A security incident does not end when the immediate disruption stops. For a Manhattan office building, residential property, hotel, retail location, or construction site, the next several minutes and hours can affect occupant safety, evidence preservation, business continuity, and the likelihood of a repeat event.
An effective security incident response should be calm, organized, and proportional to the situation. The exact steps will vary, but property teams can use the following framework to establish priorities and reduce avoidable confusion.
1. Protect People and Address Immediate Hazards
Life safety comes first. Security personnel and property staff should quickly determine whether anyone is injured, threatened, trapped, or exposed to an ongoing hazard.
Immediate actions may include:
- Calling 911 when police, fire, or emergency medical assistance is needed
- Following the building’s emergency procedures
- Moving occupants away from an unsafe area when appropriate
- Restricting access to a hazardous or disturbed location
- Providing first aid only within the responder’s training
- Giving arriving emergency personnel clear directions and access
Security staff should not take unnecessary risks, pursue individuals beyond their training or assignment, or disturb a scene simply to restore normal operations faster.
Stabilize the property without creating new risks
In a high-rise or multi-tenant building, an incident can affect elevators, loading docks, lobby access, deliveries, and tenant movement. Management should identify which operations can continue safely and which need temporary restrictions.
A designated supervisor should coordinate decisions so that guards, building engineers, reception staff, and vendors do not receive conflicting instructions.
2. Notify the Right People
Once urgent needs are addressed, follow the property’s notification plan. Depending on the incident, the response group may include:
- Property or facility management
- Building ownership or asset management
- The security account manager or guard supervisor
- Corporate security, human resources, or risk management
- Building engineering or fire-life-safety personnel
- Legal counsel or the property’s insurance contact
- Affected tenants, residents, guests, or vendors
Notifications should be factual. Avoid speculation, blame, or unverified descriptions of people and events. When communicating broadly, share only the information recipients need to protect themselves or adjust operations.
3. Preserve the Scene and Relevant Records
Incident scenes and digital records can change quickly. A well-intentioned cleanup, equipment reset, or camera-system delay may remove information needed for an internal review, insurance matter, or law-enforcement investigation.
Protect physical evidence
When it is safe and permitted by responding authorities:
- Limit unnecessary entry to the affected area
- Record who enters and why
- Avoid moving objects unless needed to protect life or prevent further damage
- Photograph property conditions according to company policy
- Retain access cards, visitor records, keys, or found items securely
If police or fire personnel take control of an area, property staff should follow their directions about access and preservation.
Secure video and electronic records promptly
Relevant materials may include:
- Security camera footage
- Access-control activity
- Visitor-management records
- Intercom or elevator-call data
- Alarm notifications
- Guard tour and dispatch records
- Relevant emails, messages, or work orders
Some systems overwrite data automatically. Authorized personnel should identify potentially relevant time windows and preserve records in their original quality as soon as practical. Keep a record of who collected, copied, transferred, or received each item.
4. Create a Clear Incident Report
A useful incident report is chronological, objective, and specific. It should distinguish what the writer personally observed from what another person reported.
At minimum, document:
- Date, time, and exact location
- How and when the incident was discovered
- Names and roles of responding personnel
- Observable conditions and actions
- Emergency calls and agency response
- Notifications made to management
- Injuries or property damage that were reported or observed
- Access restrictions or operational changes
- Video, photos, logs, or physical items preserved
- The status of the location when responsibility was transferred or normal operations resumed
Use direct quotations only when they are important and can be recorded accurately. Avoid conclusions about motive, fault, medical condition, or criminal conduct unless confirmed by an appropriate authority.
5. Maintain Safe Operations After the Incident
A serious incident may expose a temporary security gap. A broken entrance, damaged lock, disabled camera, staffing shortage, or restricted lobby can leave the property vulnerable after emergency responders depart.
Property management should conduct a short-term coverage assessment:
| Question | Possible response |
|---|---|
| Is an entrance, gate, or loading area unsecured? | Post a trained guard and arrange priority repairs. |
| Is access control or video surveillance unavailable? | Use manual sign-in, controlled entry, and documented patrols. |
| Are tenants or residents likely to gather near the scene? | Establish a safe perimeter and provide clear directions. |
| Will the incident affect overnight operations? | Confirm relief staffing, supervisor check-ins, and written post orders. |
| Is there a credible concern about recurrence? | Coordinate with management, law enforcement, and security leadership on proportionate measures. |
When existing staffing is not enough, emergency security coverage can help maintain access control, lobby presence, patrols, or a fixed post while repairs and reviews are underway. Properties evaluating longer-term support can also review Guardian’s security guard services.
6. Conduct a Structured After-Action Review
An after-action review is not simply a search for mistakes. Its purpose is to understand what happened, what worked, where the response slowed down, and what should change.
Hold the review after immediate facts and records have been gathered. Include the people who managed the incident, not only senior leadership.
Questions worth asking
- How was the incident detected?
- Did staff know who was in charge?
- Were emergency services contacted without delay?
- Did responders have access to keys, floor plans, or contact lists?
- Were post orders and escalation procedures clear?
- Did cameras and access-control systems provide usable information?
- Were tenant or occupant communications timely and accurate?
- Was additional coverage arranged when needed?
- Which corrective actions have an owner and completion date?
The review should produce a short action plan. Assign each task to a named role, set a target date, and verify completion rather than allowing recommendations to remain open indefinitely.
7. Improve the Response Plan Before the Next Incident
Incident response improves through preparation. Properties should periodically review emergency contacts, escalation criteria, guard post orders, camera coverage, record-retention settings, key control, and vendor response procedures.
Tabletop exercises can also reveal practical problems without disrupting the building. A property team might walk through scenarios such as an unauthorized person in a tenant area, an assault in the lobby, overnight vandalism, a loading-dock theft, or a disabled access-control system.
For office buildings, a coordinated approach should connect security operations with tenant needs, visitor processing, and building management. Learn more about commercial office security in New York City.
A Practical Post-Incident Checklist
Immediately after an incident, confirm that the team has:
- Protected life and contacted emergency services when necessary
- Stabilized the affected area
- Established one response coordinator
- Made required internal notifications
- Preserved relevant video, access, visitor, and alarm records
- Completed objective incident reports
- Documented temporary security vulnerabilities
- Arranged repairs or supplemental staffing
- Scheduled an after-action review
- Assigned and tracked corrective measures
Strengthen Your Property’s Security Response
Guardian ISI can help Manhattan property teams evaluate guard coverage, post-incident vulnerabilities, and temporary or ongoing security needs.
Call or text [(212) 602-1695](tel:+12126021695) or request coverage online. For general questions, you can also contact Guardian ISI.
Related Guardian services
Review Emergency Security Coverage when an incident creates a temporary staffing need. Security Guard Services covers the ongoing personnel and reporting requirements to discuss with Guardian.
Frequently asked questions
What is the first priority after a security incident?
Protect people and address immediate hazards. Call 911 when police, fire, or emergency medical assistance is needed, follow the property’s emergency procedures, and keep occupants away from unsafe areas.
Who should take charge of the response?
The property’s designated incident coordinator or senior on-site manager should coordinate the response until emergency authorities assume control. Staff should follow the building’s escalation plan and avoid issuing conflicting instructions.
How quickly should security video be preserved?
As soon as practical after urgent safety needs are handled. Many systems overwrite footage automatically, so authorized personnel should identify the relevant cameras and time periods promptly while preserving the original quality.
What should a security incident report include?
Include the date, time, location, observable facts, actions taken, emergency calls, notifications, reported injuries or damage, records preserved, and the final status of the area. Separate personal observations from information provided by others.
When is temporary security coverage appropriate?
Temporary coverage may be appropriate when an entrance cannot be secured, security technology is unavailable, a scene requires access control, regular staffing is disrupted, or management identifies a credible short-term vulnerability.
What should happen during an after-action review?
The team should examine detection, communication, command, emergency response, technology, staffing, and occupant communication. The review should end with assigned corrective actions, target dates, and a process for confirming completion.