register for maintenance and facilities should do more than list serial numbers. It should identify what each asset protects, what failure would look like, who owns the response, and what record proves the task was completed. The following structure is more useful than a basic inventory list.

Asset or system	Security or safety consequence	Evidence to keep
Access-controlled doors, locks, strikes, and closers	Unauthorized entry, delayed lockdown, failed egress, or nuisance alarms	Functional test notes, repairs, credential changes, and exception approvals
Cameras, video management systems, and storage	Loss of situational awareness, investigation gaps, or privacy complaints if angles drift	Field-of-view checks, retention verification, time synchronization, and downtime logs
Intrusion, duress, and monitoring systems	Missed alarms, delayed response, or false alarm fatigue	Signal tests, monitoring confirmations, zone changes, and call-list updates
Fire alarm, sprinkler, pump, and suppression systems	Delayed detection, failed notification, or impaired fire control	Inspection and testing reports, impairment permits, corrective actions, and authority notices
Emergency lighting, exit signs, gates, and egress hardware	Unsafe evacuation or blocked emergency movement	Walkthrough findings, battery or generator tests, repair tickets, and photos after correction
Electrical distribution, backup power, UPS, and surge protection	Loss of critical security, communications, and life safety support systems	Preventive maintenance records, load tests, thermographic findings, and corrective work orders

Separate inspection, testing, maintenance, and repair

A common weakness is treating every activity as a check. In practice, inspection, testing, maintenance, and repair answer different questions. Inspection asks whether a condition appears acceptable. Testing verifies performance. Maintenance preserves function. Repair restores function after a deficiency is found. Cleaning a camera lens is not the same as verifying recording retention. Adjusting door hardware is not the same as confirming that emergency egress still works. A sprinkler report is not automatically a fire alarm report.

This distinction matters because it prevents false confidence. If a task list says complete but does not state whether the team inspected, tested, maintained, or repaired the asset, managers cannot know whether the risk was actually reduced.

Put standards and local requirements into a usable schedule

Standards and codes need to be translated into a site-level calendar that a facility team can operate. NFPA 25 is the standard associated with inspection, testing, and maintenance of water-based fire protection systems, while NFPA 72 includes Chapter 14 on inspection, testing, and maintenance for fire alarm and signaling systems. (docinfofiles.nfpa.org) NFPA listings also show that NFPA 70B became the Standard for Electrical Equipment Maintenance in the 2023 edition, while earlier editions were presented as a recommended practice. (link.nfpa.org)

Those references do not mean every building follows the same edition or interval. Adopted codes, the authority having jurisdiction, lease terms, insurance requirements, manufacturer instructions, and the facility’s risk profile can all affect what is required. The facility team’s job is to capture the applicable requirement, assign ownership, and keep deficiencies visible until they are closed.

Schedule input	What to verify	Why it matters
Adopted fire and building codes	Edition, inspection interval, report format, and who must be qualified	Prevents use of an outdated checklist or an unqualified vendor for regulated systems
Manufacturer instructions	Cleaning, calibration, battery replacement, environmental limits, and firmware guidance	Reduces failures caused by poor upkeep rather than equipment design
Operational risk	Public access, after-hours occupancy, critical rooms, high-value inventory, or vulnerable populations	Helps prioritize assets whose failure would have the highest consequence
Incident and work order history	Repeat defects, nuisance alarms, bypasses, and late repairs	Shows whether the schedule is preventing failure or merely documenting it after the fact

Integrated systems need special attention. NFPA committee material notes that NFPA 25 does not address all electrical components of water-based fire protection systems that are addressed by NFPA 72, although one inspection or test may satisfy both standards when it meets both requirements and is performed by a qualified person. (docinfofiles.nfpa.org) That is a useful reminder for any site where sprinklers, fire alarms, access control, elevators, generators, and monitoring centers interact.

Control maintenance work so fixes do not create new hazards

Maintenance itself can introduce risk. A technician may bypass an alarm point, disable a reader, open a ceiling, isolate a circuit, prop a secured door, or take a fire protection component out of service. Without controls, a repair activity can create a security gap larger than the original deficiency.

OSHA’s lockout/tagout standard, 29 CFR 1910.147, applies to the control of energy during servicing and maintenance of machines and equipment where unexpected energization, startup, or release of stored energy could injure employees. It requires an energy control program with procedures, training, and periodic inspections for covered activities. (osha.gov) NIOSH’s hierarchy of controls also provides a useful framework by ranking hazard control actions from more protective to less protective. (cdc.gov)

For a security-focused facility program, safe maintenance controls should include:

• Pre-work review. Identify whether the job affects life safety, access control, monitoring, egress, utilities, or occupied areas.
• Isolation and notification. Use lockout/tagout, impairment procedures, monitoring center notices, and stakeholder alerts where applicable.
• Temporary protection. Assign a fire watch, guard post, mobile camera, temporary lighting, or manual patrol when a critical system is offline.
• Access management. Verify contractor identity, escort requirements, keys, badges, tool control, and after-hours permissions.
• Return-to-service verification. Confirm that bypasses are removed, panels are normal, alarms transmit, doors secure, video records, and affected occupants are notified when needed.

The objective is not to slow repairs. It is to ensure the building is not left less safe while the work is being performed.

Close the handoff gap between facilities, security, IT, and contractors

Security systems often fail at the handoff points between teams. Facilities may own doors and power. Security may own monitoring and response procedures. IT may own networks, storage, and credentials. Contractors may own testing and specialized repairs. If these groups do not share change information, a small maintenance action can become an operational failure. See also: Access Control.

CISA’s Interagency Security Committee guidance on facility access control describes the access control process as extending from employee and visitor entry through screening and authentication into nonpublic space. (cisa.gov) That broad view is useful outside federal facilities as well: access control is not only a device on a wall. It is a process that depends on policies, people, equipment, and records working together.

A reliable handoff routine should answer five questions before a work order is closed:

1. Did the maintenance activity change how people enter, exit, authenticate, or move through the building?
2. Did it affect video coverage, alarm zoning, monitoring instructions, or emergency response routing?
3. Did it create a need to update drawings, device names, floor plans, contact lists, or training material?
4. Did it require cybersecurity coordination, such as a network change, account update, software patch, or password rotation?
5. Did the contractor provide enough evidence to show what was tested, what failed, what was repaired, and what remains open?

This is where documentation becomes operational. A closeout note that says fixed is rarely enough. A useful closeout note identifies the asset, defect, action taken, test result, remaining limitation, person responsible, and date returned to service.

Use records to catch weak signals before they become incidents

Good records do more than satisfy audits. They reveal patterns. Repeated door alarms after a hardware repair may point to alignment, user behavior, or a credentialing issue. Multiple camera outages on one switch may point to power or network instability. Recurring sprinkler deficiencies may justify capital planning rather than another short-term repair.

EPA ENERGY STAR’s operations and maintenance guidance emphasizes assessing current O&M practices, implementing tune-ups, documenting actions, and tracking savings to fund future efficiency work. It also notes that staff who spend more time on preventive operations generally spend less time troubleshooting operational problems. (energystar.gov) The same management logic applies to security and safety systems: records create the feedback loop that lets teams move from reactive repairs to risk-based maintenance.

Useful metrics for maintenance and facilities leaders include:

• Percentage of safety-critical preventive maintenance completed on time.
• Number of open deficiencies by risk level and days open.
• Repeat work orders by asset, location, vendor, or system type.
• Average time to restore impaired fire, security, or access control functions.
• Number of temporary bypasses, disabled alarms, or propped doors found during inspections.
• Percentage of contractor reports reviewed, accepted, and linked to corrective actions.
• Training or procedure updates triggered by maintenance findings.

These measures should not be used only to judge technicians. They should help leaders decide where to fund replacements, revise procedures, improve supervision, or simplify overly complex systems. For more guidance in this content area, see Costcola’s maintenance and testing resources.

Frequently asked questions

What should be included in a facility security maintenance plan?

A practical plan should include an asset register, risk ranking, inspection and testing schedule, preventive maintenance tasks, deficiency process, impairment controls, contractor requirements, documentation rules, and return-to-service checks. It should cover physical security, life safety, utilities that support security, and the procedures people use to operate those systems.

How often should access control systems and cameras be tested?

There is no single universal interval for every site. The schedule should reflect manufacturer guidance, site risk, occupancy, incident history, monitoring requirements, and any contractual or regulatory obligations. High-consequence openings, public entrances, critical rooms, and cameras used for response or investigations usually deserve more frequent functional checks than low-risk areas.

Is preventive maintenance required by OSHA?

OSHA’s general safety management guidance recommends routine preventive maintenance of equipment, facilities, and controls as part of hazard prevention and control. Specific OSHA standards may also apply to certain maintenance activities, such as lockout/tagout for covered servicing and maintenance of machines and equipment where hazardous energy could injure employees. (osha.gov)

Who owns documentation when a contractor performs the work?

The contractor may perform the inspection, test, or repair, but the facility owner or operator still needs usable records. Before work starts, define the report format, required test evidence, deficiency categories, photo requirements, notification steps, and who must approve closeout. If a contractor report identifies an impairment or open deficiency, the facility team should track it until corrected.

What is the biggest mistake facilities teams make with security maintenance?

The biggest mistake is treating maintenance as a checklist separate from risk. A completed task is only useful if it confirms that the right asset was checked, the right function was tested, deficiencies were assigned, temporary protections were used when needed, and the system was verified before being returned to normal operation.