Security by Design (SBD) starts from a simple proposition: security works better when incorporated into a building’s planning, layout and operating concept than when equipment is added after construction decisions are fixed. This is especially important where public access, restricted spaces, vehicle movement, commercial operations and emergency requirements intersect.

The purpose is not to maximize the number of barriers or electronic devices. It is to create appropriate protective arrangements, backed by an understood threat and risk picture, while allowing the premises to function efficiently. Security design should be coordinated with architecture, civil and structural engineering, mechanical and electrical systems, fire-life-safety arrangements, facilities management and the intended security operator.

1. Start with a risk-based brief

At concept stage the owner and consultant should define the assets and functions to be protected, intended users, operating hours, expected access patterns and principal threat scenarios. The TVRA or other appropriate risk assessment informs the security performance objectives. For example, a high-traffic commercial property may need strong separation between public circulation, tenant space, service areas and critical plant without creating congestion at entrance points.

The operational brief should describe who needs to move where, under what authorization, how incidents will be detected and who can respond. Without these inputs, equipment selection becomes detached from the building’s actual needs.

2. Site planning and external boundaries

Early master planning should evaluate perimeter lines, building setbacks, approach routes, landscaping, loading facilities, public transport interfaces and the interaction between pedestrians and vehicles. A development may need to consider unwanted vehicle access, after-hours service entry, areas of poor natural surveillance and protection of critical utilities. Any proposed countermeasure must take account of fire access, accessibility, maintenance and the larger development plan.

The consultant should identify the security intent for each boundary: discourage casual entry, define ownership, regulate access, detect an event or delay an aggressor long enough for response. These are different requirements and should not be conflated.

3. Security zoning and internal circulation

A usable zoning strategy might distinguish public areas, controlled reception zones, staff areas, restricted operational rooms and high-security technical spaces. It should describe identity verification, visitor escort policies, delivery routes, exceptional access and interfaces between zones. The architectural drawings then need to accommodate doors, walls, reception arrangements, secure circulation and access control points.

Zoning should address real workflows. A secure server room is not well protected if routine maintenance personnel regularly need unchecked passage through it, or if the operating team cannot readily grant authorized emergency access.

4. Define systems by operational purpose

CCTV, access control, intrusion detection, intercoms, perimeter sensing, barriers and security management systems should be specified to perform defined functions. CCTV requirements may distinguish observation, detection support, recognition or evidential image needs depending on the use case. Access control should reflect the approved privilege model and emergency egress constraints. Intruder detection needs an agreed alarm response, not just an audible alert.

Integration matters because a single event may involve several systems. The consultant should specify required interfaces, alarm presentation, timestamp alignment, event recording, operator actions and escalation—not assume that products from different manufacturers will simply work together.

5. Work with the wider design team

Security drawings should be reviewed against architectural, structural, façade, M&E, data network and landscape designs. Equipment needs power, connectivity, mounting surfaces, cable routes, access for maintenance and space within plant rooms or control areas. Camera positions may conflict with decorative features; protective barriers may affect pedestrian flow; secure doors must satisfy fire and accessibility obligations. These issues should be identified while they can still be resolved through design coordination rather than variation orders.

Typical deliverables by project stage

Stage Security consulting deliverables Coordination decision
Feasibility / concept Risk-based requirements, zoning principles, initial security concept Agree security objectives and protected assets
Schematic design Outline system arrangements, access points, perimeter concepts, space planning Resolve architecture and operations conflicts
Detailed design Drawings, schedules, system interfaces, technical specifications and acceptance principles Freeze coordinated requirements for procurement
Tender Tender clarifications, technical compliance review, bidder evaluation inputs Confirm what vendors are contractually obliged to deliver
Construction Submittal review, site observation, change assessment and interface coordination Manage deviations from approved security intent
Commissioning Functional tests, integrated scenario tests, defect list and handover review Determine evidence of satisfactory performance

The precise documents depend on the contract, design stage and procurement model.

6. Draw a clear line between design and procurement

A security concept is not a full technical specification. A generic equipment schedule is not a coordinated detailed design. A tender package should translate security objectives into testable performance requirements, interfaces, drawings, quantities or schedule structure, installation standards and documentation duties. A design review should identify assumptions and unresolved issues rather than quietly transferring them to the installing contractor.

For projects procuring a design-and-build solution, the client may retain an independent security adviser to assess the contractor’s proposals against the approved design intent. Independence is particularly valuable when product choices and implementation shortcuts could alter the protection objectives.

7. Construction supervision and technical change control

Protective measures may be affected by construction-stage changes to walls, doors, entrances, electrical services or data networks. Security oversight should review relevant product submissions, approved drawings, interface coordination and installation quality, and record changes that could create new vulnerabilities. A well-run change-control process identifies the reason for a change, its security implication, the approving party and any required re-test.

Project management and construction supervision should not be claimed unless within the actual contracted scope. Some design consultants provide only document review; others assist through commissioning and handover.

8. Testing, acceptance and operational readiness

Acceptance should assess performance against written requirements. Depending on the system, it may include component checks, functional tests, alarm routing, integration behavior, event logging, operator workflow, resilience checks and training records. Testing needs agreed methods, responsibilities, pass/fail criteria and a clear procedure for resolving defects.

Handover documentation should include record drawings, approved equipment and settings information, operating instructions, training, maintenance responsibilities and a defect resolution register. A working security system also needs people and procedures to sustain its performance after occupancy.

9. Retrofitting an existing property

Existing buildings may not permit the same structural changes as new developments. A risk-based retrofit should separate what can be improved operationally, what can be achieved through integration or reconfiguration, and what needs civil works. Site constraints, tenant operations, fire requirements, available infrastructure and downtime should be recorded transparently.

Common design mistakes

Engaging the security consultant after building circulation is fixed; treating CCTV coverage as the entirety of security; failing to define who responds to alarms; selecting products before establishing operational requirements; overlooking maintenance access; omitting integration and acceptance criteria; and assuming a drawn security solution has been verified in operation.

Frequently asked questions

Is Security by Design only for new construction?

No. Its strongest leverage is early in a development, but existing buildings can apply the same risk-led principles to renovations and targeted security upgrades.

Does every Singapore development fall under the statutory SBD process?

No. Under the Infrastructure Protection Act, a specific regulated SBD process applies to designated Special Developments and Special Infrastructures. For a designated project, the Security Plan is prepared by Commissioner-approved Competent Person or Persons for the specified works and submitted to the Commissioner of Infrastructure Protection for approval. Other clients may use security-by-design principles voluntarily or to satisfy contract and stakeholder requirements.

Who should approve the final security design?

Approval responsibilities depend on the development, contractual arrangements and regulatory designation. The consultant should document recommendations and decisions; the owner and relevant competent authorities retain their defined responsibilities.

Singapore regulatory context and further reading

The Singapore Police Force explains the designated developments subject to statutory Security-by-Design arrangements: https://www.police.gov.sg/Knowledge-Hub/Infrastructure-Protection/Special-Developments-Special-Infrastructures. See also its Infrastructure Protection Act overview: https://www.police.gov.sg/Knowledge-Hub/Infrastructure-Protection/Infrastructure-Protection-Act. Requirements must be checked against current official documents for the particular project.

The UK NPSA publishes useful design considerations for entry points and internal spaces: https://www.npsa.gov.uk/building-protection/video-surveillance-access-control-detection-control-rooms/building-entry-points and https://www.npsa.gov.uk/building-protection/building-services-internal-spaces. These are technical guidance sources, not substitutes for Singapore rules.

Next step: Learn more about LORIN Security Design and Security Tender Consultancy.