A Guide To Construction Security For Principal Contractors

Security for principal contractors comes down to one duty under the Construction (Design and Management) Regulations 2015 (CDM 2015).

Making sure the necessary steps are taken to stop unauthorised people reaching your site.

But knowing what counts as “necessary” is the hard part, because there’s no fixed specification to follow, and that’s where your judgement – or expert security advice – comes in.

What Is A Principal Contractor & How Do I Know If It’s Me?

The Health and Safety Executive (HSE) describes the principal contractor as the contractor a client appoints to take charge of the construction phase on any project with more than one contractor.

If you work in a senior or managerial role on a construction project, you’ll usually have been told if you’re acting as the principal contractor. If you’re a small business (a plumber, electrician, or landscape gardener, for instance) working for a domestic client alongside other contractors and nobody’s been appointed, the role falls to whoever controls the construction phase.

That’s not to say the role casually sits with the person with the biggest job.

The client must appoint a principal contractor in writing, as HSE’s guidance on who counts as a principal contractor explains, so ask to see the appointment.

Of the duties HSE lists for the role, these are the ones that impact on site access:

•       Preparing, implementing and regularly reviewing a written construction phase plan

•       Taking steps to prevent unauthorised access to the site

That final point in the list is the one that’s most often up for interpretation.

What Does CDM 2015 Ask Of You On Site Security?

Responsibility for construction site security starts with the principal contractor.

They must make sure the “necessary steps” are taken to stop unauthorised people accessing the construction site, according to Regulation 13(4)(b) of CDM 2015. This is a health and safety responsibility, aimed at stopping people getting close to hazards they shouldn’t be near (including trespassers).

In practice, this can include measures to stop thefts, but as the principal contractor, that’s not what you’re being tested on from a liability standpoint.

You’re not the only one with a duty, though.

Contractors on site must not start work until reasonable steps have been taken to prevent unauthorised access.

On a multi-contractor project, they have to follow your directions and the relevant parts of the construction phase plan. So a subcontractor who props a gate open and creates a health and safety risk becomes your problem as well as theirs.

This becomes a practical test when HSE’s guidance, Managing health and safety in construction (L153), comes in.

It says you should take reasonable steps:

• physically define the boundary with barriers suited to the site and its surroundings
• make sure only authorised people get in

It’s worth saying this is guidance rather than law, but following the guidance is normally enough to comply with legal responsibility.

We’ve covered the wider regulations in our guide to what CDM 2015 says about site security, so we won’t go over that again here.

How Much Security Is Enough?

There’s no legal minimum amount of security you should use.

And L153 says what you do should be proportionate to the risk, so your first job is deciding who could get in and what could happen to them if they do (whether they should be on site or not).

Who Could Get In?

On a new-build estate, it might be children from the neighbouring houses who see an active construction site as a playground.

L153 asks for special consideration where a site has rights of way, adjacent work areas, occupied houses, or children and vulnerable people nearby. But thieves – organised and opportunistic – belong on the list too. Which is the second question.

What they’d find on your site can matter as much as whether they can get on your site in the first place. Open excavations and unfinished drainage are common on active sites. The same can be said when the site is empty.

We’d advise planning on the basis that somebody may get into your site at anytime of the day, during any phase of the build.

Secure your perimeter, control legitimate entry and make high-consequence hazards safe.

HSE’s guidance on protecting the public (HSG151) advises extra barriers around high-risk areas for the same reason.

What Does Enforcement Look Like?

In August 2022, Howard Civil Engineering Ltd was fined £600,000, with £42,952.88 in costs, at Sheffield Crown Court after pleading guilty to breaching Regulation 13(4)(b) and section 3(1) of the Health and Safety at Work etc. Act 1974.

This came after a seven year old boy was found in the early hours at the company’s new-build housing site in Worsbrough, South Yorkshire, trapped in a drainage pipe fixed into the ground ready for fence posts.

It was established he’d suffocated.

HSE’s press release at the time said there wasn’t enough fencing put up to keep unauthorised people out of a site, which was next to a housing estate, busy footpaths and roads. They put it down to poor planning, management and monitoring of the site and its perimeter.

HSE put the failure down to planning, management and monitoring behind the fencing, the part you control as the principal contractor. So walk your perimeter on the assumption that someone will try and get around it, keeping a record of what you find.

Matching Security Measures To Your Site

Every measure should answer a route in or a risk from the section above, with theft protection as a secondary benefit.

Boundaries & Entrance Points

Your boundary is your first line of defence, so fence or hoard the whole perimeter to suit its surroundings. And put up clear signs so no-one can say they didn’t know where your site began. The gates and delivery routes are the weak points, because they have to open.

On a new build estate, for example, you’ll have delivery trucks and flatbeds, site contractor vehicles and vans, independent contractors and visitors, and the occasional lost resident. Every one of those is a possible security vulnerability, and one that you, as the principal contractor, need to address.

That’s where access controls come in, whether you choose fobs, keycards or biometrics for the site. They give you a dated record of who came in and when, which matters when you need to show your logs to an auditor.

Storage, Plant & Vehicles

Workers often choose to keep tools stored on site, because it’s easier than driving around with them and unloading them everyday.

But that’s a big risk for theft. Direct Line Business Insurance’s analysis of police data recorded 25,525 reported tool thefts in 2024, almost half from vehicles, though it covers only responding forces.

Here we’d advise investing in more than the traditional lock-and-key, because a lock won’t stop a determined thief or tell you anyone has been there.

This could come in the form of routine mobile patrols, which give regular out-of-hours checks (we’d advise a more permanent presence for larger plant or machinery) and can disrupt anyone who thinks the site isn’t occupied.

For sites operating with minimal budget or that want a more “hands-off” approach, automated options like the VPOD intruder alarms are worth considering alongside patrols.

The common pitfall is to assume that bigger machines (excavators, telehandlers, compactors) aren’t a target. They’re valuable and, on a large or remote construction site, nobody may notice if they’re moved.

The natural first move is to keep keys separate from machinery. It’s a simple step, but one that’s so often overlooked by contractors and site managers.

Active Builds & Out-Of-Hours Cover

For multi-phase sites and building projects (infrastructure, for example, or large-scale new build estates), any ongoing work or active building sites are a concern once the working day ends. Whether that’s foundations, timberwork, or unoccupied homes, these are all hazards to anyone who gets in.

Trespass is an issue with the law as well as your own risks from theft.

The Occupiers’ Liability Acts deal with civil claims for injury on land, as with the 2022 case we’ve mentioned already, while criminal exposure comes through CDM and the Health and Safety at Work etc.

That’s where manned guarding comes into its own, especially on sites with a gatehouse or entrance area that acts as the main thoroughfare onto the site.

A person at the gate can turn away anyone who shouldn’t be there.

It may also be a good idea to install more autonomous options around the outskirts of active projects for out-of-hours cover.

Mobile CCTV towers can watch the edges of your site between guard visits, as well as being a visible deterrent.

Showing You Took The Necessary Steps

CDM 2015 doesn’t give you a list of security records, so this is a system built from your duties to plan and review the construction phase.

Our guide to writing a construction site security plan covers the detail, but this gives you enough to start with.

Keep dated records that show the plan being followed:

•       a marked site plan, with dated photographs of the boundary and gates

•       boundary and gate inspection logs, including each defect and the date it was fixed

•       access and visitor records showing who came in, when, and on whose authority

•       patrol and monitoring logs from any provider, including late or missed patrols

•       an incident and near-miss register covering trespass, damaged fencing and open gates

And review everything whenever your site changes.

Whether that be a breach, a damaged panel, a new excavation, a moved gate, a move to nights or weekends, or a new contractor or provider. The HSE expects your plan to be reviewed and revised regularly, as well as records that show you kept up with changes.

What Should A Principal Contractor Look For In Their Security Provider?

Any principal contractor should consider the credentials of their chosen security provider, but hiring one doesn’t mean you’ve given them your responsibility. The original duty of care stays with you, which is why you should choose a provider, ideally one that knows how a live construction site works, who can give you the records above.

Here’s what we’d ask before you sign anything:

•       Are the officers licensed by the Security Industry Authority (SIA) and is the company approved under the SIA Approved Contractor Scheme (ACS) for the service you’re buying? Approval is voluntary and activity-specific, so check the register.

•       How are officers vetted (BS7858 is the screening standard to look for) and will they get a site induction before their first shift?

•       Will they survey your site before quoting, explaining why each measure is proportionate to your risks?

•       Can they prove patrols happened and how quickly will you hear about a missed one?

•       Who owns gate control, boundary checks and temporary repairs, or who gets called out of hours?

At ProFM Group we’re happy to answer each of those questions. We’re a security partner of choice with SIKA Everbuild, which you can read more about in their case study.

No two projects have the same path to completion, and we’re firm believers that that needs to be reflected in the way your project is secured. We’ll do all we can, conducting site surveys and strategic analysis, so we deliver the right level of protection for your site.

If you’d like us to look at your site, speak to our team about a site survey.

Proportionate Construction Site Security With ProFM Group

What matters is that your measures match your risks and that you can show how you decided. Having one provider cover the whole site also gives you one set of records to check, which keeps the evidence trail simple.

We’re an SIA Approved Contractor for security guarding and keyholding and our officers are vetted to BS7858 standards as well as passing all right to work and DBS checks. Our construction site security services cover static guarding, mobile patrols and electronic systems for live sites.

Everything starts with a conversation and a site assessment, so call us on 0808 175 6196, email [email protected], or book a call with our team, and we’ll talk through your site security measures.