“The building has security” can mean very different things to a landlord and a tenant. One may be referring to cameras in the parking garage. The other may assume someone will respond if an employee reports a problem outside the suite after hours.

Both need a more specific answer.

Commercial building security works best when landlords and tenants agree on who controls each space, who authorizes access and who handles incidents. Property management is often positioned to coordinate shared areas and building systems, while tenants manage their employees, visitors and suite operations. The actual division depends on the lease, service agreements, applicable law and how the property is operated.

A useful security plan translates those documents into everyday instructions. It tells people where to report a broken door, who can approve a late delivery and what happens when an urgent call goes unanswered. That clarity matters just as much at a small multi-tenant office building as it does across a commercial campus.

Define Commercial Building Security Responsibilities Before Problems Arise

Start with the lease and related documents, including building rules, security service agreements and any tenant improvement approvals. Review them together rather than assuming one clause describes the entire arrangement.

Identify what the owner has agreed to provide, what the tenant must manage and which decisions require approval. Have counsel resolve unclear obligations or liability questions. An operational responsibility chart helps people carry out an agreement; it does not rewrite the lease or determine legal responsibility after an incident.

It also helps to separate four questions that are easily combined:

• Who approves the security rule or change?
• Who performs the work or operates the system?
• Who pays under the applicable agreement?
• Who confirms that a reported problem has been resolved?

Those answers may point to different people. A property manager might authorize a repair, a contractor might complete it and the lease might govern how the expense is allocated. The tenant reporting the fault still needs confirmation that the door works again.

Avoid using “shared responsibility” as the final assignment. Name a lead for each task and identify the information that lead needs from the other party. Include a backup contact for time-sensitive work.

Use a property-specific responsibility chart

The following is a planning model for a multi-tenant property, not a universal statement of landlord or tenant duties. Adjust it to the lease and actual control of each area.

Security function	Property management coordination	Tenant coordination
Shared entrances and parking	Identify who operates, inspects and repairs shared doors, gates, lighting and security equipment.	Report faults and communicate employee or visitor needs.
Suite access	Document building approval requirements and connections to shared systems.	Identify authorized suite users and request access changes through the agreed process.
Visitors and contractors	Establish shared-entry procedures and any building work approvals.	Identify the host, purpose, permitted location and access window.
Monitoring and response	Confirm contracted coverage, response instructions and building contacts.	Supply tenant contacts, operating hours and relevant exceptions.
Incident records	Define custody, preservation requests and authorized disclosure of building records.	Report relevant facts and preserve tenant-controlled records.

Make the chart easy to find. A procedure buried in a lease file is unlikely to help an employee who discovers a damaged entrance on a Sunday morning.

Separate Common-Area Security From Tenant-Controlled Spaces

Draw the boundaries on a floor plan. Mark shared lobbies, corridors, stairwells, loading areas and parking, along with tenant suites and restricted building spaces. Identify who has authority over each location and which security systems serve it.

The connecting points deserve particular attention. A tenant-controlled door may open onto a shared corridor. A delivery approved by one business may use a loading entrance serving several others. An employee may have access to the building without permission to enter another tenant’s suite.

For a hypothetical example, consider a tenant installing an interior camera near its reception area. Before work begins, the tenant and property manager should review the proposed view, mounting location, network arrangements and any required approvals. If the view extends into a shared corridor, privacy and access to the recordings need attention as well.

Building-wide camera coverage should be equally clear. Tell tenants which areas are included, what the service is designed to do and how to report concerns. Avoid language suggesting that every corner is monitored or that cameras inside the building automatically cover tenant interiors.

EyeQ’s commercial real estate security solutions provide a starting point for discussing remote monitoring across office complexes, commercial parks and standalone properties. The scope still needs to be defined for the individual site.

Assign maintenance and temporary precautions

For each shared security asset, record who receives fault reports, who can dispatch a technician and who approves temporary precautions. Include locks, intercoms, cameras, lighting and supporting connections where relevant.

If a gate cannot close, decide how access will be handled until repair. If a camera becomes unavailable, identify who evaluates the coverage impact and communicates any change in procedures. A maintenance ticket alone does not establish what protection remains available.

Close the loop with the person who reported the problem. Otherwise, tenants may continue using a workaround after repairs, or believe a fault has been resolved when it remains open.

Agree on Access Control and Visitor Management Procedures

A workable access process connects tenant knowledge with building authority. The tenant knows who is joining or leaving its organization; the system administrator needs an authorized request to make the correct change.

Document how access is requested, approved, issued and removed. Specify whether a change affects the suite, building entrance, garage or several locations. Include lost credentials, employee departures, temporary workers and tenant move-outs.

An employee’s last day should trigger the agreed access-removal process. Returning a physical card does not establish that every associated permission has been disabled. Where different parties administer different systems, name the person who confirms completion across them.

Visitors need a separate process. Access control determines whether a credential or other approved mechanism can open an entrance. Visitor management addresses the arrival itself: whom the visitor is meeting, who can approve entry and where the person should go. EyeQ offers visitor management services that property teams can evaluate against those needs.

For contractors, define the work location, permitted hours, tenant host and any building approval requirements. A tenant’s approval to service office equipment should not be treated as blanket authorization for unrelated restricted areas.

Provide a procedure for exceptions. If a contractor arrives without a listed host, staff should know which authorized contact can resolve the request. Avoid informal workarounds such as sharing permanent credentials or leaving a controlled door propped open.

Review security changes for their effect on safe exit and accessibility. OSHA’s exit-route requirements generally require employees to be able to open exit doors from inside without keys, tools or special knowledge. Qualified professionals should evaluate proposed hardware or operating changes against applicable requirements.

Establish After-Hours Monitoring and Incident Response Roles

After-hours arrangements need to reflect the whole property. One tenant may close at five while another hosts evening appointments. Cleaning crews and maintenance contractors may work after both have left.

Create an approved schedule of expected activity and a clear method for reporting temporary changes. A one-time delivery should have a defined access window and contact, rather than an indefinite exception that stays in the instructions for months.

Then explain what happens when activity requires review.

With services such as EyeQ Virtual Guard, video analytics and trained monitoring personnel contribute to detection, verification and response. AI can flag configured activity; it does not establish criminal intent or independently prove that a person is authorized. Monitoring hours, covered areas and available interventions follow the service agreement and site procedures.

The property team should approve instructions that distinguish routine activity, unresolved questions and events requiring escalation. Those instructions should identify when to contact a tenant, notify property management, use an available audio intervention or seek emergency assistance. Emergency services determine their own response.

Give urgent reports a clear route

Employees should know to contact emergency services for an immediate threat, then notify building personnel when safe. They should not have to wait for a landlord or monitoring provider to approve an emergency call.

For other reports, identify a usable after-hours number and backup contact. Distinguish urgent security faults from routine service requests so a broken exterior lock does not wait unnoticed in a general maintenance queue.

Coordinate emergency plans across the building as well. OSHA’s emergency-action-plan standard applies when another applicable OSHA standard requires a plan. Its guidance for multi-employer buildings recommends coordination where building-wide plans are not feasible. Tenant employee instructions should fit with the building’s emergency arrangements, including reporting, evacuation and communication.

A short discussion exercise can expose uncertainty. Ask who would handle a damaged entry door after closing, or how the property would communicate if a normal entrance became unavailable. Resolve conflicting instructions before staff need to use them.

Make Incident Reporting and Follow-Up a Shared Routine

A security report should reach someone who can act on it. Agree on the minimum information needed: location, approximate time, observed behavior, immediate actions and a safe way to contact the reporting person.

Encourage factual descriptions. “Someone tried several suite doors” provides more useful information than an assumption about a person’s intentions.

Determine who can request camera footage and who authorizes release. Property and tenant systems may have different custodians and retention settings. Route preservation requests promptly, limit access to appropriate people and use approved sharing methods. A tenant request should not automatically open access to recordings involving other occupants.

Services such as EyeQ incident reporting can contribute documentation to that process. Confirm what the selected service includes and who at the property receives and reviews the records.

After an incident, assign the follow-up. That may involve repairing hardware, updating an access permission or correcting an outdated contact list. Give each action an owner and a completion date appropriate to the issue.

Revisit the responsibility chart when tenants move, operating hours change or security services are modified. Periodic contact checks can also uncover stale information before it causes a missed handoff.

Clear responsibilities make commercial building security easier to manage. Landlords, tenants and service providers each need to understand their own tasks and how their work connects to the next person’s. A named contact and a tested procedure turn that understanding into something the building can use.

Bring Clearer Coordination to Your Building’s Security

EyeQ helps commercial property teams evaluate remote video monitoring and response needs across their properties. Start with the areas you need covered, the way tenants use the building and the responsibilities your team needs to coordinate.

Explore EyeQ Virtual Guard to discuss a monitoring approach for your commercial building.

Frequently Asked Questions

Who is responsible for security in a commercial building?

Responsibility depends on the lease, applicable law, service agreements and control of the property. Property management often coordinates shared areas and building systems, while tenants manage suite operations and their own personnel. Confirm the actual division in writing and seek legal advice on unclear obligations.

Does building security include the inside of a tenant’s office?

Only if the agreed scope includes it. Shared-area cameras or monitoring do not automatically extend into tenant suites. Confirm coverage boundaries, monitoring hours, response procedures and any tenant-installed security systems.

Who should remove building access when a tenant’s employee leaves?

The tenant should initiate the agreed notification process, and the authorized system administrator should make the applicable changes. If suite and building access are managed separately, assign someone to confirm that each required change is complete.

Who approves visitors and contractors after hours?

The property’s written procedure should identify the tenant host and any required building approval. Define the location, access window and backup contact. A monitoring team should receive those instructions before it is expected to handle exceptions.

Can a tenant request security camera footage from the landlord?

A tenant can submit a request through the property’s designated process. Access and release depend on the applicable agreements, law, privacy considerations and record custody. Provide the time and location promptly so the authorized custodian can assess preservation needs.

Does hiring a monitoring provider settle landlord and tenant responsibilities?

No. A provider performs the services defined in its agreement and site instructions. Landlords and tenants still need to establish approvals, contacts, maintenance arrangements and follow-up responsibilities. Monitoring does not determine their legal obligations.