For power outage security, map the whole protection chain and agree how the site will operate safely while each part is unavailable. Start with the services you need to preserve, then verify their actual power and communications dependencies.
A battery attached to one device does not establish that the complete service survives. A camera may remain powered while its recorder, network connection or operator display stops. An access controller may operate locally while changes from the central system cannot reach it.
This is a planning method for security and facilities managers. Electrical design, life-safety systems and changes to locking behaviour require the responsible qualified specialists. Do not interrupt a live supply as an informal security test.
Describe the service you need
Replace “the access system has backup power” with an operational requirement. For example: “During the agreed outage condition, authorised staff can use the designated entrance, unauthorised entry remains controlled, and emergency egress operates as designed.”
That statement exposes questions a device inventory misses. Who will operate the entrance? How will they know access is authorised? What happens if the system cannot update permissions? Which emergency arrangements take precedence?
For surveillance, define whether you need local recording, live observation, remote alarm verification or later export. Those functions may have different dependencies. Decide which are essential during the outage and which can be temporarily unavailable without an unacceptable consequence.
Trace power and communications separately
Ask facilities, IT and the service provider to identify the components supporting each essential function. Include network equipment, communications services, monitoring connections, clocks and interfaces where relevant.
Record what is known from documentation, what has been demonstrated and what remains assumed. “Connected to UPS” is a configuration claim. “Supported the agreed load for the witnessed test duration” is evidence with a defined limit. Neither proves indefinite operation.
The NPSA's automatic access-control guidance, published with a 2017 copyright date, links backup duration to the operational requirement and discusses testing the integrated system. Those planning principles remain useful; use current manufacturer instructions and local technical requirements for your installation.
Check shared dependencies. Two alarm paths are not independent if the same local network device is required for both. Record that relationship without publishing sensitive configuration details in general staff material.
Set an operating limit
Agree how long the organisation needs to maintain each function and what will happen if that period is exceeded. The answer should reflect consequences, staffing, restoration options and the reliability of supporting services.
Do not choose a duration solely because a supplier's brochure quotes it. Ask what load, battery condition, temperature and test conditions the figure assumes. Let the competent specialist determine the appropriate technical verification and maintenance regime.
A degraded operating limit might require closing a particular work area, stopping new deliveries or moving to an approved staffed entrance. Define who can make that decision and what evidence prompts it. A manager should not need to invent the operating boundary during an outage.
Worked example: keeping an office controlled
A fictional professional-services office needs staff to leave safely and essential staff to enter through a controlled route. Its planning team identifies the following gaps. The entries are illustrative, not design specifications.
| Required function | Unresolved dependency | Agreed planning action |
|---|---|---|
| Controlled staff entry | Local controller behaviour has not been demonstrated during a supply failure | Provider and facilities arrange an authorised test against the approved requirement |
| Alarm notification | Router backup is undocumented | IT confirms supply arrangements and tests notification with the monitoring provider |
| Reception decision-making | The contact list is available only on the normal network | Security provides a controlled, accessible fallback copy and confirms contactability |
| Return to ordinary operation | Nobody owns the restart check | Facilities coordinates restoration; security verifies relevant control functions before stand-down |
The team does not mark the outage risk treated when the documentation arrives. It records whether the tests support the intended operating limit and what temporary arrangements remain necessary.
Plan the human fallback
A manual arrangement needs people, information, communications and safe working conditions. It cannot be treated as free spare capacity.
If staff will check access manually, specify who authorises entry, what evidence they use and how they record exceptions. Ensure the arrangement respects emergency egress, accessibility and the site's incident procedures. Do not improvise barriers or lock people inside to preserve security.
Check whether the same staff are already assigned evacuation, welfare or facilities tasks. One person cannot simultaneously supervise an entrance, investigate an alarm and manage a building evacuation. Resolve competing assignments before counting the fallback as available.
Give the temporary arrangement a start condition, review point and end condition. Record the person currently responsible so responsibility does not disappear when shifts change.
Exercise failure and recovery
Begin with a tabletop discussion if the dependencies are uncertain. A technical test should follow an approved plan with competent staff, notifications, stop conditions and a recovery method. Coordinate with monitoring providers and other affected occupants.
Test restoration as well as failure. Check that expected permissions, recordings, notifications and time settings behave correctly after the systems return. A powered device is not necessarily a restored service. Confirm the agreed end-to-end function before declaring the relevant control restored.
Record any manual transactions or temporary permissions that need reconciliation. Close temporary access arrangements deliberately; do not leave them active because the outage has ended and attention has moved elsewhere.
Keep the report specific. State which functions and conditions were tested, what was observed and what was not tested. An exercise involving one entrance cannot establish resilience across an entire estate.
Record degraded-operation responsibilities in the security plan, and distinguish expected benefit from verified risk after treatment.
Your next action
Select one essential security function and hold a short dependency review with its operator, facilities owner and technical provider. Resolve the largest unsupported assumption before buying more backup equipment.
The paid SRMBOK Physical Security Risk Assessment Tool helps record the outage scenario, current controls, shared dependencies and corrective actions. Use the treatment and review fields to keep temporary arrangements visible until the required service has been demonstrated.