Home Security · Service

Commercial security installation — built around who has access, and for how long

A business system is judged on whether credentials can be revoked the same day someone leaves, whether footage still exists when it is asked for, and whether the access log stands up when somebody disputes it.

Compare plans All home security services

In short

What is commercial security installation?

Commercial security installation covers intrusion detection, video and electronic access control across a business premises, specified around operational reality rather than a device count. The three requirements that shape the system are who may enter where and when, how long recordings must be kept, and how quickly access can be withdrawn when a person leaves. Everything else follows from those.

Triggers

Signs you need commercial security installation

Keys are still the access method, and nobody can say with confidence how many are in circulation
Staff turnover means access is granted regularly and withdrawn rarely
An insurer, franchisor or regulator has asked what system is fitted and how long footage is retained
You have taken on a second or third site and each one is administered separately by whoever is on shift
Contractors, cleaners or delivery drivers need after-hours entry and there is no record of when they come and go
An incident has been disputed by a member of staff and no usable record existed to settle it
Areas with genuinely different risk — a stockroom, a server room, a cash office, a plant area — currently sit behind the same lock as everything else
You are fitting out new premises and the security specification has not yet been written

Seeing something not on this list? Browse home security problems by symptom →

The job

How commercial security installation actually works

Defining zones by who belongs there, not by floor plan

The specification starts with a matrix of roles against areas and hours: which groups may enter which spaces, at what times, and under what conditions. Stock, cash handling, records, plant and IT rooms usually warrant separate treatment from general workspace. This document, not the site drawing, drives the device list.

Watch for: A design produced from a floor plan alone. Without the roles-and-hours matrix the system will need reworking within months of going live, and reworking access control on an occupied site is disruptive.
Credential strategy and the revocation process

Credentials — cards, fobs, PINs or mobile — are only as good as the process that removes them. The system should allow a single named credential to be revoked immediately, across every door and every site, by an administrator who is available when a departure happens. Tie that step formally to your offboarding checklist rather than leaving it to memory.

Watch for: Shared or group credentials issued for convenience. They defeat the audit trail entirely and mean a single departure requires re-crediting everybody who shared it.
Access control hardware, egress and fire interface

Electrically controlled doors introduce requirements that a residential lock does not: fail-safe versus fail-secure behaviour on power loss, compliant free egress from the inside, and release on a fire alarm signal where the fire strategy requires it. These are code-governed, they are enforced by inspection, and they are decided by your local authority and fire officer rather than by preference.

Watch for: Any proposal that makes leaving harder than entering. Egress requirements are not negotiable and retrofitting compliance after an inspection failure costs more than specifying it correctly.
Video coverage against the questions you will actually be asked

Commercial video is specified around identifiable evidence at defined points: entrances, tills or cash handling, stock movement, loading areas, and the boundary between public and staff-only space. Coverage that produces a shape in a corridor answers nothing when an incident is investigated months later.

Watch for: Camera counts quoted without stating what each camera is expected to establish. Ask for the intended purpose and expected identification quality per position, in writing.
Retention, and who is entitled to what

How long footage is kept may be your choice, or it may be set by an insurer, a franchise agreement, a licensing condition or sector regulation. Retention interacts with privacy obligations in the other direction: recording staff and customers carries duties around notification, access requests and how long material may be held. Both directions need answering before the recorder is sized.

Watch for: A retention figure quoted without resolution, frame rate and continuous-versus-motion assumptions. Change any of those and the number is no longer true.
Monitoring, response and after-hours procedure

Commercial response involves more parties than a residential one: a central station, a documented keyholder list, sometimes a guarding provider, and an agreed escalation for out-of-hours activations. Alarm ordinances and false-alarm rules apply to business premises too, often with less patience than residential.

Watch for: A keyholder list that has not been reviewed since installation. It is the most consistently out-of-date document in commercial security, and it is discovered at three in the morning.
Multi-site administration

Once there is more than one site, the question becomes whether they are administered as one estate or as separate systems that happen to share a supplier. Centralised administration means one credential per person across all locations, one revocation, and consistent reporting. Separate systems mean a person leaving requires an action at each site, and someone remembering to take it.

Watch for: Different platforms accumulating across sites through acquisition or local purchasing decisions. Consolidating later is expensive; specifying for it at the second site is not.
Handover, documentation and administrator training

Commissioning should produce more than a working system: an as-built device schedule, the roles-and-hours matrix as configured, named administrators with their own accounts, a documented procedure for issuing and revoking credentials, and a tested export process for producing footage to a third party.

Watch for: A single administrator account shared by the management team. It removes accountability for access changes, and it becomes unusable the moment that person leaves.

Money

What does commercial security installation cost?

Commercial systems are priced per site from a specification rather than from a package, and a multi-door access system with video runs well beyond residential equipment. Monitoring and any software or storage subscription are recurring. Ask for hardware, labour, monitoring and licensing quoted as separate lines.

See the full commercial security installation cost guide — by material, size and region →

Straight answer

When commercial security installation is the wrong call

Everyone else ranking for this is paid when you say yes. Here's when you shouldn't.

The roles-and-hours matrix does not exist yet. Buying access control before deciding who may go where is how businesses end up with an expensive system administered as one universal credential. Write the matrix first; it costs nothing.
Nobody owns administration. Credential issuing and revocation is a recurring operational duty, not a one-off installation task. Without a named owner and a place in the offboarding process, access accumulates and the audit trail becomes indefensible.
You are in short-term or shared premises. Landlord consent, shared entrances and common areas limit what may be fitted and who may be recorded. Establish what the lease and the building management permit before specifying anything fixed.
You have not confirmed what your insurer or regulator actually requires. Specifying a system and then discovering the required retention period, alarm grade or monitoring arrangement differs means paying twice. Get the requirement in writing first.
The obligations that come with recording staff have not been considered. Notification, lawful basis, access requests and retention limits apply to employee footage in most jurisdictions. If nobody has looked into this, resolve it before cameras go up rather than after a complaint.
The real exposure is procedural rather than physical. Cash handling, stock reconciliation, contractor supervision and key control are process problems. A system records what happens; it does not substitute for controls that stop it happening.

Your options

Types of commercial security installation

Compare commercial approaches

Integrator-delivered systems, monitored dealer offerings and self-administered platforms.

Access control and video equipment

Controllers, readers, credentials, recorders and storage.

Insurance requirements

What insurers commonly specify for commercial premises.

Permits and alarm ordinances

Registration and false-alarm rules applied to business premises.

Compare home security options side by side →

Before you sign

What to check when hiring for commercial security installation

How quickly can a single named credential be revoked across every door and every site?

The operational test that matters most. If the answer involves visiting sites or contacting the installer, the system will not keep up with your turnover.
Who will hold administrator accounts, and does each one have their own?

Shared administrator logins destroy accountability for access changes and become a problem the day that person leaves.
What retention does this design deliver, at what resolution and under what recording mode?

Retention quoted without those three variables is not a specification. Insurers and regulators ask about the real figure, not the brochure one.
What does each camera position establish, and to what identification standard?

Commits the designer to a purpose per camera and gives you something to hold them to at commissioning.
How do the access-controlled doors behave on power failure and on a fire alarm?

Fail-safe versus fail-secure and egress compliance are code matters, not preferences, and they are checked at inspection.
Can we export footage in a format a third party can open, and who is authorised to do it?

Evidence trapped in a proprietary viewer is of limited use to an insurer, an investigator or a tribunal. Test the process at handover.
If we add a site next year, does it join this platform or become a separate system?

The answer decides whether administration stays central or fragments. It is far cheaper to specify at the second site than to consolidate at the fifth.
What are we licensing, and what stops working if we stop paying for it?

Commercial platforms increasingly carry software and storage subscriptions distinct from monitoring. Establish which functions depend on which.

All home security hiring checklists →

Local pros

Commercial Security Installation near you

Local pro matching for commercial security installation is rolling out by metro. Enter your ZIP and we'll match you with vetted pros in your area today.

Related work

Often done at the same time

Access Control and Smart Locks

Door hardware and credential basics

Security Camera Installation

Coverage design and storage

Alarm Monitoring Setup

Monitoring agreements and response

Security System Takeover

Inheriting a system at new premises

All home security services →

FAQ

Commercial Security Installation — questions people ask

Still have a question? Talk to our team →

How is a commercial security system different from a residential one?

The devices overlap; the requirements do not. A business system is specified around people who change — staff, contractors, cleaners, delivery drivers — so credential administration and revocation become continuous operational work rather than a setup task. It also has to satisfy obligations that a home does not: insurer or regulator retention requirements, code-governed egress and fire interface on controlled doors, and duties around recording employees. Documentation and administrator accountability matter as much as the hardware.

How long should we keep CCTV footage at a business premises?

Start with what is imposed on you rather than what feels sensible. Insurers, franchise agreements, licensing conditions and sector regulation each commonly specify a minimum, and where one applies it sets the floor. Pulling in the other direction, privacy obligations in most jurisdictions expect footage not to be kept longer than necessary for a stated purpose. Get the binding requirements in writing before sizing storage, and note that any retention figure is only meaningful alongside the resolution and recording mode it assumes.

What happens to a departing employee's access?

It should be revocable immediately, by a named administrator, across every door and every site, and the step should sit inside your offboarding checklist rather than depending on someone remembering. This is the strongest practical argument for electronic credentials over keys: a key handed back cannot be proven not to have been copied, whereas a revoked credential is verifiably dead. Individually issued credentials are essential — shared codes or group fobs mean one departure requires re-crediting everyone.

Do we need professional monitoring for a commercial premises?

It depends less on preference than on obligation. Insurers frequently require central-station monitoring for cover on business premises, and some licensing regimes do too, so the first step is confirming what is actually required of you. Beyond that, monitoring answers the practical question of who responds when a premises alarms at three in the morning and no employee is there. Commercial arrangements typically involve a documented keyholder list and an agreed escalation, both of which need reviewing regularly.

Can we manage several locations from one system?

Yes, and it is worth specifying from the second site onward rather than the fifth. Centralised administration gives each person one credential valid across the locations they need, one revocation when they leave, consistent reporting, and a single place to check who entered where. The alternative accumulates through local purchasing and acquisition: separate platforms per site, each administered by whoever is available, with no reliable estate-wide answer to a simple access question. Consolidating later is a project; specifying for it early is a decision.

Who should be able to view our security footage?

Fewer people than usually end up with access. Define named roles with their own accounts, distinguish live viewing from retrieving and exporting recorded material, and log who accessed what. Confirm at handover whether the installer retains any access and, if so, agree in writing on what basis and for how long. Where employees are recorded, most jurisdictions expect access to be limited to a defined purpose and defined people, so an unbounded viewer list is a compliance problem as much as a security one.