Designing security in layers, from the site boundary inward

Physical security has four functions: deter, detect, delay and respond. They are not independent. Delay is only worth anything if detection has already happened, because delay simply buys time for a response that nobody has started. A three-metre fence around an unmonitored perimeter delays an intruder by perhaps ninety seconds and tells no one about it.

So the design question at every layer is arithmetic. The cumulative delay from the point of detection to the target must exceed the time to detect, plus the time to assess the alarm, plus the time for the response force to arrive and intervene. Response time is a site input, not a product feature: it depends on whether the guard force is on site, how many posts there are, and how long it takes to reach the far corner of a compound at two in the morning.

Write that number into the specification as a design assumption. If the agreed response time is four minutes, every layer schedule can be checked against it, and any proposal to remove a layer during value engineering has to argue against a number rather than a sentiment.

The most cost-effective layer is usually the one that involves no equipment. Approach geometry decides how much energy a hostile vehicle can carry to your line, and how long an intruder is exposed before reaching it.

Look at achievable speed first. A straight run of 200 m aimed at the gate is a design fault, and it is cheaper to fix with road geometry, chicanes, planters and level changes than with a higher barrier rating. Every kilometre per hour you remove from the approach reduces the energy the barrier must absorb, and energy rises with the square of speed.

Then look at parking and standoff. A vehicle does not have to move to be a threat, so uncontrolled parking against a facade is a distinct problem from a penetrative attack and is solved by keeping vehicles at a distance, not by hardening the line. Finally look at surveillance value: landscaping, boundary walls and stored materials that block sightlines remove the detection time the rest of the design depends on.

Be explicit about what the boundary is for, because a fence and a vehicle security barrier are different things and are frequently confused in specifications. A welded mesh or palisade fence provides delay against a person and a mounting point for detection. It does not stop a vehicle at anything above walking pace. If the design requires vehicles to be stopped at the boundary, that is a rated vehicle security barrier line, specified with a full crash designation, and the fence sits alongside it rather than instead of it.

Specify the boundary as a system: the physical element, the detection element, the assessment element and the clear zone. Perimeter intrusion detection should be specified by performance, not by technology — a stated probability of detection across defined crossing scenarios (climb, cut, crawl, bridge) and a stated maximum nuisance alarm rate, both demonstrated during a site acceptance test over a defined period. A sensor that performs beautifully in a datasheet and alarms forty times a night in a sandstorm will be switched off within a month, and then the layer does not exist.

Assessment is where most perimeters fail. Cameras must be specified against an operational requirement, not a megapixel count. IEC 62676-4 anchors the familiar categories to pixel densities on the target plane — broadly 25 px/m for detection, 62.5 for observation, 125 for recognition and 250 for identification in the widely used 2014 edition, with the 2025 revision restructuring the framework — so state the category, the target plane and the edition you are working to. Add lighting and infrared illumination as part of the same clause, since neither camera nor analytic works without them.

Finally, keep the clear zone. A boundary with vegetation, stored pallets or a contractor's cabin against it has no detection value, and that condition is created after handover, so it belongs in the operations and maintenance requirements as well as the drawings.

Every gate is a deliberate hole in the boundary, so the first design decision is how few of them you can operate with. The second is the sequence at each one.

A defensible vehicle entry sequence has the same elements in the same order: queuing space held off the public road so that a refused vehicle does not block traffic; driver and vehicle identification; a search or inspection position; an interlocked pair of barriers where the inner barrier cannot open until the outer one is closed; and a final denial barrier that is rated and that can be deployed from the guard position without waiting for a decision chain.

Specify the interlock logic explicitly, including what happens on power failure, on fire alarm and on manual override, because the default configuration of most gate controllers is convenience rather than security. Specify the guard position as well: ballistic protection should be stated with a class and a named standard — for example a bullet resistance class to EN 1522 for the window and door assemblies — rather than described as bulletproof.

Under-vehicle inspection, whether mirrors or a scanning system, needs somewhere to happen that is not the live lane, and the throughput consequences need to be modelled at peak. A vehicle entry point that works at ten vehicles an hour and fails at sixty is a design that was never tested against the operational profile.

The pedestrian layer is where security meets daily life, and where over-specification does the most damage: a lobby that is unpleasant to pass through generates propping, tailgating and workarounds that destroy the layer far more effectively than any attacker.

Specify entrance control against the failure you are preventing. Counting people is a different requirement from preventing an unauthorised person entering behind an authorised one, and each maps to a different equipment family. Powered pedestrian entrance control equipment falls under EN 17352, which is the correct safety reference for turnstiles, speed gates and swing lanes; powered pedestrian doors sit under EN 16005 instead. Naming the wrong one in a specification is a common and avoidable error.

At the envelope itself, deal with the openings that are not doors: service shutters, loading bays, plant rooms, roof access and the ground floor glazing. Loading bays in particular tend to be excluded from the access control scope and then become the route everyone uses, which is why they belong in the layer schedule alongside the main lobby.

Inside the envelope, security stops being about the boundary and starts being about hierarchy. Define zones by consequence — public, general staff, restricted, high security — and then make the credential requirement step up between zones rather than at every door.

EN/IEC 60839-11-1 defines security grades from 1 to 4 for electronic access control, and those grades can be applied per access point. That gives you a clean way to express intent in a specification: a grade for perimeter doors, a higher grade for restricted areas, without naming a product. Pair it with a policy statement — where two-factor is required, where anti-passback applies, where a door must be monitored as well as controlled.

Keep the audit view in mind while zoning. A door that is controlled but not monitored produces no evidence that anything went wrong, and a zone boundary that people can walk around through a stairwell is not a boundary at all. Walk the route on the drawings before it is built.

Layers only behave as a system if the alarms, the video and the access events land in one place with one clock. Specify time synchronisation across all subsystems, association between an alarm and the cameras that cover it, and the ability to produce a single chronological incident record. Without that, an operator investigating an event is reconciling three timelines by hand while it is still happening.

Two failure modes are worth guarding against explicitly. The first is uniform thickness: applying the same level of protection everywhere, which over-spends at low-consequence points and under-spends where it matters. The second is the construction gap — the contractors gate, the temporary fence line and the commissioning period when detection is disabled and the response plan does not yet exist. Both belong in the specification, because neither will appear on a product datasheet.

A layered design is enforceable only if these are written down:

• The agreed response time, stated as a design assumption, with the delay budget for each layer checked against it.
• A layer schedule that lists, for every layer, whether it deters, detects, delays or responds — and the measure that delivers it.
• Approach geometry treated as a design element: achievable speed, standoff, parking control and sightlines.
• The boundary defined as physical element, detection element, assessment element and clear zone, with the clear zone carried into the maintenance obligations.
• Perimeter detection specified by performance: probability of detection across defined crossing scenarios and a maximum nuisance alarm rate, both proven in a site acceptance test.
• Cameras specified against an operational requirement category and target plane per IEC 62676-4, with the edition named, plus the lighting and IR illumination to support it.
• Vehicle entry sequence defined: off-road queuing, identification, inspection position, interlocked barriers, rated final denial barrier, and the interlock behaviour on power failure, fire alarm and override.
• Guard positions specified with a named ballistic class and standard, not the word bulletproof.
• Pedestrian entrance control specified against EN 17352, with powered doors referred to EN 16005 where relevant.
• Internal zones defined by consequence, with an EN/IEC 60839-11-1 grade assigned per access point and a stated policy for two-factor, anti-passback and door monitoring.
• Time synchronisation, alarm-to-camera association and a single incident timeline required across subsystems.
• Security arrangements during construction and commissioning made an explicit deliverable.