Small Business Physical Security Checklist: Locks, Cameras and Access

What to take away

This small business physical security checklist focuses on the physical layer of cybersecurity: limiting who can reach devices, network equipment, and records. With no security budget and one person to do the work, spend the first hours on doors, keys, and lighting. Those are the cheapest controls that still change an intruder's odds.
A camera system is ruled out at this level. A four-camera setup with recording runs roughly $600 to $2,500 installed, and the footage rarely prevents entry.
A written key log, a rekey of exterior doors, and a closing routine cover most small offices at near zero cost.
Stop the do-it-yourself approach when a single site holds more than about $25,000 in replaceable equipment, cash, or regulated records.
Local police departments in most U.S. cities offer free site surveys. Ask before you buy anything.

What the constraint removes

The limit here is concrete. One person, no security line item, and a site that still has to open on Monday. That rules out guard services, monitored alarm contracts above roughly $40 a month, and any camera installation with a maintenance agreement.

It also rules out the assumption that a camera deters. Most break-ins at small commercial sites happen in under five minutes, and a camera records the event rather than stopping it. For a one-person operation, footage is evidence after a loss, not prevention before one.

Physical controls support cybersecurity by limiting who can reach computers, network equipment, and records. What remains is the set of controls that cost time instead of money: locks, lighting, sightlines, routines, and relationships with the people who already patrol your block.

What still works on no budget

Start with the exterior. Walk the building at night, the way an intruder would. Note which doors sit in shadow, which windows face an unlit alley, and which side entrance is propped for smokers.

Crime prevention through environmental design, usually shortened to CPTED, is the framework behind this. It holds that lighting, sightlines and territorial cues change behavior before anyone arrives. Many U.S. police departments publish CPTED guidance and will send an officer to walk your site.

Use this checklist to protect both the site and the devices, network equipment, and records inside it:

Walk the building at night. Note shadowed doors, unlit approaches, and side entrances that are left propped open.
Keep exterior doors locked, rekey them as needed, and maintain a written log of keyholders.
Keep lighting and sightlines clear around entrances.
Secure computers, network equipment, and backup media when they are not in use; limit physical access to people who need it.
Give each worker an individual digital account, and remove access when they leave or change roles.
If you install a camera, place it at the main entrance, use local storage, and assign someone to check recordings weekly.
Keep alarm codes away from the panel, and do not let delivery routines leave doors propped open.

No-Budget Exterior Security Steps

Rekey every exterior door, collect old keys
Number keys and log each holder
Move valuable stock from doors and windows
Add motion lights at entrances and loading area
Trim shrubs below window height

A simple key log is the highest-value document you will produce. It answers the question every insurer asks after a theft: who could have walked in.

A door that stays locked, a light that stays on, and a list of who holds a key will outperform a camera you cannot afford to monitor.

Compromises worth making

Some paid steps earn their place even under a tight limit. A deadbolt upgrade on a rear door costs $40 to $120 per door and takes an hour. A keypad lock on one entrance runs $100 to $250 and removes the shared-key problem entirely.

Cost of Paid Upgrades

Deadbolt upgrade per door$40
Keypad lock on one entrance$100
Single camera with memory card$80

If you must buy one camera, buy one at the main entrance with local storage, not a cloud subscription. A single unit with a memory card costs $80 to $200. It will not cover the building, and it will cover the door people actually use.

For cybersecurity, physical keys and keypad codes do not replace digital identity controls. Give each worker an individual account, remove access when a role ends, and compare local accounts, single sign-on, and full provisioning before connecting a keypad to a network. Identity and access, compared lays out those digital choices side by side.

The FTC's guidance on starting with security treats physical access as part of the same problem as digital access, which is the right frame for a small site.

Compromises that are not

Do not buy a camera system you cannot review. Unmonitored footage is a storage bill and a false sense of coverage. If nobody watches the feed or checks the recordings weekly, the money is gone.

Do not accept a shared master key for a multi-tenant building. Do not let a landlord hold the only copy of your suite key. Do not leave the alarm code written near the panel.

Do not treat a locked front door as coverage for a back door that delivery drivers prop open. That single habit defeats every other control on this page, and it stays invisible until something goes missing.

Example

A two-room insurance office in a mid-size U.S. city had one employee, a rear alley door and a shared hallway. The owner spent $180 on two deadbolts, $90 on motion lights and nothing on cameras. A police CPTED walkthrough flagged the alley door as the only unlit entrance.

Six months later a break-in attempt at that door failed. The owner's total outlay stayed under $300, and the key log named the two people holding keys.

When to stop and resource it properly

Set a threshold now, in writing, so the decision is not made in a panic. When one site holds more than about $25,000 in equipment, cash or regulated records, the workaround stops paying. At that point, price a monitored alarm and a proper camera system.

When to Resource Security Properly

More than $25,000 in equipment, cash or records?

Yes

price monitored alarm and camera system

keep no-budget controls running

A second trigger is headcount. Past roughly ten employees, a manual key log breaks down and you need real access control with audit trails. The SBA's cybersecurity guide for small businesses covers offboarding, which is where physical and digital access meet.

A third trigger is a lease change, a remodel or a new location. Those are the moments when a security line item is easiest to justify and cheapest to install.

Common questions

How much does a basic business camera system cost?

A four-camera setup with recording typically runs $600 to $2,500 installed in the U.S., depending on wiring and whether you pay for cloud storage. That range is illustrative, not a quote.

Can local police help with office physical security?

Yes. Many U.S. departments offer free CPTED surveys and will walk the property with you. Call the non-emergency line and ask for the crime prevention officer.

What is the single most useful physical security control for a small office?

A key log combined with rekeyed exterior doors. It costs almost nothing, and it answers the first question asked after any loss.

When should a small business stop doing this itself?

When one site holds more than about $25,000 in valuables, or when headcount passes roughly ten. Below those lines, locks, lighting and routines carry most of the weight.