Incident response playbook template for guards
An incident response playbook template for security teams: the five-step spine plus ready steps for medical calls, trespass, theft and fire evacuation.
An officer standing over a collapsed shopper should not be working out company policy. They should be doing step two. This is a starting incident response playbook for the four or five calls that actually recur. Paste it into your post orders and edit.
A response playbook is a written action sequence for each incident type your officers really see. Every one of them shares the same spine: assess, notify, secure, document, hand off. Build the recurring scenarios first, keep each one short enough to read while walking, and edit the document after every incident that did not go the way it was written.
Why write playbooks at all?
Under stress people fall back on what they have rehearsed. If nobody rehearsed it, they improvise, and improvisation is where the officer walks a witness away from the scene or moves the injured person.
The point is not to script every possibility. It is to make the recurring incidents automatic so that attention is available for the one that is genuinely strange.
What goes in every response, whatever the incident?
The documentation step is the one that decays first. Writing incident reports people read covers what a usable report looks like, and reporting without the paper covers capturing it on the phone while the detail is still fresh.
What mix of incidents should you plan for?
Below is an illustrative distribution for a commercial property, not measured data. Use it to see the shape of the problem, then run the same breakdown on your own reports from the last ninety days. Your mix decides your training order.
Monthly Incident Breakdown
Illustrative mix for a commercial property
Key insight: 41% of incidents are high-priority (trespassing, theft, property damage, medical). Fast response to these events is critical for client satisfaction and liability reduction.
Medical emergency
- Call 911 first for anything life-threatening. Do not assess first and call second.
- Give first aid within your training level and no further.
- Do not move an injured person unless leaving them is the greater danger.
- Clear a path for EMS, including doors, elevators and the parking bay.
- Post someone at the entrance to meet and walk the crew in.
- Write the timeline while it is happening, not afterward.
Trespassing
- Approach calmly and identify yourself out loud.
- Ask who they are and what they are here for. Let them answer.
- If they have no business being there, ask them to leave in plain words.
- Document the contact whichever way it ends, including the ones that end politely.
- If they refuse, call police. Do not make it physical.
- Keep them in sight until they leave or officers arrive.
Theft and property crime
- Do not pursue off the property. This is the line that gets officers hurt and companies sued.
- Note the description while you can still see them: height, build, clothing, direction of travel, vehicle.
- Leave the scene as you found it for the responding officers.
- Identify witnesses before they walk away, and get contact details.
- Pull and preserve the video before the retention window overwrites it.
- File the full report the same shift.
Fire and evacuation
- Pull the alarm if it is not already sounding.
- Call 911.
- Run the evacuation per the site plan, not per your instinct about the nearest door.
- Sweep your assigned areas for occupants.
- Account for people at the assembly point and report the count.
- Nobody re-enters until the fire department says so, including you.
Most sites you work already sit under a client emergency action plan. Under 29 CFR 1910.38, that plan must be in writing and available to employees, and it must cover reporting procedures, evacuation and exit route assignments, who stays behind to shut down critical operations, how people are accounted for afterward, and who performs rescue or medical duties. Ask the client for theirs, and make sure your playbook does not contradict it.
When an incident outgrows one officer and one radio, you need a command structure rather than a longer checklist. That is the subject of the incident command system for security teams.
What has to change per site?
The five site-specific lines
- Local emergency numbers, and the honest response time to this address
- Hazards on this site: chemicals, machinery, height, live rail, whatever it is
- Client escalation contacts, and the hour after which you call the second name
- What access control does during an incident, including which doors fail open
- Who talks to media, and the exact sentence an officer says when a reporter approaches
These belong in the post orders for the site, with a one-page version on the clipboard. A short emergency response quick reference is what an officer actually reaches for at 3am.
Whatever system you keep it in, the copy on the officer's phone has to be the current one. The laminated sheet in the locker will not be. And the report they file at the end of it should carry its own evidence: TeamMap's incident reports attach a photo, a GPS fix and a timestamp to the record as it is written.
What do you do the day after?
Read the report against the playbook. Where the officer deviated, ask why before you correct them. Half the time the playbook was wrong.
Then change the document. A debrief that produces agreement and no edit produces nothing.
Key Takeaways
- Every response shares one spine: assess, notify, secure, document, hand off.
- Build playbooks for the incidents your own last ninety days of reports actually show.
- Never pursue off the property, and never move an injured person unless staying is worse.
- Check your fire and evacuation steps against the client's OSHA emergency action plan so the two do not conflict.
- After every incident, edit the playbook or admit you did not really debrief it.
Continue Reading
Daily activity report template for security guards
A daily activity report template for security guards: header, patrol log, incident log, maintenance notes, and a full sample DAR you can copy.
Security guard shift handoff SOP template
A shift handoff SOP you can lift straight into your binder: the briefing list, joint equipment checks, two signatures, and the paid overlap the FLSA expects.
Security escalation matrix template: who to call
A security escalation matrix template with four severity levels, notification times, named backups and call sequences for medical, fire and active threat.