IL Security Guard cheat sheet

Illinois security officers are licensed by the Illinois Department of Financial and Professional Regulation (IDFPR) under the Private Detective, Private Alarm, Private Security, Fingerprint Vendor, and Locksmith Act of 2004 (225 ILCS 447).

A Permanent Employee Registration Card (PERC) is required before an employee may perform security work; the employing agency files the application and the card must be carried while on duty.

A security officer is a private citizen with no greater arrest authority than any other citizen; police powers are not conferred by the license.

Unarmed security officer training requires 20 hours before assignment (8 hours basic, 8 hours on-the-job, 4 hours of firearms-free use-of-force/other); armed officers require an additional 20-hour firearms course and annual requalification.

Agency licensure and officer registration are separate: the agency holds the license, the individual holds the PERC; working for an unlicensed agency is itself a violation.

Security officers may not wear or display badges, uniforms, or titles that imply law enforcement affiliation or authority.

License and PERC must be produced on request of an employer, client, or IDFPR investigator; failure to carry is a violation subject to discipline.

Scope of authority is set by the client contract and post orders; officers may enforce private property rules (trespass, access control) but cannot exercise police authority.

Citizen's arrest (725 ILCS 5/107-3): a private person may arrest when a criminal offense is committed in their presence, or when they have reasonable grounds to believe the person committed a felony and the person is in fact guilty.

Detention must be based on specific, articulable facts; a hunch, profile, or nervousness alone does not justify holding a person.

Search by a private security officer generally requires consent or a valid contractual/property right; a search without consent may expose the officer and employer to civil liability for battery and invasion of privacy.

Use of force must be proportional and limited to what is reasonably necessary to prevent imminent harm, effect a lawful arrest, or defend self/others; deadly force is limited to defense against imminent death or great bodily harm.

Illinois uses the objective reasonableness standard (Graham v. Connor) for evaluating force; totality of circumstances, not hindsight, controls.

Civil liability theories: false imprisonment (intentional confinement without authority), battery (unlawful touching), assault (threat), defamation, malicious prosecution, and negligent hiring/training against the employer.

Miranda warnings apply only to government agents; a private security officer acting independently is not required to give them, but statements obtained by coercion may be excluded or actionable.

Shopkeeper's privilege (retail detention) in Illinois permits brief detention of a suspected shoplifter on probable cause, in a reasonable manner, for a reasonable time, for investigation or police notification.

Report structure: who, what, when, where, why, how; include date/time of occurrence, date/time of report, location, persons involved, witnesses, actions taken, and disposition.

Use objective, factual language; record observed facts and direct quotes, not conclusions such as 'suspicious' or 'obviously drunk' without supporting observations.

Write in first person, past tense, chronological order; use full names, titles, and identification numbers; avoid abbreviations that are not standard.

Correct errors with a single line-through and initials; never erase, white-out, or rewrite a completed report - alterations undermine credibility and may be discoverable.

Evidence chain of custody must record each transfer: date, time, from whom, to whom, purpose, and storage location; a broken chain weakens admissibility.

Physical evidence is packaged separately, labeled, sealed, and stored in a secured evidence locker; biological and perishable items require special handling.

Reports are discoverable in civil and criminal litigation; assume every report will be read by a jury, opposing counsel, and the client.

Supplemental and late reports should be labeled as such and reference the original report number; never destroy or discard original notes.

Patrol types: fixed post, foot patrol, vehicle patrol, and roving; each has different observation ranges and response times that should be documented in post orders.

Observation fundamentals: scan systematically (left-to-right, near-to-far), vary routes and timing, and use peripheral vision; avoid routine patterns that enable predictability.

Describe persons using head-to-toe method: sex, race, age, height, weight, hair, clothing (top to bottom), scars/tattoos, and distinguishing features.

Incident response sequence: observe, assess, call for backup/police, contain or isolate, render aid, document, and notify supervisor and client.

Perimeter and access points should be checked for forced entry, propped doors, and tampering; record time of each check on the patrol log.

Radio and communication discipline: identify yourself, state location, describe the situation, request specific resources, and acknowledge instructions.

Post orders define authority and response limits at each site; officers must follow them and document deviations.

Note-taking during patrol should capture time, location, and observation; these notes support later report writing and testimony.

Emergency priority order: life safety, incident stabilization, property protection; never enter an unsafe area without training and equipment.

Fire response: activate alarm, call 911, evacuate via designated routes, account for occupants at the assembly point, and never use elevators during a fire.

Fire extinguisher PASS: Pull the pin, Aim at the base of the fire, Squeeze the handle, Sweep side to side; only fight small, contained fires with an exit behind you.

Fire classes: A (ordinary combustibles, water), B (flammable liquids, foam/CO2/dry chemical), C (energized electrical, CO2/dry chemical), D (metals, special agents), K (cooking oils, wet chemical).

CPR for an adult: check responsiveness and breathing, call 911 and get an AED, begin chest compressions at 100-120 per minute, 2 inches deep, 30 compressions to 2 breaths.

AED use: turn on, follow voice prompts, attach pads to bare chest, clear the victim before shock, resume CPR immediately after.

Choking adult: encourage coughing; if ineffective, deliver abdominal thrusts (Heimlich) until the object is expelled or the person becomes unresponsive.

Severe bleeding: apply direct pressure, then a tourniquet 2-3 inches above the wound if pressure fails; note the time applied.

De-escalation sequence: slow down, create distance and time, use a calm low tone, acknowledge the person's concern, offer choices, and request backup before physical intervention.

Active listening skills: paraphrase, reflect feeling, ask open-ended questions, and summarize; these reduce perceived threat and build cooperation.

Nonverbal signals (stance, eye contact, gestures, proximity) often outweigh words; maintain a non-threatening posture and respect personal space.

Verbal judo tactics: redirect hostility with empathy, use the person's name, avoid power struggles, and give face-saving options.

Escalation indicators: clenched fists, pacing, rapid speech, invasion of personal space, and threats; respond by increasing distance and calling for support.

Bias-free communication: treat all persons with dignity regardless of race, gender, religion, disability, or perceived status; document objective behavior, not stereotypes.

Cultural and language barriers: use interpreters, plain language, and written instructions; confirm understanding by asking the person to repeat back.

Complaint handling: listen, record facts, avoid arguing, and route to the supervisor; never make promises about outcomes you do not control.

Common indicators of impairment: slurred speech, odor of alcohol, bloodshot eyes, unsteady gait, poor coordination, and erratic behavior; document observations, not diagnoses.

Do not physically restrain or search an impaired person without authority; notify the supervisor, request medical help if needed, and call police if a crime or safety hazard exists.

Prescription and recreational drug impairment may present with dilated or constricted pupils, tremors, sweating, and confusion; treat as a medical emergency if overdose is suspected.

Opioid overdose signs: pinpoint pupils, slow or absent breathing, unresponsiveness; call 911 and administer naloxone if trained and authorized.

Workplace safety fundamentals: report hazards, use PPE, follow lockout/tagout and confined-space rules, and know the location of first aid and emergency equipment.

Bloodborne pathogen precautions: treat all blood and body fluids as infectious; use gloves, eye protection, and a barrier device for rescue breathing.

Incident reporting of substance abuse must be factual and confidential; avoid defamatory statements and share only on a need-to-know basis.

Drug-free workplace policies may include testing; officers must follow the client's policy and chain-of-custody procedures for any specimen or evidence.

Terrorism indicators: unusual surveillance, photography of security measures, attempts to gather information about access, unattended packages, and unusual odors or vapors.

Suspicious package indicators: excessive postage, misspelled words, oily stains, protruding wires, unusual odor, and no return address; do not open or move - isolate and call authorities.

Critical infrastructure sectors include energy, water, transportation, communications, financial services, healthcare, and emergency services; each has sector-specific protection requirements.

Report suspicious activity to the supervisor and, where appropriate, to local law enforcement or the Illinois State Police; do not confront or investigate suspected terrorism yourself.

Insider threat indicators: unusual after-hours access, attempts to bypass access control, unusual questions about security systems, and unexplained financial distress.

Vehicle-borne threat response: establish standoff distance, prevent unauthorized vehicles from approaching the building, and report suspicious vehicles with plate and description.

Bomb threat response: remain calm, record exact words, note background sounds and caller details, notify supervisor and police, and follow evacuation procedures.

Situational awareness: know normal baseline activity at your site so anomalies are recognizable; report, do not assume.

Core ethical duties: honesty, integrity, confidentiality, impartiality, and avoidance of conflicts of interest; never accept gifts or favors that could influence decisions.

Access control methods: identification verification, visitor logs, badge checks, escort requirements, and challenge procedures for unbadged persons.

Tailgating and piggybacking prevention: one person per badge swipe, observe entry points, and politely challenge anyone without visible credentials.

Confidentiality: client information, incident reports, and personal data are shared only on a need-to-know basis; unauthorized disclosure may violate law and contract.

Professional appearance and conduct: uniform standards, punctuality, sobriety, and respectful language reflect on the officer and employer.

Use of force and authority must be lawful and proportionate; officers may not use their position for personal gain, retaliation, or harassment.

Documentation of access control: log visitor name, purpose, time in/out, escort, and badge number; retain logs per client policy.

Report any suspected misconduct, bribery, or security breach through the chain of command or the client's ethics hotline.

PERC = Permanent Employee Registration Card; must be carried on duty and produced on request.

Agency license and individual PERC are distinct; both must be current for lawful employment.

Illinois unarmed training: 20 hours; armed adds 20-hour firearms course with annual requalification.

Security officers have citizen's arrest authority only; no police powers attach to the license.

Uniforms and badges may not imply law enforcement affiliation.

Post orders and client contract define scope; license does not expand authority.

IDFPR enforces licensure; violations may result in discipline or criminal charges.

Citizen's arrest: offense in presence, or reasonable grounds for felony plus actual guilt.

Detention requires specific, articulable facts - not hunches or profiles.

Search requires consent or valid property/contract right; otherwise civil liability risk.

Force must be proportional; deadly force only against imminent death or great bodily harm.

Objective reasonableness standard (Graham v. Connor) governs force evaluation.

Miranda applies to government agents, not private officers acting independently.

Shopkeeper's privilege allows brief, reasonable retail detention on probable cause.

Include who, what, when, where, why, how plus actions taken and disposition.

Record facts and direct quotes; avoid conclusory labels without supporting observation.

Write first person, past tense, chronological; use full names and identification numbers.

Correct errors with single line-through and initials; never erase or rewrite.

Chain of custody records each transfer: date, time, from, to, purpose, location.

Package and label evidence separately; secure in a locked evidence locker.

Assume every report is discoverable and may be read in court.

Patrol types: fixed post, foot, vehicle, roving; each has distinct observation range and response time.

Scan systematically and vary routes to avoid predictable patterns.

Describe persons head-to-toe: sex, race, age, height, weight, hair, clothing, marks.

Response sequence: observe, assess, call backup/police, contain, aid, document, notify.

Check perimeter and access points for forced entry, propped doors, tampering.

Radio discipline: identify, locate, describe, request, acknowledge.

Post orders define authority and response limits at each site.

Priority: life safety, incident stabilization, property protection.

Fire: activate alarm, call 911, evacuate, account for occupants, no elevators.

PASS: Pull, Aim at base, Squeeze, Sweep; only small contained fires with exit behind.

Fire classes A, B, C, D, K with matching extinguishing agents.

Adult CPR: 100-120 compressions/min, 2 inches deep, 30:2 ratio.

AED: turn on, follow prompts, clear before shock, resume CPR immediately.

Severe bleeding: direct pressure, then tourniquet 2-3 inches above wound with time noted.

De-escalate: slow down, create distance and time, calm tone, acknowledge, offer choices.

Active listening: paraphrase, reflect feeling, open-ended questions, summarize.

Nonverbal signals often outweigh words; maintain non-threatening posture and space.

Verbal judo: redirect hostility with empathy, use name, avoid power struggles.

Escalation indicators: clenched fists, pacing, rapid speech, threats - increase distance.

Bias-free communication: dignity for all; document behavior, not stereotypes.

Complaints: listen, record facts, avoid arguing, route to supervisor.

Document observations of impairment, not diagnoses; notify supervisor and call for aid.

Opioid overdose: pinpoint pupils, slow breathing, unresponsive - call 911, naloxone if trained.

Bloodborne pathogens: treat all fluids as infectious; use gloves and barrier devices.

Report hazards, use PPE, follow lockout/tagout and confined-space rules.

Do not restrain or search an impaired person without authority.

Report substance incidents factually and confidentially; avoid defamation.

Follow client drug-testing and chain-of-custody policies for specimens.

Indicators: unusual surveillance, photography of security, access probing, unattended packages.

Suspicious package: do not open or move - isolate and call authorities.

Critical infrastructure sectors: energy, water, transportation, communications, finance, healthcare, emergency services.

Report suspicious activity to supervisor and law enforcement; do not investigate yourself.

Insider threat: after-hours access, bypass attempts, unusual security questions.

Vehicle threat: maintain standoff distance, record plate and description.

Bomb threat: record exact words, note background, notify, evacuate per procedure.

Core duties: honesty, integrity, confidentiality, impartiality, no conflicts of interest.

Access control: verify ID, log visitors, check badges, escort as required.

Prevent tailgating: one badge per swipe; politely challenge unbadged persons.

Confidentiality: share client and incident data only on a need-to-know basis.

Professional conduct: uniform standards, punctuality, sobriety, respectful language.

Never use position for personal gain, retaliation, or harassment.

Log visitor name, purpose, time in/out, escort, badge number; retain per policy.