The perimeter and surroundings of the building
Fencing, lighting, visibility and natural sighting (CPTED), blind spots.
Safe company
Secure company and soft target protection
Evaluation of the object's threat and a security plan with priorities — for a new object, in the event of a change in operation or when the entry mode is just a matter of habit.
risk assessmentsecurity plan with prioritiesstaff exercise (TTX)
He is responsible for this service
Jan Gibek
Corporate Security GBH Defence
The weak point is not in the technique. It is in mode.
Schools, offices, surgeries and administrative buildings operate daily with open doors and high attendance. Entry is usually semi-permeable, the reception does not have a procedure for an unknown person and in a tense moment it is not clear who makes the decision. Part of the risks is determined by the environment — location, crime, surrounding traffic. But most of them are risks that you can influence: regime measures, work with inputs, clarity and lighting of the space, division of responsibilities. The audit separates and names the two groups before they manifest in a real situation. We do not scare; we will describe the likely scenarios and their impact on your decision making.
- The entrance and reception do not have a uniform procedure for an unknown person or for accompanying visitors.
- The cameras are installed, but no one is monitoring them live and no one has mapped the blind spots.
- Evacuation is being practiced, but no one has addressed evacuation — sheltering people when the threat is outside.
- In a moment of crisis, it is not clear who makes the decisions, who the team informs and what is closed first.
Scope
What the product is — and what it isn't.
Includes
- Inspection of protection layers: perimeter and surroundings, building envelope, internal zones, sensitive areas
- Control regime measures: entrances, records of visits, keys, reception work
- Assessment of cameras, lighting and clarity of space — principles CPTED (crime prevention through environmental design)
- Checking the escape routes, the evacuation scenario and the possibility of evacuation
- Staff Exercise (TTX) — practicing management response and reception to a model incident at the table
Does not include
- We do not track employees or visitors, and we do not screen private individuals
- We do not supply or install camera and alarm systems — recommendations are independent of suppliers
- We do not replace security, the police or an integrated rescue system
- We don't deal with cyber security — that's covered by a separate service
Procedure
First the reality. Then measures.
-
01
Survey
A tour of the layers
We will go through the building layer by layer during normal operation: the perimeter and surroundings, the building envelope, entrances, internal zones and sensitive spaces — and also the mode in which the team actually works with them on a daily basis.
-
02
Analysis
Risk assessment
We weigh each risk as a product threats, vulnerability and impact on traffic. We will separate environmental risks that you cannot control from mode and input risks that you can control.
-
03
Recommendations
Safety plan
We will build a security plan: regime measures, environmental and technical adjustments, responsibilities and sequence of steps — from immediate to long-term, with an owner for each measure.
-
04
Practice
Staff Exercise (TTX)
The staff exercise is an exercise in crisis decision-making at the table: with the management and the reception, we go through a model incident — who decides when to evacuate and when to invade, i.e. hide people in the building.
Coverage
Protection works in layers — perimeter, shell, inner zones, sensitive areas — and is held together by regime, not technology.
Building envelope and entrances
Doors, locks, windows in range, access points and their actual use.
Visiting and reception regime
Registration of arrivals, escort, procedure for an unknown person, regime measures.
Technical systems
Cameras, access and alarm systems: coverage, blind spots and who responds to an alarm.
Indoor zones and sensitive areas
Grading of access, key mode, filing cabinets, server rooms and warehouses.
Personnel response (soft target)
Incident recognition, evacuation vs. invacation, framework Run - hide - fight.
Output for management
Threat assessment and security plan
Structured PDF document + personal presentation for management
What the document contains
- Vulnerability assessment: risks weighted by threats, vulnerabilities and impact
- Map of weak points by layers of protection, p the owner of each measure
- Safety plan: regime measures, environmental modifications, technique, training
- Staff exercise scenario for reception and management
- Steps divided into immediate, mid-term and long-term according to costs
The structure of the output is based on methodology of the Ministry of the Interior of the Czech Republic for the protection of soft targets, so it will also serve as a basis for a subsidy application. We only pass it on to the management or the founder, in the agreed confidentiality regime.
Role and mode
Who decides and how we cooperate.
- 01
Head of Audit
Single point of contact for the client; keeps the scope, deadlines and consistency of the output.
- 02
Audit team
Specialists in physical security, regime measures and personnel response.
- 03
Contact on the client side
Appointed person with the authority to approve measures and make sensitive areas accessible.
Operational log
- The security plan divides the steps into immediate, mid-term and long-term.
- An audit is a snapshot in time — after the introduction of measures, we measure the shift against the original finding.
- We recommend a re-audit after a major change in operation, reconstruction or an incident in the vicinity.
- If the security situation worsens, the scope can be expanded operationally.
- Form
- A one-time audit with a fixed scope; optional follow-up inspection program against the original finding.
- Time frame
- Inspection and exit usually in a matter of weeks depending on the size and structure of the object.
- Involvement of the client's team
- We work with management, reception and the property manager; we do not restrict normal operation.
- Scope by scenario
- We set the depth of the audit according to real threat scenarios, not according to a flat price list.
Discretion
An audit shows where an object is vulnerable — such a message does not belong to the public. We work according to the rules need-to-know: information is only given to those who absolutely need it. We act inconspicuously on site, the results are known only to the authorized persons of the management or the founder, and we store the documentation securely. There is no one to learn about cooperation with us. However, confidentiality has legal limits and we respect them — we do not promise what is beyond the limit.
- Collaborations and outputs covered by a non-disclosure agreement (NDA)
- We perform inconspicuously on the spot, without markings and uniforms
- We store documentation securely and share it only with authorized persons
- Team members are vetted and bound by confidentiality
Standards and the law
Trusted capacity, within the limits of the law.
- A team with experience in physical security, soft target protection and facility operations.
- We structure the threat assessment and security plan according to the methodologies of the Ministry of the Interior of the Czech Republic for soft targets.
- We weigh risks according to the logic of ISO 31000; we take the fire and evacuation regulations as a binding framework.
- We work within the framework of the relevant trade authorizations.
- Team members are vetted and bound by confidentiality.
We work within the limits of the law and within the framework of the relevant authorizations. The audit is defensive and proportionate — we assess the client's facilities and operations, not private individuals. We do not track third parties, we do not eavesdrop and we do not use any hidden or offensive means. We handle personal data according to GDPR. We do not do or offer anything that is outside the law.
Proof system
Specifically, but discreetly.
A service detail should not end with a promise. It shows an anonymized scenario, methodology and output that management will really use.
We do not show the client. We show the decision.
- 4 layers Perimeter, shell, zones, sensitive areas. We assess each layer separately and in sequence.
- 3 quantities Threat x Vulnerability x Impact. Each risk is given a weight, not just a line in the list.
- 2 documents Threat assessment + plan. Decision support for management, not a list of risks.
Deliverable preview
Threat assessment and security plan
- Vulnerability assessment: risks weighted by threats, vulnerabilities and impact
- Map of weak points by layers of protection, p the owner of each measure
- Safety plan: regime measures, environmental modifications, technique, training
Guides and analysis
A company's physical security audit: a practical checklist
What does the audit check, how does it take place and what should the priority output for management look like.
How to detect wiretapping in the office
When to supplement the general audit with a defense technical inspection of sensitive premises.
Part of the GBH group
GBH Partners
Crisis air transportation and consulting for operations with risks outside the facility.
GBH Capital
Investment division of the security infrastructure financing group.
GBH Cyber
Cybernetic layer of the object — camera and access systems, networks.
GBH Bunker
Physical audit measures: doors, safes, protected areas.
GBH Academy
Staff and reception training that the audit will usually recommend.
Related services
All services
Leadership readiness
Preparing for a crisis
readiness assessment
crisis playbook
staff exercise (TTX)
Advisory
Security consulting
monthly risk brief
monitoring exposure changes
prioritized by impact
Infrastructure
Safe rooms and bunkers
protective layer design
technical specifications
continuity with the operation of the facility
Questions for decision
Do you monitor employees or visitors during the audit?
Nope. We assess the object, inputs and operating mode of the client, not a specific person. We don't track people, we don't screen private individuals and we don't use hidden means. We handle data according to GDPR and within the limits of the law.
Will the audit disrupt the normal operation of the school or office?
Not fundamentally. We plan the tour during normal operation — that is when you can see how the mode really works. Most of the work is done by observing the layers of the building and talking to the management and reception, not closing the operation.
Who will know what the audit found?
Only authorized persons on the side of the management or the founder. We pass on the message in the agreed confidentiality regime, we store the documentation securely and the cooperation is covered by a non-disclosure agreement. We do not publish weak points.
When does it make sense to submit an audit?
Typically in the case of a new building or reconstruction, during operation with free movement of people, after the situation in the surroundings has deteriorated or when the entry mode is based on custom. For schools, authorities and hospitals, the output can also be used as a basis for an application for a subsidy for the protection of soft targets.
What if you find a serious problem?
We will tell you clearly and immediately, not in a message. We prioritize serious findings, describe their impact on operations, and suggest a first step. We don't scare you — we describe a likely scenario and its consequences.
Will you guarantee that nothing will happen then?
No, and nobody serious promises that. An audit will reduce the likelihood and impact of an incident and give you clear priorities, but residual risk always remains. We'll only recommend measures that make sense — and we'll also tell you what you don't need.
Let's have a non-binding chat about your property
"Write us the basic situation. The first conversation is discreet and non-binding — first we will find out the real situation, only then we will propose the scope of the audit and next steps."
Tomáš Šlesinger · GBH Group Security Advisor
Contact us
The first step doesn't have to be big. It must be correct.
First contact protocol
First we understand the situation. Then we suggest the next step.
Briefly write what you are dealing with. We will contact you discreetly and arrange a safe call format.
Call safely