A physical security incident response plan must protect people first, preserve evidence, bring in emergency services and regulators, and let the site keep operating. Anchor yours to AS 3745 and Safe Work Australia’s emergency plan guidance. Its core is a clear Emergency Control Organisation, a short list of immediate actions, defined escalation paths, regular rehearsal and a review that feeds back into the plan.

TL;DR:

• Call 000 for threats to life, violence, or weapons; isolate the area, preserve the scene, and assign one person to log every action and time.
• Assign a Chief Warden for every shift; that person directs evacuation or lockdown until responders arrive, while larger events can escalate to incident teams.
• Practice with role plays several times yearly, hold two full drills annually where practicable, and rehearse every three months in education and care services.
• After every incident or drill, document a debrief, assign each corrective action an owner and deadline, and update the plan and staff training.
• Check jurisdiction specific reporting rules, notify emergency services promptly, and preserve police event numbers, witness lists, footage, and records for regulator or insurance claims.

Table of Contents

• What should you do in the first minutes of a physical security incident?
• Who is responsible for what during a response?
• When must you escalate and notify external parties?
• How often should you train and run drills?
• How do you recover and learn after an incident?
• Which layered security controls make response easier?
• How do you draft, test and maintain a site-specific plan?
• How should response protocols differ by sector?
• How do you coordinate with security providers and police?
• How should you communicate during and after an incident?
• What resources should you plan for?
• What legal obligations apply beyond WHS and AS 3745?
• How does physical response connect with cyber incident response?
• Why do plans fail, and what makes staff follow them?
• How can we help you build and run your response plan?
• FAQ
• Sources

What should you do in the first minutes of a physical security incident?

The first minutes decide how an incident ends. Staff do not need a thick manual at that point. They need an ordered list they can recall under stress. Work through these steps in sequence:

1. Call 000 if life or serious harm is possible, and keep the line open until the operator tells you otherwise.
2. Use calm de-escalation and safe distance where it is reasonable. Never put a worker between an aggressor and an exit.
3. Trigger alarms and duress devices, so the people who can help know where to go. Our guide to duress alarm systems covers how these should be placed and tested.
4. Isolate the affected area and move unaffected people to a safe location.
5. Record who, what, where and when, and leave the scene undisturbed until police arrive.
6. Notify the ECO or Critical Incident Response Team duty officer and appoint one named person to log every action and time.

Pro Tip: Print the first six steps on a single card and attach it to every duress device and reception desk, so nobody has to remember them.

Who is responsible for what during a response?

Confusion about authority wastes more time than any missing equipment. AS 3745 planning relies on an Emergency Control Organisation, a structured team that includes a Chief Warden and floor wardens, who are authorised to direct occupants before emergency services arrive. Make that authority explicit in the plan, and make sure everyone on site knows who holds each role on each shift.

• Chief Warden: takes command on site, decides on evacuation or lockdown, and is the single point of contact for emergency services on arrival.
• Floor or area wardens: sweep their zones, account for people and report to the Chief Warden.
• Security staff: control access points, monitor cameras and keep evidence areas clear.
• Facility manager: liaises with emergency services, coordinates internal information and owns post-incident reporting.

Larger organisations add tiers. The University of Sydney’s plan, for example, moves from local teams to an Incident Assessment Team and then a Critical Incident Response Team. Handover changes who controls access and who speaks for the organisation, so write those consequences down. Our page on evacuation management systems explains how AS 3745 and EWIS fit together.

When must you escalate and notify external parties?

Escalation fails when people hesitate over whether an incident is “serious enough”. Set triggers in advance instead. Call 000 for any threat to life, active violence or a weapon. Ask for police attendance for theft, trespass or property damage where the offender may still be nearby or evidence needs collecting. Other emergency responders, such as ambulance and fire services, are requested for the harm or hazard they handle.

WHS laws add duties. SafeWork NSW points to WHS regulation 43, which requires workplaces to have an emergency plan with procedures for response, evacuation, notification and communication. Safe Work Australia adds that the plan must cover notifying emergency services quickly. Check your own regulator’s notifiable incident criteria, as they differ by jurisdiction.

• Record the police event number and the officer’s name for every attendance.
• Keep the internal incident report, timeline and witness list together in one file.
• Retain records for regulator follow-up and insurance claims.

Our security incident reporting guide sets out what a useful report contains.

How often should you train and run drills?

A written plan that nobody has rehearsed is a document, not a capability. Industry practice, as described by the City of Sydney, is to run full emergency drills or simulations at least twice a year so staff perform under stress, and to treat written plans as insufficient without rigorous training. Build your cadence around these elements:

1. Role-plays and table-top exercises several times a year, using a different scenario each time (an aggressive visitor, a forced entry, a suspicious package).
2. Two full-scale drills a year where practicable, involving every shift and, ideally, local police or fire liaison.
3. More frequent rehearsal for specific services. Education and care services, for instance, must rehearse evacuations every three months and document a debrief each time.
4. Role-specific training in de-escalation, duress device use, evacuation leadership and first aid. The competency unit PUAFER003 is a useful benchmark for facility emergency managers.

Pro Tip: End every exercise with a prompt debrief and a written action log with named owners. Drills without recorded fixes only repeat the same mistakes.

How do you recover and learn after an incident?

Recovery starts while the response is still running, but the learning happens afterwards. Run a prompt investigation that captures witness statements, a timeline and contributing factors, and bring in multidisciplinary reviewers when the incident is complex. NSW Health’s guidance stresses multidisciplinary investigation and learning-focused reviews, with outcomes feeding governance and audit processes.

• Treat every incident, however minor, as a prompt to review controls and find root causes, as WA Health recommends.
• Write recommendations with an owner and a deadline, then fold the changes into the plan and training.
• Coordinate with your business continuity plan, and expect that police or coronial restrictions may limit access to part of the site.

The national guidance on active armed offenders frames the whole cycle as prevention, preparedness, response and recovery, and includes business continuity in recovery. Use the same cycle to structure your review.

Which layered security controls make response easier?

Good response depends on early detection. Protective security guidance for crowded places recommends layered measures across people, information and physical controls to deter, detect, delay, respond and recover. For most facilities that means:

• People: a visible security presence and patrols, backed by staff who know how to report unusual behaviour.
• Detection: CCTV and monitored alarms, sited so they capture entry points and evidence, and maintained so they work when needed.
• Delay: access control and perimeter barriers that slow an intruder long enough for responders to arrive.
• Safe egress: emergency exits and responder access that remain usable when locks and barriers are engaged.

Safe Work Australia’s violence prevention guide lists security personnel, CCTV, access controls, lighting and barriers among its physical environment controls. Keep measures proportionate: a hospital or shopping centre must protect occupants while preserving public access. A structured security risk assessment shows where each layer earns its place.

How do you draft, test and maintain a site-specific plan?

Plans written in isolation tend to describe procedures the site cannot actually deliver. The City of Sydney guidance recommends a dedicated emergency committee with senior management, facilities managers and chief wardens. Follow this sequence:

1. Form the emergency planning committee, adding security and worker representatives.
2. Assess hazards and incident types using a risk process such as WorkSafe Queensland’s four steps: identify, assess, control, review.
3. Draft the plan against the Safe Work Australia contents list and AS 3745: roles, communications, evacuation diagrams, contact lists and escalation triggers.
4. Set a testing schedule, run the exercises and record the results.
5. Review the plan after every real incident and every test, and keep version control and training records.
6. Give each role holder a one-page action card that matches the full plan.

Treat the plan as a living document with a named owner. If the owner leaves, the plan should be reassigned before the handover is complete. Our corporate office security plan primer shows how this governance looks in an office setting.

How should response protocols differ by sector?

One generic plan rarely fits a building site, a hospital ward and a head office. The framework stays the same, but the scenarios and the first actions change.

Construction sites face out-of-hours intrusion, theft of plant and tools, and conflict with trespassers or neighbours. Response protocols should cover gate and fence breaches, safe handling of confrontation with an intruder (observe and report rather than engage), isolation of hazardous plant after a break-in, and contact with the principal contractor. Our construction site security plan steps through the controls that support these protocols.

Healthcare facilities deal with aggression from patients and visitors, often driven by distress. Protocols should emphasise early de-escalation, duress response teams, safe zones for vulnerable patients and clear authority to restrict access. The NSW Health guidance referenced earlier emphasises incident reporting and learning-focused review, which suits a clinical culture.

Corporate offices are more likely to see unauthorised access, aggressive visitors, threats to individual staff and tailgating. Reception procedures, visitor management and a clear lockdown or evacuation decision path matter most.

For each sector, write realistic scenarios into the plan, each with the trigger, the initial actions, the decision maker and the notification list. Run those exact scenarios in your drills. Events and crowded venues add a further layer, where crowd control strategies and the national crowded-places guidance become the main reference.

How do you coordinate with security providers and police?

External help only works if it is arranged before the incident. Owners and operators of crowded places hold primary responsibility for site protection, including risk assessment, mitigation, staff awareness and timely reporting to law enforcement. Outsourcing guarding or monitoring does not move that responsibility, so make the relationship explicit.

With your security provider, agree in writing what officers do and do not do in an incident: who they report to on site, when they observe and report, when they intervene, and how they hand over to police. Include their post orders and escalation contacts in the plan, and invite them to your drills so the first joint rehearsal is not the real thing.

With police, build a relationship before you need it. Share site plans, access arrangements and after-hours contacts with your local station where appropriate, and know who to call for non-urgent liaison, because 000 is for emergencies. Brief arriving officers with a short handover: what happened, who is hurt, where the scene is, what has been touched and who holds the camera footage.

Also list specialist support you might need: locksmiths, glazing and board-up contractors, counselling services and forensic cleaners. Keep their after-hours numbers in the contact list and test them occasionally. A contact list that has never been dialled is often wrong.

How should you communicate during and after an incident?

Communication breaks down in predictable ways: too many voices, rumours filling silence and staff learning about events from social media. Decide the structure in advance.

Internal. Use a pre-agreed channel for urgent instructions, such as public address, SMS or a messaging group, and keep the wording short and directive (“Lock down. Stay in your room. Wait for the all clear.”). Appoint one person to approve messages. After the immediate danger, brief staff on facts, support available and what to say if asked questions.

External stakeholders. Notify affected tenants, contractors, visitors’ hosts and, where relevant, parents or next of kin through someone trained for those conversations. Your insurer and regulator should hear from you rather than from a third party.

Media. Nominate one spokesperson, usually a senior manager rather than the facility manager who is busy running the response. Prepare a holding statement that confirms the incident, the safety of people and that authorities are involved, without speculating on cause, names or blame. Direct all media queries to that person and tell staff not to comment publicly or post online.

Keep a log of every message sent, to whom and when. It supports the investigation and shows regulators that your notification obligations were taken seriously.

What resources should you plan for?

Resource planning means deciding in advance what you will need during an incident and its aftermath, and who has the authority to commit it.

Personnel. Identify who staffs the ECO each shift, who covers when a warden is absent and how you add security cover if an incident leaves the site exposed. A burglary or fire can leave a building open overnight, so know how quickly you can get a guard on site. Consider fatigue: a long incident needs relief for the people running it.

Equipment. Keep first aid supplies, torches, radios with spare batteries, high-visibility vests for wardens, barrier tape, evacuation chairs where needed and printed copies of plans and contact lists somewhere that survives a power or network failure. Check expiry dates and battery condition on a schedule.

Technology. Make sure alarms, duress devices, CCTV and access control are monitored, maintained and recording. Confirm footage retention periods so evidence is not overwritten, and know who can export it. Test backup power and communications. Our electronic security solutions and A1 CCTV and alarm monitoring are designed to support exactly this kind of readiness.

Finally, set spending authority. If the Chief Warden needs approval from someone unreachable before calling in extra guards or a glazier, the plan has a gap. Decide who can authorise emergency spend and write it down.

What legal obligations apply beyond WHS and AS 3745?

WHS duties and AS 3745 set the baseline, but a physical security incident can trigger several other obligations at once. This is general information, so confirm your position with a legal adviser for your jurisdiction and industry.

• Privacy and surveillance. CCTV footage often contains personal information. Know your obligations for collection, notices, retention, secure storage and release to police or others, and keep a record of who received footage and why.
• Evidence and investigations. Preserve the scene and footage so police can use them. Internal investigations should not contaminate a criminal matter, and witness interviews may need to wait if police request it.
• Insurance. Policies commonly require prompt notification and cooperation. Late notice can put a claim at risk, so list your insurer and policy reference in the contact sheet.
• Use of force and security licensing. Security officers act within their licence conditions and the law. Your plan should not ask anyone to do more than their licence and training allow.
• Duty of care to visitors and contractors. Obligations extend to people who are not employees, including their notification and support.
• Sector rules. Healthcare, education, critical infrastructure and gaming venues have their own reporting rules. The national security guidance says critical infrastructure security plans must align with local emergency arrangements and include procedures for breach response, access control and staff training.

Review these obligations whenever your site, tenants or services change.

How does physical response connect with cyber incident response?

Physical and cyber incidents increasingly overlap. A stolen laptop, a tailgater at a server room door, a cloned access card or a tampered network port are physical events with digital consequences. A hybrid plan treats them as one problem with two response teams.

Start by mapping where the two meet: server and comms rooms, access control and CCTV systems that sit on the network, badge databases, and devices that leave the building. Then agree handover rules. If security finds a compromised door controller or a missing device, who tells the IT or cyber lead, how fast and what do they preserve? If the cyber team sees an unusual badge pattern, who checks the door?

Share contact lists and escalation triggers across both plans, and include a physical security representative in cyber exercises and an IT representative in physical drills. Decide who owns external notification when both are involved, so police, regulators and customers do not receive conflicting accounts.

Keep the evidence trail intact on both sides. Camera footage, access logs and device handling records may all matter later, and the retention periods should be aligned rather than set independently. The aim is not a merged super-plan but a clear bridge between two competent ones.

Why do plans fail, and what makes staff follow them?

In my view, most incident response plans fail on usability, not on content. A lengthy document written to satisfy an audit will not be read during an incident with an aggressive visitor at the door. The plans that work are short at the point of use, rehearsed until the first steps are habit and visibly endorsed by senior leaders who turn up to the drills. Consult the people who will carry the plan out, and hold debriefs that are honest about what went wrong without hunting for someone to blame. That is how a plan becomes part of the site’s culture instead of a binder on a shelf.

— Abco

How can we help you build and run your response plan?

We deliver the services that put a plan into practice on your site. With extensive experience, around-the-clock operations and quality systems, we support facility managers across construction, healthcare and corporate settings. We offer:

• Site reviews and plan development tailored to your risks.
• Exercise facilitation, so your team practises before it matters.
• Security guarding and mobile patrols for on-site presence and rapid response.
• CCTV and alarm monitoring for early detection and evidence preservation.

Contact us through our security guarding page to request a site-specific proposal.

FAQ

What is a physical security incident response plan?

It is a documented set of roles, actions and escalation steps for handling on-site security incidents such as violence, intrusion or theft. It covers immediate response, notification, recovery and review. Safe Work Australia says an emergency plan must cover how to respond, evacuation, notifying emergency services, medical treatment and communication.

Who should lead the response on site?

The Chief Warden, working within the Emergency Control Organisation, leads on site until emergency services arrive. AS 3745 planning gives the ECO authority to direct occupants. Larger events escalate to an incident assessment or critical incident team.

How often should we test the plan?

Run role-plays and table-top exercises several times a year, and aim for at least two full drills annually where practicable. Some services, such as education and care, must rehearse every three months. Always document a debrief and actions.

When do we call police instead of other services?

Call 000 for any threat to life, weapons or violence in progress. Request police attendance for crimes where evidence or offenders are involved, and keep the event number. Use ambulance or fire services for the harm they handle.

Do we need to review the plan after a minor incident?

Yes. Every incident, however minor, should trigger a review of control measures to find root causes and prevent recurrence. Record the findings and update the plan and training.

Sources

• Violence | SafeWork NSW
• Emergency plans and procedures – Overview | Safe Work Australia
• ANU Policy Library – Procedure – Emergency response

Recommended

• Security risk assessment checklist for Australian facilities
• Access control policies for Australian facility managers
• Security incident reporting for facility and site managers
• Data Centre Physical Security Layers Australian Operators Must Have Under the ERP Act