Facilities Management & Building Security UK Guide 2026
Last updated: 4 October 2026
A facilities management company protects a building by combining access control, CCTV monitoring, manned guarding, key holding and risk assessment under one accountable contract, rather than leaving security to a standalone guarding firm disconnected from the building's day-to-day upkeep. In the UK, this integrated model is increasingly how commercial landlords, developers and residential blocks manage both compliance and physical risk.
Key Takeaways
- A facilities management company delivers security as one strand of a wider service that also covers maintenance, compliance and building operations, not as an isolated add-on.
- Hard FM services, which include fabric and MEP (mechanical, electrical and plumbing) maintenance, generated 58.65% of the global facility management market in 2026, according to Mordor Intelligence (2026).
- Legal responsibility for building security sits primarily with the building owner or occupier under the Health and Safety at Work etc. Act 1974, even when an FM contractor delivers the day-to-day operation.
- Priority First's operational data shows 100% of checkpoint completions across its managed sites now carry a watermarked photo, up from 0% before onboarding, giving clients a provable patrol record rather than a paper log.
- Soft services, the category security sits within, totalled USD 1.1 trillion globally in 2026 and are forecast to reach USD 2.3 trillion by 2035, per GM Insights (2026).
What Does a Facilities Management Company Do for Building Security?
A facilities management (FM) company is a contracted provider that operates and maintains a building's physical infrastructure and, where security is included in scope, also manages access control, surveillance, guarding coordination and emergency response as part of a single service. This distinguishes it from a standalone security guarding firm, which typically only supplies personnel and has no responsibility for the building's fabric, plant or compliance obligations.
In practice, an FM company's security remit typically covers access control systems, CCTV monitoring, key holding and alarm response, coordination of SIA-licensed manned guards, fire and life-safety compliance, and periodic risk assessments. Priority First structures its own contracts this way, pairing facilities management with physical protection so that a single team is accountable for both the building and its security posture.
Priority First's Managing Director, Mo Hassan, has described the reasoning behind this model directly: "Our clients kept asking the same question: you are already in the building day and night, why am I paying someone else to look after it? Combining security with facilities management is not diversification for its own sake — it is one accountable team for the whole building instead of three contractors blaming each other."
The distinction matters most at the point of an incident. When security and building management are separate contracts, a fault in a door closer, a broken CCTV feed and a lapsed alarm contract can each sit with a different supplier, and no one owns the whole picture.
Who Is Legally Responsible for Building Security Under UK Law?
The building owner or occupier carries primary legal responsibility for building security under UK law, specifically under the Health and Safety at Work etc. Act 1974, which places a general duty on employers and those in control of premises to ensure the safety of workers, visitors and the public. An FM company delivering security services acts as a contractor discharging part of that duty, but the underlying legal liability does not transfer away from the owner or occupier simply because a contract exists.
This means a written contract with an FM provider must clearly define which security tasks the contractor performs and to what standard, because gaps in that definition become the owner's exposure, not the contractor's. The Health and Safety Executive (HSE) — Britain's national regulator for workplace health and safety — publishes guidance confirming that both clients and contractors share duties to prevent unauthorised site access.
HSE official Mike Thomas has stated: "Clients and contractors must ensure that unauthorised access onto sites is prevented, both during and outside working hours."
For construction sites specifically, this duty is reinforced by the HSE's press guidance urging construction companies to strengthen site security, which highlights unauthorised access as a recurring and serious risk. A well-drafted FM or security contract should state explicitly who holds keys, who authorises access, and who is accountable if a breach occurs.
What UK Health and Safety and Security Regulations Must FM Companies Comply With?
UK facilities management companies operating in security must comply with a cluster of statutes and regulator requirements that together govern licensing, safety and data handling. The core framework starts with the Private Security Industry Act 2001, which established the Security Industry Authority (SIA) as the regulator requiring individual licences for door supervisors, CCTV operators and manned guards working in licensable roles.
Alongside SIA licensing, several other obligations apply:
- The Health and Safety at Work etc. Act 1974 sets the general duty of care for premises and contractors.
- The Regulatory Reform (Fire Safety) Order 2005 places fire risk assessment duties on the "responsible person" for non-domestic premises.
- The Building Safety Act 2022 introduces stricter accountability for higher-risk residential buildings, relevant to blocks in areas such as Chelsea and Knightsbridge that Priority First serves.
- The Information Commissioner's Office (ICO) regulates CCTV and access control data under UK GDPR, requiring lawful retention and signage.
- Relevant British Standards, such as BS 7958 for CCTV management, guide operational best practice for monitoring rooms.
An FM provider should be able to demonstrate compliance against each of these when asked, not simply assert it. Ask any prospective contractor to show how their contract documents map onto each requirement rather than accepting a general compliance statement.
How Does an FM Company Manage Access Control and Visitor Management?
Access control is the system and process an FM company uses to determine who may enter a building, when, and through which points, typically combining electronic credentials, staffed reception and a visitor log. In a commercial office or residential block, this usually means keycard or fob entry at main doors, a staffed front-of-house desk for visitor sign-in, and an audit trail showing every entry and exit event.
Priority First's concierge and front-of-house management service combines this welcome function with security screening, so the same team that greets a visitor also verifies their access. Deliveries present a particular risk point, since an unverified courier is a common route for unauthorised entry.
On a Chelsea and Knightsbridge development combining construction and occupied space, Priority First now logs every delivery on arrival with photographs and signs it through a chain of custody, rather than leaving it on trust as a paper-based system once did. That same site runs facilities and maintenance tasks on the same platform as security, giving one accountable record for the whole building rather than three separate logs held by three separate contractors.
What Role Does an FM Company Play in CCTV Monitoring?
CCTV monitoring is the continuous or periodic review of camera footage by trained operators who can identify incidents in real time and trigger a response, distinct from simply recording footage for later review. An FM company's role typically covers camera maintenance, live monitoring during agreed hours, footage retention in line with ICO guidance, and escalation procedures when an incident is flagged.
Priority First delivers this through its CCTV monitoring service, feeding footage into the same incident log used by physical patrols, so that footage, response and outcome sit in one record rather than three disconnected systems. This integration proved decisive on a Chelsea and Knightsbridge site combining commercial and construction risk, where CCTV monitoring, key holding, construction security and logistics management all report through a single site log.
The value of combining monitoring with a physical response was demonstrated when a central London site was broken into overnight: Priority First received the call at 12:30, agreed the response on the same call, and had an SIA-licensed operative on site by 14:30 — a two-hour turnaround from first contact to deployment. That kind of response time depends on CCTV alerting a team that already holds keys and already understands the site, which is precisely the gap an integrated FM-and-security contract is designed to close.
How Do FM Companies Coordinate Manned Guarding Services?
Manned guarding is the deployment of SIA-licensed security officers who physically patrol, monitor access and respond to incidents on site, and an FM company typically coordinates this alongside its other building responsibilities rather than treating it as a separate function. Coordination in practice means checkpoint scheduling, officer induction, patrol verification and handover documentation, all managed through a single operational record.
Priority First's physical protection and manned guarding service requires every checkpoint to be completed with a photograph, GPS location and timestamp, so delivered cover is provable rather than merely claimed. Across its largest portfolio, Priority First's operational data recorded over 4,900 photo-backed patrols, each carrying officer ID, GPS and timestamp, as of August 2026.
A large distribution facility in the West Midlands illustrates why this matters: a perimeter too large to secure from a gatehouse alone needed both SIA-licensed officers and dog units for deterrence at scale, with every patrol, incident and handover logged on Priority First's platform. The site's director later said: "I had the pleasure of working with Priority First Security and I have to say, their team is incredibly friendly and helpful... They have completely changed my view on what security guard should be."
Mobilisation speed matters as much as ongoing coverage. Priority First onboarded three new prestige residential sites in Central London, including a 10-checkpoint serviced residence, within a fortnight in July 2026, with checkpoint mapping, officer induction and photographed patrols running from night one — replacing the weeks of "bedding in" that new security contracts traditionally require.
Hard FM vs Soft FM: Where Does Security Sit?
Hard FM refers to the maintenance of a building's physical infrastructure — HVAC, electrical systems, plumbing and structural fabric — while soft FM covers people-facing services such as cleaning, catering, concierge and security. Security services sit within soft FM, but the strongest contracts deliberately blend the two, because a hard FM fault, such as a failed door closer or broken lock, is itself a security vulnerability.
Global market data illustrates the relative scale of each category, and the comparison is worth setting out directly:
| Category | Market Share / Size | Source |
|---|---|---|
| Hard FM services | 58.65% of the global FM market in 2026, driven by mandatory MEP maintenance | Mordor Intelligence (2026) |
| Soft FM services (incl. security) | USD 1.1 trillion globally in 2026, forecast USD 2.3 trillion by 2035 (7.5% CAGR) | GM Insights (2026) |
| Total global FM market | USD 3.01 trillion in 2026, forecast USD 3.72 trillion by 2031 (4.33% CAGR) | Mordor Intelligence (2026) |
Priority First's guide, Building Management vs Security, sets out this distinction in more detail for buyers deciding how to structure a contract. A related question — how building management differs from full facilities management — is addressed in Priority First's guide, Building Management vs Facilities Management.
For residential blocks specifically, Mo Hassan, Managing Director of Priority First, makes the case for combining the two: "Blocks tend to buy security and building management as separate contracts, and the gaps between the two are exactly where problems live. The concierge who notices a leak, the patrol officer who spots a failed door closer — when one team owns the whole building, nothing falls between contracts."
In-House vs Outsourced: What Should a Business Check Before Hiring an FM Company?
Outsourcing building security to an FM company means transferring day-to-day delivery to a contractor while the business retains oversight, and the choice between building an in-house team and outsourcing hinges on scale, cost predictability and access to licensed personnel. An in-house security team requires the employer to hold responsibility for SIA licence checks, training, shift cover and equipment directly, which suits only very large single-site operators.
Before signing with any FM company for security, a business should verify:
- SIA licences for every individual officer, checkable against the Security Industry Authority register.
- Public and employers' liability insurance, with cover levels appropriate to the site's risk profile.
- A written scope of work naming exactly which security tasks fall under FM and which remain with the client.
- Evidence of patrol delivery, such as photo-backed checkpoint records rather than a verbal assurance.
- Data handling practice for CCTV and access logs, consistent with ICO guidance under UK GDPR.
- References from comparable sites, ideally in a similar sector or building type.
Priority First holds 37 documented client contracts on file, of which 28 sit in Chelsea and Knightsbridge, alongside a 5.0-star rating from 63 Google reviews as of September 2026 — the kind of track record a prospective client can check directly rather than take on trust.
Your Building Security Checklist
- Confirm every on-site officer's SIA licence number against the public register.
- Request a written scope of work separating hard FM, soft FM and security responsibilities.
- Ask whether patrol checkpoints are photo-verified or simply logged by hand.
- Check CCTV retention and access policies against ICO guidance under UK GDPR.
- Confirm who holds keys, who authorises access, and how that is documented.
- Establish response times for out-of-hours alarm activations before signing.
- Review the provider's fire risk assessment process under the Regulatory Reform (Fire Safety) Order 2005.
- Ask for a recent client reference or case study relevant to your building type.
FAQ
What does a facilities management company do for building security?
A facilities management company typically manages access control, CCTV monitoring, key holding, alarm response and coordination of manned guarding, integrating these with the building's wider maintenance and compliance obligations. This differs from a standalone security firm, which usually only supplies guarding personnel without responsibility for the building itself.
Is the FM company or the building owner legally responsible for security?
The building owner or occupier holds primary legal responsibility under the Health and Safety at Work etc. Act 1974, even when an FM company delivers the practical security work. A clear contract defining the FM company's exact scope is essential, because any gap in that scope remains the owner's liability.
What is the difference between hard FM and soft FM security services?
Hard FM covers a building's physical infrastructure, such as electrical and mechanical systems, while soft FM covers people-facing services including security, cleaning and concierge. Hard FM generated 58.65% of the global facility management market in 2026, according to Mordor Intelligence (2026), while soft services including security reached USD 1.1 trillion globally that year, per GM Insights (2026).
Do I need SIA-licensed officers for building security in the UK?
Any individual carrying out licensable security activities, such as manned guarding, door supervision or CCTV monitoring in certain contexts, must hold a valid SIA licence under the Private Security Industry Act 2001. A reputable FM provider will confirm every officer's licence status before deployment and can produce evidence on request.
How quickly can an FM security provider respond to an incident?
Response times vary by provider and contract terms, but Priority First's own record shows a break-in at a central London site handled from first call at 12:30 to an SIA-licensed operative on site by 14:30, a two-hour turnaround. Response speed depends heavily on whether the provider already holds keys and site knowledge, which is why integrated FM-and-security contracts tend to respond faster than newly engaged standalone guarding firms.
What should I check before hiring an FM company for security?
Verify SIA licences for all officers, confirm public and employers' liability insurance, request a written scope of work, and ask for evidence such as photo-backed patrol records rather than verbal assurance. Checking recent client references for similar building types is also recommended before signing.
How much does outsourcing building security to an FM company cost?
Costs vary significantly by site size, hours of cover and service mix, ranging from a single concierge-security post at a residential block to a full multi-service contract covering construction, logistics and facilities management. As an illustrative example, one construction-and-commercial site combining key holding, CCTV monitoring, construction security, logistics management and facilities management runs at approximately £280,000 per year, though every quote should be based on a site-specific risk assessment rather than a generic rate.
Securing Your Building with Priority First
The problems this article covers — unclear liability, disconnected CCTV and guarding contracts, unverifiable patrols and slow incident response — are precisely what Priority First was built to remove by combining facilities management with SIA-licensed security under one accountable contract. Every checkpoint across Priority First's managed sites now requires a photograph to complete, with missed areas showing as gaps in the record rather than passing silently.
Priority First protects over £1.6 billion in client assets across prime central London, West London, the West Midlands and Bedfordshire, serving construction, commercial, luxury retail, hotel and residential clients. If your building's security and facilities management currently sit with separate, disconnected contractors, get in touch with Priority First for a site assessment and a scope proposal tailored to your building.
Related Reading
- What Is Key Holding and Alarm Response? UK Guide 2026
- 24/7 Manned Guarding Cost UK 2026: Full Price Guide
- Close Protection Cost Per Day UK 2026 | Full Price Guide
