A secure lobby is designed so that one entry point is easy to see, easy to supervise and easy to control, with people, cameras and access control working as layers rather than as separate purchases. Get the layout right first (sightlines, a single clear route, a defined line between public and secure space), then add electronic systems and staffing to suit the risk. Doing it in that order costs less and works better than fitting hardware around a poor floor plan.

This guide is for facility managers, project teams and building owners planning a new lobby or reworking an existing one. It draws on Australian government, university and health-sector design guidelines, and on what we see in the field at ABCO Security.

TL;DR

• Start with a site-specific security risk assessment. Lobby design for a hospital, a corporate tower and a retail foyer should not be the same.
• Use CPTED principles: natural surveillance, clear entries, good lighting and no hiding places such as deep recesses or blind corners.
• Funnel visitors to one controlled entry, keep reception facing the public area, and make the reception desk the gate to the secure working area.
• Layer access control, CCTV and trained people. CCTV supports physical barriers and does not replace them.
• Plan for accessibility, fire egress, power failure and privacy law from the first drawing, not as a late fix.

Table of Contents

• What a secure lobby has to do
• Start with CPTED: see and be seen
• Layout: one front door, one clear route
• Layering access control, people and cameras
• Fitting the design to your site type
• Safety, accessibility and privacy requirements
• Common mistakes to avoid
• Our perspective
• How ABCO can help
• FAQ
• Sources

What a secure lobby has to do

A lobby has two jobs that pull against each other. It must welcome visitors, tenants and patients, and it must stop the wrong people from moving deeper into the building. Good design resolves that tension with geometry and flow before it reaches for locks.

The Australasian Health Facility Guidelines tie front-of-house design to CPTED principles and a facility-specific security risk assessment and mitigation plan. The threats they name include crime, ram raids and violent behaviour in the foyer or retail area. Your own list will differ, but it usually includes:

• Unauthorised entry and tailgating into secure floors
• Theft from reception, the lobby or unattended parcels and equipment
• Aggression towards front-desk staff
• Vandalism and after-hours intrusion
• Vehicle impact at glazed entries
• Crowding or queuing problems at peak times or events

Write these down, rank them by likelihood and consequence, and let the ranking drive the design. If you want a deeper walk-through of the underlying thinking, our guide to CPTED principles for safer public spaces covers it in plain terms.

Start with CPTED: see and be seen

Crime Prevention Through Environmental Design is the backbone of most Australian security design guidance. The NSW Planning Portal’s CPTED document describes four key strategies: territorial reinforcement, surveillance, access control and space and activity management. It defines natural surveillance as people being able to see and be seen, which depends on building layout, orientation, landscaping and lighting.

In a lobby, that translates into a few concrete decisions.

Make the entry prominent and readable

The same NSW document says entrances should sit in prominent positions and let users see in before they enter, which supports surveillance from the street and quick access for emergency services. The health guidelines add that the front of house should be readily identifiable from the street and car parks, with clear pedestrian and vehicle routes, well lit and signposted.

The same guidelines say the main entry door should be flush with the exterior wall so people approaching the building are visible. A recessed doorway might look elegant, but it creates a pocket where someone can wait unseen.

Remove hiding places

ANU’s security guideline says the façade should be designed to minimise recesses, alcoves and columns that may be a security hazard, and that the main external entrance should be well lit with all perimeter doors and ground-floor access points properly illuminated. RMIT’s 2025 design standards go further: blind corners are to be avoided, reliance on enclosed corridors minimised and visual connection between spaces prioritised.

Keep waiting areas and lifts visible

The NSW guidance says waiting areas and entries to lifts and stairwells should be close to active uses and visible from the building entry. If someone has to walk around a corner to reach the lifts, you have created an unobserved stretch right where tailgating and confrontations happen.

Do not over-fortify

Heavy shutters and grilles can backfire. The NSW document warns that security grilles, shutters and doors should still allow natural observation of the street, and that overuse of traditional security equipment can reduce natural surveillance and make genuine users feel unsafe. A lobby that feels like a bunker puts off tenants and visitors, and it hides activity from passers-by who would otherwise act as informal guardians.

Layout: one front door, one clear route

The single most effective layout move is to reduce the number of ways in and make the remaining one obvious. A design article on building protection puts it simply: place entryways so visitors are guided to a single access point. We would not cite a page we have not verified, so treat that as a general principle and anchor your design to the Australian guidelines below.

The Australasian Health Facility Guidelines (Part C) say that entry and exit points to a facility or department should be reduced to a minimum and given monitoring or access control as applicable. They also say perimeter doors should be lockable and that provision should be made for use after hours and after dark.

Design the reception desk as a boundary

James Cook University’s building security guideline gives a clear model. Reception counters should be wide enough or high enough to inhibit direct physical contact, face the public area and form part of the secure area’s working-hours perimeter. Access from the public area to the secured working area should go through doors controlled from reception or by electronic access.

The same guideline says offices and facilities the public are likely to use should preferably be grouped near reception, keeping public movement through the building to a minimum. That one decision shrinks the area you need to protect.

For the people side of this, see our guidance on reception security priorities for facility managers, and how to choose between concierge and reception security models.

Zone the building by sensitivity

ANU’s guideline says areas should be zoned according to security requirements, with high-security areas grouped together. Think of it as rings: street, lobby, general tenancy floors, restricted areas. Each ring needs a control point that matches what it protects. JCU’s guideline takes a defence-in-depth approach and says the project architect should consider the façade and security envelope early so the envelope stays intact.

Use a simple visitor flow

A workable sequence for a corporate or healthcare lobby looks like this:

1. Visitor enters a lit, visible entry with clear signage.
2. Reception or a concierge greets and verifies who they are visiting.
3. A badge is issued and recorded (see our visitor badge checklist).
4. The badge opens only the doors the visitor needs.
5. Exit is recorded and the badge returned or deactivated.

Layering access control, people and cameras

No single measure carries a lobby. The South Australian Government’s PHYSEC1 handbook lists the forms of access control: security guards at entry and exit points, guards monitoring via intercom or CCTV, mechanical locks, electronic access control and symbolic barriers such as signage or CPTED. Western Australia’s Safer Places by Design guidelines (2023) recommend layered security through multiple design responses, including organised control such as security personnel at entrances, and electronic systems to control access.

The WA guidelines also say the built environment should maximise natural access control, with formal access control used where natural control is not achievable or not enough. Design out the problem first, then add technology.

Electronic access control

The health guidelines suggest staff swipe card entry at access points be considered as a more secure and cost-effective option. Macquarie University’s guidelines require that the main entry door be swipe access controlled and covered by CCTV. For choosing systems, our articles on access control for office buildings and the 2026 guide to access control for business set out the options.

Two design details matter at the lobby:

• Speed. If the reader and door are slow, staff prop doors open. Check throughput at your busiest hour.
• Time delays. JCU’s guideline calls for long access time delays for disabled people using electronic access doors, so your readers and door timers need to allow for that.

Guards and concierge

Technology records and detects. People interpret and respond. The PHYSEC1 handbook names guards at entry points and at central monitoring points as access control in their own right. A licensed guard or concierge can challenge tailgaters, de-escalate a heated visitor and notice behaviour that no sensor flags. Our security guarding service covers static posts for lobbies, and we can pair them with mobile patrols outside business hours.

CCTV that helps rather than just records

PHYSEC1 says CCTV can act as a visual deterrent to unauthorised access, theft or violence and can help investigations, but must not be used as a substitute for physical barriers. It also says cameras should cover the perimeter, particularly publicly accessible areas such as reception, lobby and entry points, car park entrances, public hallways, stairwells and lift lobbies.

The health guidelines list the lobby sites to overlook: main entrance, waiting areas, reception, lobby, cashier’s desk and ATM, with appropriate CCTV signage, colour digital recording and good lighting. Good lighting matters as much as the camera, because a poorly lit scene gives poor footage.

On image quality, the University of Sydney’s security standard specifies a minimum of 246 pixels per metre at all main building entrances to identify people entering. Treat that as a useful benchmark for your own brief. When you shortlist cameras, a Hikvision trade showroom is one place designers can look at hardware in person before specifying.

Other devices ANU lists as sometimes needed include duress alarm buttons, break-glass units, passive infra-red detectors and communications systems. A duress button under the reception desk is a small cost with a big effect on staff confidence.

If you want the cameras watched, not just recorded, see our A1 CCTV and alarm monitoring and electronic security solutions.

Fitting the design to your site type

The principles hold everywhere, but the weighting changes. Use the table as a starting point for your risk assessment, not as a specification.

Healthcare

The health guidelines say the front-of-house configuration should avoid entrapment points and maximise lines of sight and opportunities for observation. In practice that means a reception counter positioned to see the door and the waiting area together, with an exit path for staff behind it. Our security risk assessments for healthcare sites look at exactly these points.

Corporate offices

The aim is to keep the public in the lobby and let only verified people through. Combine a staffed desk in business hours with electronic control and monitoring out of hours. We cover the rollout in after-hours office security.

Retail

Retail wants openness, so lean on natural surveillance: clear glazing lines, uncluttered displays and cameras that cover the entry and the cashier’s desk, as the health guidelines recommend for cashier and ATM areas.

Construction and events

A construction “lobby” is a gate, a site office and a sign-in point. The same logic applies: one controlled route, recorded visitors, supervised entry. See our construction site security plan and construction security services. For events, entry lanes and queue space are the design problem, covered in our crowd control security plan.

If your lobby shares a building with other tenants or a public through-route, our guide to security by design explains how to bring these decisions into the project early.

Safety, accessibility and privacy requirements

Security features must never trap people or lock out those who need to get in.

Safety and accessibility

JCU’s guideline lists safety considerations to design in: after-dark personal safety, communications and cameras where distress could occur such as lifts, door furniture suitable for people with disability, automatic unlocking of emergency exit doors when the fire alarm sounds, and fail-safe operation with battery backup for secure locking during mains power failure. Confirm egress and fire requirements with your building certifier and fire engineer before finalising door hardware.

Curtin University’s guideline says after-hours entry doors should have video surveillance and an intercom, and be capable of universal access and conform to the relevant accessibility specifications. RMIT’s standards also call for safe refuges where people can wait for assistance to evacuate.

Base-building security standards

Agilient’s page on physical and facility security notes that SA HB 188:2021 guides Australian base-building security, applies to buildings of any size, and builds on the ISO 31000:2018 risk process. It is a useful reference for the risk process behind your lobby brief.

Privacy and CCTV

Cameras in a lobby capture personal information. The ACT Government’s 2025 CCTV policy states that CCTV footage of a person is personal information under the Information Privacy Act 2014, and that its systems must not be used for automated biometric verification or identification. That policy governs ACT Government systems, so private operators should check the rules that apply in their own state or territory, including surveillance device and privacy legislation, with a legal adviser.

As practical habits, Sprintlaw’s guide to business camera laws advises disabling unneeded features such as audio recording, documenting configuration and using clear, consistent signage at entry points and in monitored areas.

Common mistakes to avoid

• Adding security after fit-out. Moving a reception desk or a door is cheap on paper and costly on site. Security considered at design stage avoids rework.
• Relying on cameras alone. They deter and help investigations, but they do not stop a person walking through an open door.
• Several unsupervised entries. Every extra door needs its own control and monitoring.
• Dark or recessed entries. Lighting and flush doors are low-cost fixes.
• Shared egress routes. JCU’s guideline says emergency exit doorways should not be shared with other uses so defence-in-depth envelopes can work.
• Ignoring after-hours use. The lobby that is staffed at 10am is empty at 10pm. Design for both.
• Forgetting the control room. Alarms and camera feeds need somewhere sensible to be watched. See our guidance on security control room design.

Our perspective

We treat the lobby as the first and best chance to prevent an incident, not the place where you record one. Most of the lobbies we are asked to secure were designed before anyone asked how people, cameras and doors would work together.

Our view is that a good lobby has three layers working as one. The building shapes behaviour through sightlines, lighting and a single obvious route. Technology such as access control, CCTV and alarms adds detection and records. Licensed people supply judgement and response around the clock.

We work to ISO 9001 and ISO 30000 standards, bring more than 15 years of industry experience and run 24/7 operations across Australia. That lets us carry a lobby design from risk assessment to guarding, electronic security and monitoring, so there is one accountable provider rather than three that never speak to each other.

Abco

How ABCO can help

If you are planning a lobby or reviewing an existing one, we can start with a security risk assessment of the entry, reception and visitor flow, then recommend the mix of licensed guards, CCTV and alarm monitoring, and access control that suits your site. For out-of-hours cover, our Night Owl Service is listed from $5.45 per day.

To talk through your building, contact ABCO Security and tell us the site type, the hours it operates and the risks that worry you most.

FAQ

What is the first step in lobby security design?

Begin with a security risk assessment for the specific building. The Australasian Health Facility Guidelines link front-of-house design to CPTED principles and a facility-specific risk assessment. The results tell you whether to prioritise visitor control, theft prevention, staff safety or after-hours protection.

Should a lobby have a guard, cameras or access control?

Usually all three, in proportion to the risk. South Australia’s PHYSEC1 handbook lists guards, locks and electronic access control as forms of access control, and says CCTV is not a substitute for physical barriers. Layered measures cover each other’s weaknesses.

Where should CCTV cameras go in a lobby?

Cover the main entrance, reception, waiting areas, lift lobbies and stairwell entries, plus car park entrances. Aim for image quality that identifies people entering, with good lighting and visible signage. Some institutions specify 246 pixels per metre at main entries as a benchmark.

Do lobby cameras raise privacy issues?

Yes. Footage of a person is generally personal information, so you should have a clear purpose, signage and sensible settings, such as disabling audio where it is not needed. Rules vary by state and territory, so get legal advice for your jurisdiction.

How does lobby design differ for a hospital and an office?

Hospitals need sightlines to waiting areas, no entrapment points and duress alarms because of aggression risk. Offices focus on stopping tailgating and controlling movement from the lobby to tenant floors. Both start from a risk assessment.

Sources

• Australasian Health Facility Guidelines, Front of House Unit
• Australasian Health Facility Guidelines, Part C
• NSW Planning Portal CPTED document
• ANU Security, CCTV and Access Control guideline
• RMIT 2025 Design Standards
• JCU Building Security guideline
• South Australian Government PHYSEC1 Physical security
• WA Safer Places by Design CPTED Guidelines
• University of Sydney Security Services Standard
• Curtin Security Infrastructure Design Guideline
• Agilient Physical and Facility Security
• ACT Government CCTV Policy 2025
• Sprintlaw, Security Camera Laws for Businesses in Australia

Recommended

• People First: Australian Security Control Room Design, AS 2201.2
• Security by Design: Australian Business Guide
• Access Control Policies for Australian Facility Managers
• 9 Physical Security Best Practices for Australian Sites