The facility audit your insurance carrier just scheduled.
Most physical security programs aren’t owned by Security — they’re owned by an over-stretched facilities team running multi-site assessments by spreadsheet. RiskWatch ships the facility hierarchy, the assessment library, and the multi-site rollup auditors and insurance carriers actually ask for.
- ASIS PS · FEMA 426 · NFPA 1600 · Workplace Violence libraries
- Region / facility hierarchy with multi-site rollups
- Mobile TVRA · offline-capable · crime-data overlay built in
- For ops directors: facility-level dashboards + finding-to-task workflow
What is physical security assessment software?
Surveyors capture findings on mobile at the site. The board report rolls up the same evening — no PDF reformatting at midnight. One question library — usually the ASIS Facility Physical Security Control Standards — drives every site walk, with findings mapped to NIST 800-53 PE controls and blended with third-party crime data for per-site risk scores. Also called physical security risk assessment software, facility security assessment software, or TVRA software.
Clipboards don't scale. And the board still asks “how risky is each site?”
CSOs we talk to manage 20 to 500 sites. Most are still running TVRAs with paper checklists and email-attached spreadsheets. Here's what that actually costs.
Site walks live in PDFs and clipboards.
Surveyors collect findings on paper, then re-enter them at a desktop. Photos sit in phone galleries. Mobile assessments capture findings, photos, and signatures on-site — even offline.
Likelihood is a guess until you add crime data.
Most physical security programs score likelihood from gut feel. That doesn't survive a board challenge. We blend Cap Index, Security Gauge, and World Aware data into every site's risk score.
47 sites. 47 spreadsheets. One board update.
Ranking sites by risk requires a rollup nobody has time to produce. Auto-prioritized site risk index — top-N, trended, exportable to PDF or Word in two clicks.
Every module a corporate security team needs — in one platform.
Sixteen flagship modules sharing data, permissions, and audit trail. Built around the per-site Risk Register so your portfolio rolls up cleanly across regions, facility types, and business units.
Portfolio risk on one screen
Heat maps, top-N sites by score, control-domain scores, mitigation status — in widgets that read in 10 seconds.
TVRA on any device
Walk the site, capture findings, attach photos and signatures. Sync when you reconnect — no data lost in the field.
ASIS, FEMA, NIST PE built in
ASIS Facility Physical Security Control Standards, FEMA 426/452, NIST 800-53 Physical & Environmental — ship-ready.
1,000+ pre-built questions
Curated by physical-security practitioners. Map every question to a control standard so reports trace to a framework.
Likelihood backed by data
Cap Index CRIMECAST, Security Gauge, and World Aware feeds populate per-site likelihood objectively.
Doors, locks, keys, audit
Track door schedules, lock types, master-key control, badge systems, visitor logs, and access reviews.
CCTV coverage and gaps
Camera placement, retention, monitored vs recorded, blind-spot tracking, and integration with incident response.
Fence-to-foyer assessment
Fencing, lighting, vehicle barriers, gate guards, vegetation control, signage — every layer scored and tracked.
Intrusion · theft · sabotage · WPV
Pre-loaded threat catalog covering intrusion, theft, sabotage, workplace violence, vehicle ramming, and social engineering.
Site risks, rolled up
Each site has its own register; portfolio rollup gives you the enterprise view auditors and boards expect.
Findings that route themselves
Convert findings into tracked tasks for facilities, security ops, or IT — with owner, due date, and proof of close.
Best-practice fixes inline
Every non-compliant question carries pre-mapped remediation guidance from the ASIS standard.
"Who changed this?" answered instantly
Timestamped log of every score change, finding, attachment, and reassignment — admissible in a regulator review.
Set the cadence, stop reminding
Schedule recurring assessments per site type. Alerts when a site is due, overdue, or off the standard.
Onboard 200 sites in an Excel paste
Bulk import sites, contacts, regions, and prior findings. Customize fields without IT involvement.
Board-ready exports
Heat maps, executive summaries, control-by-control compliance, KRI breach trends. PDF, Word, or Excel.
Threats × Vulnerabilities × Assets = Site Risk Score.
Each site risk in the register links to the threats that could trigger it, the vulnerabilities that make it possible, and the assets it would harm. Three connected modules — Threats, Vulnerabilities, Assets — feed into the Site Risk Score so you can trace any number on the heat-map back to the door, lock, or perimeter gap that drove it.
- Threats catalog — intrusion, theft, sabotage, workplace violence, vehicle ramming, social engineering
- Vulnerability tracking — unmonitored doors, blind spots, perimeter gaps, key turnover, weak processes
- Asset register — people, facilities, server rooms, inventory, cash, equipment, sensitive documents
- Per-site risk score — objective, defensible, trended — not vibes-based
Intrusion · theft · sabotage · workplace violence · vehicle ramming · social engineering at reception.
Unmonitored doors · weak access control · CCTV blind spots · perimeter gaps · keyholder turnover.
People · facilities · server rooms · inventory · cash · proprietary equipment · sensitive documents.
Walk · Score · Mitigate · Reassess.
Aligned to ASIS Facility Physical Security Control Standards and ISO 31000. Walk the site on a phone or tablet, score with crime-data overlay, route findings to facilities or security ops as tracked tasks, and schedule the next assessment per site type. Every step lives in the audit trail.
- Walk — mobile, offline-capable, photos and signatures captured on-site
- Score — crime-data overlay populates likelihood; you score impact
- Mitigate — findings convert to assigned tasks with due dates and proof
- Reassess — schedule recurring TVRAs per site type; trend the score
Likelihood, finally defensible.
RiskWatch ingests three commercial geospatial-risk feeds — Cap Index CRIMECAST, Security Gauge, and World Aware — and blends them into the likelihood half of every site's risk score. When the board asks “why does Phoenix West rank ahead of Newark?” you answer with a 7-year crime trend, a localized threat-environment score, and a confidence interval. Not a guess.
- Cap Index CRIMECAST — 7-year crime trend per address, per crime category
- Security Gauge — U.S. localized threat-environment score with confidence interval
- World Aware — Global incident intelligence — civil unrest, geopolitics, travel risk
- Auto-populated likelihood — no more guesswork; auditors and boards see the source
- Confidence-flagged scoring — every score traces to its data source and last-updated date
Every TVRA covers four domains. We score each one separately.
Doors, locks, keys, badge systems, visitor logs, exit devices, master-key control
CCTV placement, retention, monitored vs recorded, blind-spot tracking, integration
Fencing, lighting, vehicle barriers, gate guards, signage, vegetation control
Guard force, post orders, response procedures, incident reporting, after-action review
From first walk to board-ready in five stages.
Most teams complete stages 1–3 within their first week. Stage 4 runs continuously. Stage 5 is on-demand the moment your CSO or auditor asks.
Pick the standard
ASIS Facility Physical Security Control Standards by default. Or FEMA 426/452, NIST 800-53 PE, or your custom library.
Walk the site
Mobile TVRA on any browser-enabled device. Photos, signatures, comments — even offline. Auto-sync when reconnected.
Score with crime data
Likelihood populates from Cap Index/Security Gauge/World Aware. You score impact. The platform calculates risk.
Mitigate and monitor
Findings convert to tasks. Reassessments trigger on schedule. Site Risk Index trends across the portfolio.
Report and brief
Heat maps, executive summaries, control-by-control compliance, KRI breach trends — in two clicks.
The 47-site walk that stopped requiring a war room.
Real corporate security teams. Real before-and-after numbers. Real ASIS-aligned walks.
We did 47 sites in eight weeks. Our previous vendor took 14 weeks for 28. The mobile app and ASIS template alone paid for the year-one license.
“We did 47 sites in eight weeks. Our previous vendor took 14 weeks for 28. The mobile app and ASIS template alone paid for the year-one license.”
“Cap Index integration ended the 'how do you know?' debate. Likelihood scoring stopped being subjective the day we turned the feed on.”
“The board update used to take three weeks of spreadsheet work. Now it's a saved report. Quarterly review went from 'fire drill' to 'thirty-minute walkthrough.'”
If your physical-security program references it, we ship the library.
ASIS Facility Physical Security Control Standards as the default. FEMA 426/452, NIST 800-53 PE, ISO 27001 A.7, plus industry-specific standards for power, transportation, chemical, healthcare, and finance.
Take RiskWatch home before you sign anything.
Three downloads. Use them to evaluate, share with your team, or build the business case for replacing clipboard-and-spreadsheet TVRAs.
Physical Security Assessment Checklist
Forty pages built on ASIS Facility Physical Security Control Standards. Print, walk a site, tally compliance percentage and risk score, and assemble an executive summary using the included template.
- ASIS-aligned 4-domain structure
- Compliance % + risk-score tallies
- Executive summary template
TVRA Site Risk Register Template
Pre-built site register with threat catalog, vulnerability tracker, asset inventory, scoring formulas, and a 5×5 heat-map. Use standalone or as your migration source.
- Threat × vulnerability × asset linking
- Likelihood × impact heat-map
- Per-domain scoring tabs
Physical Security Platform Buyer's Guide
Vendor scorecard, mobile-app comparison, crime-data feed coverage, pricing benchmarks, and implementation timelines by site count. The shortlist tool for corporate-security RFPs.
- Feature matrix · 6 vendors
- Mobile-app side-by-side
- Pricing benchmarks
Common questions, answered up front.
About TVRAs, ASIS, FEMA, NIST 800-53 PE, crime-data feeds, and how RiskWatch handles all of them.
What is physical security assessment software?
How do you conduct a physical security assessment?
What standards do physical security assessments use?
How does crime-data integration work?
What's the difference between physical security and cyber security assessments?
Does the mobile app work offline?
How long does implementation take?
Is there a free trial?
Walk your first site this week.
Start a 30-day free trial — every assessment template, mobile walks, crime-data overlay, and four-domain scoring. No credit card required.
No credit card required · 30-day free trial · Cancel anytime