Office Security Assessment Checklist for Ottawa & Eastern Ontario

Commercial office buildings present a different security problem than warehouses or retail sites. Tenants share a perimeter, visitors and couriers flow through reception during business hours, IT and server rooms sit behind ordinary office doors, and after-hours risk shifts from theft of inventory to credential abuse, lobby intrusion, and unauthorized building entry. An office security assessment is the discipline of working through that environment systematically — lobby, tenant suite, IT room, common area — and identifying where the existing system is doing its job and where it isn’t.

This checklist reflects what Family Security looks at during a commercial office security assessment in Ottawa or Eastern Ontario. It’s the same field framework we use whether the building is a single-tenant headquarters off March Road, a 12-floor multi-tenant tower downtown, or a professional services suite in Kanata. Property managers, facilities leads, IT and security teams, and tenant decision-makers can use it as a self-audit, an RFP input, or a procurement scoping document for an office security upgrade.

Why Commercial Office Security Is Different

Three operational realities make office security distinct from generic commercial security work:

• Daytime traffic is open by design. Reception, lobbies, elevator banks, and shared common areas are intentionally permeable during business hours. Most office security incidents happen during that permeable window, not against a hardened after-hours perimeter — tailgating, social-engineered visitor entry, after-meeting exits left unlocked.
• The high-value assets are credentials and data, not inventory. Server rooms, IDF and MDF closets, executive areas, and unattended workstations all carry exposure that doesn’t show up on a property-loss spreadsheet. A breach of a wiring closet or an executive office can cost more than a forklift’s worth of warehouse goods.
• Multi-tenant complexity is the norm. Most commercial offices in Ottawa share a building lobby, elevator core, parking garage, and after-hours entrance with other tenants. Access control has to respect that boundary while still letting the building operator manage common areas.

An office security assessment is the structured way to evaluate whether your existing system answers those three problems, where the gaps are, and what an upgrade or remediation path looks like.

How We Assess an Office Security Posture

The site review follows eight areas, in this order. The order matters — lobby and visitor flow shape what tenant-suite access control needs to do, and IT-infrastructure exposure shapes what gets prioritized after that.

1. Reception, Lobby & Visitor Flow

• Reception sight lines: can the reception desk actually see the main entry, the elevator bank, and the visitor seating area
• Visitor management procedure: sign-in, identification check, escort policy, badge issuance and retrieval
• Lobby turnstile or speed-gate enforcement, where present, and bypass behaviour during peak traffic
• Courier and delivery handling — where parcels are received and who has accountability
• Lobby camera coverage with identification-grade angles on the main entry and reception desk
• After-hours lobby lock-down and re-entry procedure for staff returning late

A common finding: cameras covering the lobby ceiling but not capturing a usable face shot at the reception desk. By the time a subject has been escorted to a suite, the relevant identification evidence has already happened — and wasn’t recorded.

2. Tenant Suite Access & Multi-Tenant Considerations

• Suite entry door hardware, locking, and request-to-exit behaviour
• Credential type and credential management for the tenant footprint (cards, fobs, mobile, PIN)
• Access groups: who can enter what suite, what floor, what shared meeting space, at what time
• Boundary between landlord-managed common areas and tenant-managed suite interior
• Tailgating risk at tenant entry — particularly on floors shared by multiple tenants
• Integration between tenant access control and base-building access control, where they coexist

We typically recommend platforms with mature audit and reporting depth for office environments. Kantech and Lenel are the two access control systems we deploy most often in commercial office environments across Ottawa and Eastern Ontario, including multi-tenant and single-tenant deployments.

3. After-Hours Building Access

• After-hours entrance designation: which door is the legitimate after-hours route, and is everything else hard-locked
• Intercom and remote-unlock procedure for off-hours visitors, contractors, and cleaning crews
• Cleaner and contractor credentialing — temporary cards, supervised access, audit trail
• Stairwell re-entry rules across floors, especially in multi-tenant buildings
• Loading dock and freight elevator access outside business hours
• After-hours alarm partitioning so individual tenants can arm independently

After-hours office breaches almost always involve a legitimate-looking entry path that was never tightened — a propped stairwell door, a freight elevator with no after-hours access control, a cleaning crew with a master credential that hasn’t been reviewed in three years.

4. Server Rooms, IDF/MDF Closets & IT Infrastructure

• Dedicated access control on every server room, IDF closet, and MDF room — not shared with general office access
• Door position switches and forced-door alarming on IT-critical rooms
• Camera coverage of server room entry with identification-grade angle
• Environmental monitoring integration: temperature, humidity, water sensors tied to the security platform where possible
• Restricted access group: named individuals, not a generic “IT” credential pool
• Audit trail for every IT-room entry, retained for a defensible window

The IT room is the highest-consequence interior space in most office environments. A credential audit trail on the server room door is one of the few security controls that an insurance carrier, a compliance auditor, and an incident-response team all want to see in the same format.

5. Executive Areas & Restricted Zones

• Executive suite and boardroom access control, separate from general office floor
• Records rooms, HR file storage, and any physical document repositories
• Finance and treasury area access restrictions
• R&D, lab, or restricted-program spaces where present
• Visitor escort policy into restricted zones
• Camera coverage limited to corridors and entry points, not interior of executive offices (privacy boundary)

Executive and restricted zones are the areas where a single access-control mistake produces the largest downstream consequence — a stale credential on the boardroom door, a records room sharing access with the kitchen, a finance suite that any general-office cardholder can walk into after hours. The remediation is rarely expensive; it almost always requires a deliberate access-group review against the actual organizational chart and a documented escort policy for non-staff entry.

6. Video Coverage of Common Areas, Elevators & Stairwells

• Camera count and field-of-view by zone (lobby, elevator cab, elevator lobby per floor, stairwell entries, parking garage, loading area)
• Identification-grade vs detection-grade coverage at critical points (main entry, after-hours door, IT room corridor)
• Resolution and frame rate against incident-review requirements
• Retention policy and storage sizing — 7-day minimum baseline, 30-day common in commercial office, 90-day for regulated tenants
• Low-light performance, especially in parking garages, after-hours lobbies, and back-of-house corridors
• Remote viewing access for facilities and after-hours response
• Recording redundancy and storage protection from tampering

A camera that doesn’t deliver an identification-grade image at the point a security incident happens is documentation, not security. Coverage planning, resolution selection, and retention sizing are evaluated together as part of any commercial security camera system review.

7. Privacy, Compliance & NDAA Considerations

• Equipment provenance for cameras, recorders, and access control hardware
• NDAA Section 889 compliance for offices serving federal customers, federal-adjacent contracts, or sub-tier suppliers
• Privacy-sensitive coverage areas (washrooms, lactation rooms, wellness rooms, individual private offices) properly excluded
• Data retention policies aligned with PIPEDA, sector regulations, or insurance requirements
• Cyber posture of recorders and access platforms — default credentials, firmware currency, network segmentation from corporate LAN
• Documented retention, access, and disclosure policy for video and access-log data

Office compliance reviews more often catch equipment lineage and privacy boundary problems than coverage problems. Older deployments installed before NDAA awareness frequently include hardware that now needs replacement to serve federal-adjacent customers — see our NDAA-compliant security systems overview for the equipment-eligibility detail.

8. Maintenance & Lifecycle Readiness

• Documentation: as-built drawings, cable maps, credential databases, system passwords, contact-state baselines
• Spare parts inventory for critical components
• Firmware update cadence and process
• End-of-life status for cameras, recorders, panels, and access control hardware
• Service-agreement coverage, response-time commitments, and historical service record
• Credential database hygiene — quarterly review of active cards against actual staff roster

Most office security systems in operation today are five-to-ten years past their original commissioning. Coverage and access groups were designed for the floor plan and headcount as they existed at install — not the open-plan reconfiguration, the new boardroom build-out, or the IT room that moved one floor up during a tenant improvement. Ongoing security system maintenance is what keeps the original engineering valid as the office changes.

Common Findings in Ottawa Office Security Reviews

Across the office and professional-services sites we assess in Ottawa and Eastern Ontario, the same categories of finding come up repeatedly:

• Lobby cameras covering the room but not capturing a usable face shot at the reception desk
• Tailgating tolerated at suite entries because there’s no enforcement model
• Server room and IDF closets opened with the same general-office credential as the kitchen
• After-hours entrance not actually hard-locked — propped stairwell or freight elevator route still available
• Access control with stale credential lists (former employees and former cleaning-crew staff still active)
• Camera retention shorter than the incident-review window the operator actually needs
• Cameras procured during the 2018-2020 buying wave that now fall outside NDAA-eligible equipment lists
• Access platforms left on default administrator credentials
• No documented privacy boundary on camera placement — washrooms, wellness rooms, or individual offices captured by accident

None of these are exotic problems. They are the consequences of systems that were correctly designed at install time and then drifted from the operational reality of the office. Reception staff changed, the IT team moved its primary closet to a different floor, the cleaning contractor rotated companies twice, a tenant moved out and another moved in — each of those events should have triggered a credential and coverage review, and most of the time none of them did.

The other repeating pattern: office security upgrades that addressed a single problem (a stolen-laptop incident, an after-hours intrusion attempt, an HR investigation) without ever stepping back to look at the system as a whole. Patchwork fixes accumulate. A full office security assessment is how that drift gets caught and corrected before the next incident forces the conversation.

When to Schedule an Office Security Assessment

A site review is most useful in any of these situations:

• Tenant improvement, office reconfiguration, or floor expansion
• Tenant change or operational handover in a multi-tenant building
• Move into a new commercial office or headquarters
• Insurance review or carrier requirement
• Post-incident remediation (intrusion, credential abuse, lost-device exposure)
• Procurement preparation for a security system upgrade
• NDAA or federal-supplier compliance review
• Annual operational review, especially for systems older than five years

The output is a documented set of findings, prioritized remediation recommendations, and — where the operator wants it — a scoped upgrade or maintenance path. Industry data from Statistics Canada on commercial property crime consistently shows that lobby intrusion and after-hours unauthorized entry account for a large share of commercial office incidents — which is exactly why the assessment starts at reception and visitor flow.

Next Step

Family Security is a commercial security integrator serving Ottawa and Eastern Ontario, with deep field experience in office, headquarters, professional services, and multi-tenant environments. We design, install, and maintain access control, video surveillance, intrusion detection, and integrated commercial security systems — including NDAA-compliant deployments for federal-adjacent tenants.

If you operate or manage a commercial office, headquarters, or professional services suite in Ottawa or Eastern Ontario and want a structured review of your current security posture, request a commercial security site review.