2.4 Standards, Regulations, Codes & Where to Find Them

Where to Look Up What Governs the Door in Front of You

Physical security assessments collide with codes, regulations, voluntary standards, product listings, and owner rules. Independent OpenExamPrep teaching for published PSP Domain 1 tasks is not a dump of copyrighted clause text and not a claim that a numbered line from a code book is a PSP exam item. The professional skill is how to find the document that actually governs this hospital, data center, warehouse, or campus, and how to handle the usual conflict: security wants the door to hold, life safety wants occupants out.

Life safety typically wins the conflict

On a required egress path, a security preference does not outrank the building official or fire marshal. If a warehouse chains a required exit to stop shrink, the problem is not clever loss prevention; it is an egress violation with injury potential. If a hospital wants a smoke-compartment door on a required exit to fail-secure (stay locked on power loss or fire alarm) because elopement is a fear, the adopted fire code and accessibility rules will often require that door to unlock for egress under emergency conditions. The assessor's job is to name the conflict, bring EHS and the authority having jurisdiction (AHJ) into the plan, and look for hardware sequences that satisfy both where the adopted code allows them—not to write a finding that occupants should wait while security holds the stair.

Three collisions you will actually see:

• Fail-safe versus fail-secure. Fail-safe unlocking on fire alarm or power loss is commonly required on doors that are part of the means of egress. Fail-secure hardware that remains locked is common on doors that are not that egress path, or on special locking arrangements the adopted code expressly allows. Do not specify fail-secure on a required hospital exit because a camera vendor prefers it.
• Delayed egress. Time-delay locking is a code-controlled arrangement (initiation, signage, delay duration, and occupancy limits), not a security gadget you invent on a data-hall door. Whether a delay is allowed, and for how long, is in the edition the AHJ adopted, plus any local amendment. Teach yourself to ask for the sequence of operations and the occupancy classification, not to memorize a single national delay as if it were universal.
• Occupancy. A hospital (healthcare), a warehouse (storage/factory mix), a data hall, and a corporate office campus are not the same occupancy. Hardware that is routine in a business occupancy may be illegal in a healthcare smoke compartment. Occupancy is why you cannot copy a campus lock schedule onto a hospital annex.

How to find the applicable document

Use a lookup path. Write the path in the assessment plan so fieldwork does not guess.

1. Ask the AHJ and facilities which code edition is adopted for this parcel. That is usually an International Building Code (IBC) and International Fire Code (IFC) pair, often with state or city amendments. The book on your shelf is useless if the city is on a different edition.
2. Confirm occupancy classification and use with facilities and the certificate of occupancy, not with the marketing name of the building. A campus childcare center inside an office park is not an office.
3. Ask the fire marshal which fire-alarm and life-safety references they enforce. NFPA 101 (Life Safety Code) and NFPA 72 (National Fire Alarm and Signaling Code) are commonly encountered. Some jurisdictions adopt NFPA 101; others rely on IBC/IFC language that points to related standards. Confirm, do not assume.
4. Check accessibility. The ADA Standards for Accessible Design, plus any state accessibility code, affect hardware height, communication features, and whether a delayed-egress device is even usable for people with disabilities. A warehouse office and a hospital public entrance are both in scope in different ways.
5. Check OSHA egress duties that apply to the employer even when the building official is focused on construction code. Exit routes, panic hardware, and not locking people in are occupational duties. Chaining the warehouse exit is still wrong if the building permit is silent that week.
6. Read the listing mark on the device, then confirm the listing in the laboratory's product directory (for example UL Product iQ). A reader, lock, power supply, or delayed-egress controller is not “equivalent” because the salesperson said so.
7. Collect owner standards: corporate security design criteria, healthcare system lock protocols, data-center tenant manuals. Owner standards can be stricter than code. They cannot authorize a less safe egress condition than the AHJ will accept.
8. Only then look at sector guidance from DHS, CISA, or a regulator, and only after you confirm the facility is actually in that sector and whether the document is voluntary guidance or a binding rule.

Codes and regulations you will actually bump into

IBC and IFC. These model codes, once adopted and amended, drive occupancy, fire-resistance, and many special locking arrangements. Physical security assessors use them as lookup objects, not as novels to quote. Get the adopted edition from the AHJ. Local amendments matter: a city may restrict delayed egress more tightly than the model book.

NFPA 101 and NFPA 72. You will meet them on hospitals, assembly spaces, and fire-alarm matrices that release doors. NFPA 101 is a life-safety reference commonly used in healthcare and other occupancies depending on adoption. NFPA 72 is the usual reference for how detection and notification systems behave, including door release. Read the edition the marshal names. Do not paste handbook commentary into a client report as if you were the code body.

ADA. Accessibility is not optional decoration. Hardware, signaling, and delayed egress that trap or confuse a person with a disability will fail even if a security committee likes the delay. Coordinate with facilities and, in hospitals, with patient-experience and clinical engineering—not only with the integrator.

OSHA egress. Employers must maintain exit routes. A data center that badges every door still needs a legal way out when the badge system is dead. A warehouse that hides an exit behind stored pallets has an operations problem the assessment should record even if the fence is excellent.

Healthcare overlay. Hospitals add CMS conditions of participation and often accreditation life-safety surveys on top of the building code. That overlay is why an assessor who only reads a corporate office lock standard will recommend illegal hardware on a smoke-compartment door. Bring the hospital's life-safety officer into the stakeholder list from section 2.1.

Voluntary standards, listings, and sector guidance

ASIS Physical Asset Protection Standard. This is a voluntary consensus standard. An owner may adopt it as a management framework for identifying assets, assessing risk, and selecting protection. It is not a statute. It does not preempt the fire marshal. It is not a product listing. If the owner has not adopted it, you still look up the adopted code. If the owner has adopted it, you still cannot use it to justify chaining a required exit.

UL listings (and other laboratories). Listings describe tested product performance under defined conditions: access-control units, burglary-resistant electric locking, panic hardware, bullet-resisting glazing, alarm system components, and similar categories. The assessment skill is to read the mark, confirm the model, and see whether the installed application matches the listing (indoor versus outdoor, fire-rated door, delayed-egress accessory). A listing is not a site risk assessment and not a substitute for occupancy rules.

DHS / CISA guidance. Some sectors have federal performance requirements. Many CISA publications are voluntary protective-measure guides. Before you write a warehouse or campus finding that cites a CISA brochure as a mandate, confirm whether a binding rule applies to this facility. Useful guidance can still inform a recommendation; mislabeling it as law damages credibility with the AHJ.

Owner standards. Corporate design criteria, tenant handbooks, and hospital system lock protocols often decide camera placement, badge enrollment, and key control. Put them in the document stack during planning. When owner standard and adopted code conflict on egress, record the conflict and expect the AHJ to win.

Worked conflicts across four facilities

Hospital. Security wants fail-secure maglocks on a behavioral-health smoke-compartment door that is also a required exit. EHS and the fire marshal require release on fire alarm and a legal egress operation. The assessment plan already named EHS as a stakeholder; the survey report should propose listed hardware and a sequence of operations the AHJ will accept, not a memo that elopement risk outranks evacuation.

Data center. Operations wants delayed egress on white-space emergency exits to slow a tailgate. That is a code question for this occupancy and this AHJ, plus a listing question for the delay device, plus an OSHA question if occupants could be trapped during a fire-alarm failure. Measure and ask; do not install a delay because a colocation competitor did.

Warehouse. Loss prevention wants to chain the rear exit on the second shift. OSHA egress and the fire code both object. Functional assessment (section 2.2) should fix the shrink process—seals, cages, dual control—rather than illegal confinement.

Corporate campus. Research wants delayed egress on a lab with chemicals. That door may also be an accessible egress route and part of a hazardous-materials plan. EHS, the AHJ, and the owner laboratory standard all get a vote; the integrator does not get the only vote.

What not to do in reports or exam preparation

Do not paste copyrighted standard text into a client report or a study note as if volume were competence. Do not invent that a specific numbered requirement is on the PSP exam. Do not treat a voluntary ASIS standard, a UL mark, or a CISA brochure as the adopted building code. Do look up the AHJ's edition, the occupancy, the listing, the owner rule, and then write recommendations that occupants can survive.