Security Guard cheat sheet

A private security guard's arrest authority derives from citizen's arrest statutes, not police powers; the guard generally must have observed a felony or breach of the peace in progress, or have reasonable grounds plus immediate pursuit.

Detention of a person is a seizure: it requires reasonable suspicion tied to a specific crime, must be brief, and must end when suspicion dissolves or police arrive.

Force must be proportional: the guard may use only the minimum force reasonably necessary to defend self or others, prevent escape of a lawfully arrested person, or overcome resistance to a lawful detention.

Deadly force is generally limited to defense against an imminent threat of death or serious bodily harm; it is never justified solely to protect property.

Use-of-force reporting is triggered at the moment force is applied, not only when injury results; the report must state the threat, the force used, and the de-escalation attempted.

A citizen's arrest must be delivered to law enforcement without unreasonable delay; the guard must state the facts of the offense and the basis for the arrest.

Search of a person or belongings by private security is lawful only with consent, incident to a lawful arrest, or under a specific contractual/statutory power; refusal of consent cannot itself justify force.

Criminal intent (mens rea) and the act (actus reus) must both be present for most offenses; a guard documenting an incident should record observed acts and statements, not conclusions about intent.

Patrol patterns alternate routes and timing so that observation intervals are unpredictable; fixed, clockwork rounds create exploitable gaps.

Observation is systematic: scan at the perimeter first, then mid-ground, then focal points; note baseline conditions so anomalies stand out.

Report content follows the observable-fact rule: who, what, when, where, how - descriptions of behavior and appearance, not opinions or labels.

Descriptions should be built from top-down features: height/build, hair, clothing layers, distinguishing marks, direction of travel, and any vehicle plate.

Notes must be contemporaneous; memory decay and post-event suggestion make delayed accounts less reliable and less defensible.

A written report is a permanent record that may be disclosed in court or to regulators; it must be factual, chronological, legible, and free of speculation.

Baseline documentation (lighting, locks, doors, alarm status) at shift start allows later comparison and supports negligence defenses.

Photographs and evidence are logged with time, location, and chain-of-custody entries; unlogged items lose evidentiary value.

The response sequence is: assess the scene for ongoing danger, call for help and emergency services, render aid within training, secure the area, then document.

Life safety precedes property protection: evacuation and rescue take priority over containing damage or guarding assets.

An emergency action plan defines alarm signals, evacuation routes, assembly points, and assigned roles; guards execute the plan rather than improvise it.

Fire response uses the RACE sequence - Rescue, Alarm, Contain, Evacuate/Extinguish - and PASS for extinguisher use: Pull, Aim, Squeeze, Sweep.

Medical response: check responsiveness and breathing, activate EMS, control severe bleeding with direct pressure, and start CPR/AED per training; do not move a suspected spinal-injury casualty unless in immediate danger.

Suspicious-item response: do not touch or transmit radio near the item, establish a cordon at a distance consistent with local guidance, and notify police.

Incident command is unified: arriving emergency services assume authority, and the guard shifts to supporting role, providing access, information, and scene control.

Post-incident actions include accounting for occupants, preserving the scene, and a hot-wash debrief while memories are fresh.

Access control rests on three checks: identity (who), authorization (entitled?), and purpose (why now); all three must pass before entry.

Credential verification compares the badge photo, name, and access level to the person presenting it; borrowed or altered badges are a common breach.

Tailgating and piggybacking are prevented by one-person-per-swipe rules, vestibules, and challenge procedures for unbadged followers.

Screening methods include visual inspection, metal detection, and bag checks; each requires a posted or stated policy and consent, with refusal handled by denial of entry, not force.

The layered defense model uses perimeter, building envelope, interior zones, and asset-level controls; a single control is never treated as sufficient.

Visitor management records name, host, purpose, time in, time out, and issued badge; unescorted visitors are restricted to authorized areas.

Keys and access cards are inventoried and signed for; loss is reported immediately because the credential, not the person, is the security token.

Alarm response follows verification first: confirm whether the alarm is real (call-back, camera check) before committing to a response, then follow escalation procedures.

First impressions form within seconds; tone, posture, and eye contact shape whether the public cooperates voluntarily or resists.

Service orientation means solving small problems (directions, assistance, information) so that the guard is seen as a resource, which increases reporting of suspicious activity.

De-escalation techniques include lowering voice volume and pitch, slowing speech, maintaining non-threatening distance and open posture, and offering choices.

Active listening uses paraphrase and clarifying questions; it defuses anger and gathers accurate facts for the report.

Professional boundaries: no personal relationships with detainees, no accepting gifts that could compromise impartiality, no off-duty use of authority.

Bias-free conduct: decisions are based on observed behavior and policy criteria, not on protected characteristics; articulable facts must support every stop or challenge.

Complaints are received, documented, and routed to the proper authority; a guard does not argue or adjudicate a complaint at the scene.

Appearance and uniform standards are part of authority: a clean, correctly worn uniform supports credibility and reduces confrontation.

Radio protocol: identify yourself, state the location, state the need, keep transmissions brief, and confirm receipt; clear channel discipline prevents missed calls.

The phonetic alphabet and plain-language codes reduce misheard words; numerals are spoken digit by digit for addresses and plates.

Report structure: date/time, location, persons involved, narrative in chronological order, actions taken, evidence, and signature.

Objectivity rule: record what was seen, heard, and done; avoid conclusions such as 'suspicious' or 'hostile' without describing the conduct that prompted them.

Corrections are made by single-line strike-through with initials and date; erasures and white-out destroy the integrity of the record.

Statements from witnesses are recorded verbatim where possible and attributed; the guard's own opinions are separated from quoted speech.

Handover briefings pass on open items, keys, equipment status, and pending incidents; undocumented handovers are a common source of liability.

Confidentiality: incident details are shared only on a need-to-know basis with authorized parties, consistent with privacy law and employer policy.

Hazard identification precedes control: spot the hazard, assess the risk (likelihood x severity), apply controls, then re-check.

The hierarchy of controls ranks elimination, substitution, engineering controls, administrative controls, and PPE - in that order of preference.

Slips, trips, and falls are the most common workplace injuries; controls include spill response, cable management, signage, and adequate lighting.

Lone-worker risk requires check-in schedules, communication devices, and defined escalation when a check-in is missed.

Bloodborne-pathogen and body-fluid exposure requires gloves and barrier protection; hand hygiene follows removal, and exposure is reported immediately.

Fire safety: know extinguisher classes (A ordinary combustibles, B flammable liquids, C electrical, D metals, K cooking oils) and never use water on a live electrical fire.

Ergonomics and fatigue: prolonged standing, night shifts, and heavy loads increase injury and error rates; rotation and breaks are control measures.

Report every near-miss; unreported near-misses are leading indicators of the next injury.

Tort liability for a guard commonly arises from false imprisonment, assault, battery, negligence, and defamation; each requires documented, policy-compliant conduct.

Negligence elements: duty, breach, causation, and damages; a written policy plus training records is the primary evidence of reasonable care.

Vicarious liability holds an employer responsible for acts within the scope of employment; acting outside policy and training increases both personal and employer exposure.

Ethical tests for a decision: is it legal, is it consistent with policy, would it withstand public disclosure, and is it impartial?

Conflicts of interest, gratuities, and off-duty employment must be disclosed and approved; undisclosed conflicts undermine impartiality.

Licensing and regulatory compliance: guards must hold the required state license or registration, complete mandated training, and carry credentials while on duty.

Use-of-force and detention events require mandatory reporting to the employer and often to the licensing authority within set timeframes.

Records retention follows statute and contract; destroying or altering records after an incident can constitute spoliation and create adverse inference at trial.