CSO (CDR) cheat sheet

A security officer's authority is delegated by the client or property owner through contract and post orders; it is not general police authority.

Four elements of negligence: duty, breach of duty, causation, and damages - all four must be shown before liability attaches.

Critical incidents (injury, crime in progress, fire, weapon on site) are reported to the supervisor immediately; routine incidents before end of shift.

Conflicts of interest and gifts that could influence an official decision are disclosed and refused rather than accepted and later reported.

Confidential client information is released only on a need-to-know basis or under legal compulsion such as a subpoena or court order.

Under respondeat superior, an employer can be liable for an officer's acts performed within the scope of employment.

Post orders override general procedure at a specific site unless the order is unlawful or creates an imminent safety hazard.

A uniform and badge create apparent authority; using them to imply police powers is impersonation and is a criminal offense.

Private-citizen arrest generally requires a felony or breach of the peace committed in the officer's presence; the exact rule varies by jurisdiction.

Shopkeeper's privilege allows detention of a suspected thief for a reasonable time, using reasonable force, on probable cause; the detention must not become a full search or interrogation.

Force must be objectively reasonable, proportional to the threat, and preceded by de-escalation attempts whenever feasible.

Deadly force is limited to defense of self or others against an imminent threat of death or serious bodily harm.

Force continuum sequence: presence, verbal direction, soft empty-hand control, hard empty-hand, intermediate weapon, deadly force.

False imprisonment elements: intentional confinement, without consent or lawful authority, for an unreasonable time or without probable cause.

A detention must rest on observed facts and last no longer than needed to resolve those facts; release and document when cleared.

A person whose license to be on the property is revoked becomes a trespasser if they refuse to leave; involve police rather than escalate force.

Patrol has four purposes: deter, detect, report, and respond; visible, randomized patrol is itself a deterrent.

Standard building check items: doors, windows, locks, lighting, alarm status, unauthorized persons, and safety hazards.

Checkpoints are scanned or signed and logged with time and location; a missed checkpoint must be explained to the supervisor.

Vehicle patrol pre-shift inspection covers tires, lights, fluids, brakes, and radio; private-property speed is typically 5-15 mph.

Never enter a dark or unsecured area alone; hold and observe, or request backup, before making entry.

Know the baseline of normal activity for the post so that anomalies (open door, ladder, unattended vehicle) stand out.

Vary route, direction, and timing; predictable patrol patterns can be planned around.

When relieving a fixed post, complete a verbal briefing and a log entry before the outgoing officer departs.

Reports record observable facts and the conditions of observation; conclusions are left to investigators.

Core report elements: who, what, when, where, how, action taken, and disposition.

Narratives are written chronologically, in the 24-hour clock, past tense, first person, without opinion or speculation.

Person description order: sex, age, height, weight, build, hair, complexion, clothing top to bottom, distinguishing marks, direction of travel.

Vehicle description: plate, state, make, model, color, year, damage, occupants, and direction of travel.

Contemporaneous notes can be subpoenaed; they must not be rewritten, altered, or destroyed after the report is filed.

Perception degrades with stress, poor lighting, distance, and inattentional blindness; record the conditions under which the observation was made.

Scene preservation: touch nothing, restrict access, and log every person who enters the area.

Access control sequence: identify, verify, authorize, record.

Authentication factors are knowledge, possession, and inherence; two-factor requires two different categories, not two of the same.

ID verification: match the photo to the holder, confirm name and expiration, and check for tampering or delamination.

Visitor process: sign in, display the badge visibly, follow escort rules, sign out, and reconcile badges at shift change.

One credential read admits one person; politely challenge and verify anyone who follows through on another's entry.

Least privilege: issue the minimum access needed, review it periodically, and revoke it immediately on termination or transfer.

Lost or unreturned master keys require rekeying of affected areas and a written key log entry.

After-hours entry requires the person to be on the authorization list plus call-back verification before access is granted.

Every alarm is treated as real until positively confirmed otherwise.

Evacuation rule: stairs only, never elevators; close doors behind you; go to the assembly area; no re-entry until cleared.

A head count at the assembly area is compared to the roster, and missing persons are reported to the incident commander or fire department.

Shelter-in-place: interior room with few windows, seal gaps, shut down ventilation, and wait for the all-clear.

First-arriving responders establish incident command; security supports with information, access, and perimeter but does not take command.

Common emergency roles: floor warden, searcher, stairwell monitor, and assembly area recorder.

Bomb threat call: capture exact wording, caller voice and background noise, ask location and time, and avoid radios or cell phones near a suspicious item.

Life-safety systems must never be disabled without a documented fire watch.

Fire tetrahedron: fuel, oxygen, heat, and chemical chain reaction; removing any one element extinguishes the fire.

Fire classes: A ordinary combustibles, B flammable liquids, C energized electrical, D metals, K cooking oils.

Extinguisher use - PASS: Pull the pin, Aim at the base of the fire, Squeeze the handle, Sweep side to side, keeping an exit behind you.

Only attack a fire that is small, confined, and has a clear escape route behind the operator.

Exit signs and emergency lighting: monthly 30-second function test and annual 90-minute duration test.

Maintain 18 inches of clearance below sprinkler deflectors and unobstructed access to extinguishers and standpipes.

Fire doors must self-close and latch; propping them open defeats compartmentation and is a reportable violation.

Most frequent violations: blocked exits, daisy-chained extension cords, and improperly stored flammables.

Radio protocol: identify your unit, pause before speaking, keep transmissions brief, use plain language, and acknowledge.

Spell names and plates with the phonetic alphabet and state numbers digit by digit.

Emergency call order: location first, then nature of the emergency, injuries, suspect description and direction of travel, then stay on the line.

De-escalation: lower volume and pace, keep hands visible, maintain safe distance, and offer limited choices rather than ultimatums.

Complaint handling: listen, acknowledge, avoid arguing policy, document, and route to the supervisor per procedure.

Never confirm whether a person is on site, or release personal data, to an unverified caller.

Answer telephones within three rings, identifying the post and your name, and record messages with time and callback number.

CCTV evidence is exported to sealed, labeled media with a handling log noting date, time, camera, and custodian.

Common alarm device types: door contact, passive infrared motion, glass break, and duress or panic button.

Fail-safe hardware unlocks on power loss to protect life-safety egress; fail-secure hardware stays locked to protect assets.

Frequent false alarm causes: drafts, pets, insects, dying batteries, and loose or misaligned contacts.

Access control components: card reader, request-to-exit device, electric strike or mag lock, and door position switch.

Maintain minimum lighting levels at entrances and parking areas and report burned-out lamps promptly.

A propped or taped door defeats the entire electronic access system and must be treated as an alarm condition.

Warning signs: direct or veiled threats, intimidation, weapon fixation, recent discipline, obsession, and sudden withdrawal.

Escalation levels: low (document), moderate (report and monitor), imminent (evacuate and call 911).

Active threat response priority: Run if a safe route exists, Hide and barricade if not, Fight only as a last resort.

Termination procedure: disable access before the person is notified, collect badge and keys, and escort off the property.

Domestic violence spilling into the workplace: notify the supervisor, obtain a photo, keep a copy of any protective order, and use no-trespass where lawful.

Document every threat report with exact words, time, witnesses, and actions taken.

Post-incident: preserve the scene, obtain witness statements before end of shift, and offer employee assistance resources.

Universal precautions: all blood and body fluids are treated as potentially infectious regardless of the source.

PPE is selected for the identified hazard, inspected before use, and replaced when torn or contaminated.

Hazard communication: a current SDS is available for every chemical, GHS pictograms appear on labels, and the first-aid section is read before use.

Body fluid spill: restrict the area, don gloves and eye protection, absorb, disinfect with an approved product, and bag as biohazard waste.

Lifting mechanics: bend the knees, keep the load close, do not twist, and use a team lift for heavy or awkward loads.

Heat illness prevention: hydration, rotation, and shade; suspected heat stroke is a 911 emergency.

Never disturb suspected asbestos, lead paint, or mold in older buildings; stop work and report to the supervisor.