A half-full office is easier to walk into. Fewer people at the desks means fewer people noticing the stranger by the printer or the door propped open for a delivery. This office security checklist covers the gaps that open up in a hybrid building.
The short version
- Office security in a hybrid building is mostly habits and records, not hardware.
- The weak points are the quiet hours: early mornings, evenings, weekends and Friday afternoons.
- Every risk needs a named owner. A control nobody owns is a control that lapses.
- Review the checklist every quarter. Floor plans and contractors change faster than policies do.
Start at the front door
Most office building security problems begin in the lobby. A reception that knows every face breaks when a third of the company is only in twice a week. Anyone with a lanyard and confidence looks like a colleague.
Visitor management is the fix. Pre-register expected guests, sign every visitor in, give them a badge that looks different from a staff pass, and have the host collect them. A visitor management system keeps the record, but the habit matters more than the tool.
Tailgating is the harder problem. Holding the door for a stranger is how most unauthorised entries happen. Tell people it is fine to let the door close and ask the person to badge in, and brief reception to say the same without apology.
- Every visitor is pre-registered or signed in on arrival, with a host named.
- Visitor badges look different from staff badges and are collected at sign-out.
- Staff know the tailgating rule and reception backs them up.
- Lost passes and leavers’ passes are cancelled the same day.
For the reception side of this, see our guide to front desk security.
After hours and weekends
People come in early, stay late because the office is quiet, and drop in on a Saturday. Each of those visits happens when reception is empty and the cleaners have the run of the floor.
After-hours access should be a decision, not a side effect of whose pass still works at nine at night. Decide who needs it, set the door schedule to match, and keep the list short.
- Door schedules match working hours, and out-of-hours access is granted by name.
- Cleaners and maintenance contractors have their own credentials, not a shared fob.
Desks, meeting rooms and devices
Nobody owns a hot desk, so nobody feels responsible for what is left on it. A clean desk policy sounds like housekeeping, but in a shared office it decides whether a client file is locked away or read by whoever books the desk next. Lockers, privacy screens on exposed desks and laptops that lock on idle fix most of it.
Meeting rooms need the same thinking. Glass walls carry more than people assume. Confidential conversations belong in a room chosen for it, cleared down when the meeting ends.
- Hot-desk users have lockable storage and desks are clear at the end of each day.
- Laptops lock on idle, and screens facing public areas have privacy filters.
- Rooms suitable for sensitive meetings are identified and bookable as such.
- Shared printers release jobs at the device, not on send.
Deliveries and contractors
A courier with a parcel and an engineer with a toolbox get waved through more often than a visitor with a briefcase. They should not. Deliveries stop at reception or a mailroom. Contractors sign in like any other visitor, are met by whoever booked the work, and wear a badge for as long as they are on site. Access to server rooms and comms cupboards is a separate approval, not something granted because the engineer has already arrived.
- Deliveries are accepted at a fixed point and never walked to a desk by the courier.
- Contractors are pre-approved, signed in, badged and escorted where the work requires it.
Knowing who is in the building
Security and safety meet at the fire alarm. Someone has to answer one question: is everyone out? In a fixed-desk office the answer came from a floor plan. In a hybrid office the plan is out of date by lunchtime.
The answer has to come from records you already keep. Staff check-ins, desk bookings and the visitor log together give a live list of who is on site, and the fire warden needs it on a phone at the muster point. Run the drill against the live list and count who was on site but not on it. That number is your gap.
- A live on-site list exists, includes visitors and contractors, and can be read away from the building.
- Fire wardens are named per floor and per day, because the usual one may be at home.
- Sign-out is enforced so the list does not show people who left hours ago.
The quarterly review
A checklist run once is a snapshot. Run it quarterly and it becomes a control. Tie it to your workplace risk assessment so security items sit beside safety ones, and give each line an owner. Adjust the names below, keep the columns.
| Risk | Control | Who owns it |
|---|
| Unknown person on the floor | Sign-in for every visitor, distinct badges, host collection | Front of house |
| Tailgating at secure doors | Badge-in rule communicated and backed by reception | Office manager |
| Passes that still work after someone leaves | Same-day cancellation, monthly access review | IT and HR together |
| Out-of-hours entry with no record | Door schedules by role, named after-hours list | Facilities |
| Confidential material on shared desks | Clean desk policy, lockers, end-of-day sweep | Team leads |
| Contractor in restricted space unescorted | Pre-approval, escort rule, key log | Facilities |
| Nobody knows who is on site in an evacuation | Live on-site list from check-ins and visitor log | Fire warden lead |
At each review, walk the floor rather than reading the policy. Try the doors. Look at the desks at six in the evening. The checklist says what should be true; the walk shows what is.
Frequently asked questions
What office security features does a hybrid office need?
Visitor sign-in with distinct badges, door access that matches working hours, lockable storage at shared desks, and a live list of who is on site. Most of it is process rather than equipment.
How do you stop tailgating without upsetting people?
Make badging in a stated rule and letting the door close expected, not rude. People follow it once they see it applied to everyone, including the managing director.
Does a clean desk policy work with hot-desking?
Only if people have somewhere to put their things. Give hot-deskers lockers and the policy mostly enforces itself. Without storage it becomes a complaint.