Hotel Security Checklist
Free and ungated, and organized by the question no other security checklist asks: what kind of proof settles each row? Hardware you can inspect, configurations you must test, records you must audit, and legal programs with statutory deadlines, with the industry's own door-lock standard cited row by row.
The full 72-item hotel security checklist is below: free, no signup, printable, and machine-readable. Two things separate it from every other version of this page. First, it cites the hotel industry's own published door-lock security standard (HTNG, hosted by AHLA), which specifies auto-deadlatch engagement, key voiding at every new occupancy, and a 1,000-entry lock audit trail, and which no competing checklist mentions. Second, it includes the state human-trafficking training and signage mandates that name hotel roles explicitly and carry per-day penalties, which every competing checklist omits entirely.
The checklist
Organized by area, then by the kind of proof each row needs. Field items come from published operator and vendor practice, rewritten and consolidated; rows with a named authority carry it inline.
A. Perimeter and approach
6 itemsParking is where most hotel property crime happens and where the security walk goes least often.
- Perimeter fencing, gates, and walls intact, with no permeable sections or informal paths.Field
- All exterior lighting operational: parking, service yard, and the approach to every entrance.Only a night frame verifies this; a daytime photo of a car park proves nothing about its lighting, which is why this row almost never gets checked.Field
- Parking sightlines unobstructed by landscaping, signage, or parked vehicles.Field
- Landscaping cut back from windows, ground-floor patios, and camera lines.Field
- Vehicle access points controlled per policy; underground parking entry monitored.Field
- Exterior camera housings clean, aimed correctly, and unobstructed by growth or glare.Field
B. Entrances and access control
7 items- Main entrance and lobby under continuous surveillance during open hours.Field
- Side, rear, and service entrances secured, alarmed where required, and never propped.A propped service door is the most photographable security failure in the building, and one of the most common.Field
- Back-of-house doors inventoried, tested, and not visually obvious from public areas.Field
- Emergency exits open freely from inside and cannot be opened from outside.A two-direction physical test; no photo settles both directions.OSHA 1910.22
- Every egress route clear of carts, linen, stock, furniture, and cabling.OSHA 1910.22
- Exit signage illuminated and visible down the full length of each corridor.Field
- Staff-only zones require credentialed access, and the access list is current.Field
C. Guest room hardware, per the industry's own lock standard
13 itemsThe HTNG Door Lock Security Best Practices (2017, hosted by AHLA) are public, free, and cited by no competing checklist. The most common real-world lock failure they address is not a broken lock; it is a sagging door that stops the auto-deadlatch engaging, which quietly re-enables the plastic-carding attack the latch exists to prevent.
- Door closes from a full swing and the auto-deadlatch engages every time, with no frame sag preventing it.The highest-value row on this page, and it needs a push, not a photo.HTNG 2017
- Locking mortise throw meets the minimum length for the door-frame tolerance.The standard specifies a 20mm minimum.HTNG 2017
- Auxiliary anti-pick latch present and functioning.HTNG 2017
- Interior turn-piece engages a secondary bolt, and while engaged no guest key opens the door.HTNG 2017
- A single handle action retracts the deadbolt and all secondary bolts together for emergency egress.HTNG 2017
- Lock is tamper-resistant from the corridor side, with no exposed parts or open ports.HTNG 2017
- Low-battery indicator not warning; battery replacement runs on a program, not on failure.HTNG 2017
- Peephole present, clear, correctly oriented, and not tampered with.Field
- Connecting-room doors lock on both sides, tested rather than assumed.Field
- In-room safe operational, reset to default after each departure, anchored, instructions legible.Field
- No hidden or unauthorized recording devices, checked at the standard locations.A physical sweep; a property that runs this row should document where it looks.Field
- Outlets, fixtures, and smoke-detector housings show no tampering or added hardware.Field
- Nothing left behind by the previous guest in the closet, under the bed, or in the safe.Photo-verifiable only if the routine opens those spaces: a coverage rule.Field
D. Key and credential control
10 itemsThis section answers the question guests actually ask: can the last guest get back in? Under the HTNG standard, the answer must be enforced by configuration, and configuration can only be tested.
- All rental keys from the previous occupancy are voided at each new check-in.HTNG 2017
- Time and zone restrictions applied to every credential class.HTNG 2017
- Duplicate keys carry unique IDs, so any entry traces to a specific card.HTNG 2017
- Master and grand-master credentials held only by named holders, with issue and return logged every shift.Field
- Mechanical override key blanks restricted, not commercially available; every use recorded in the audit trail.HTNG 2017
- Lock audit interrogation verified working and able to retrieve recent entries with date, time, and key ID.The standard specifies capturing at least the last 1,000 room entries.HTNG 2017
- Portable programming devices require an authenticated user, and their use is logged.HTNG 2017
- Physical key inventory reconciled: guest-room spares, back of house, storage, plant rooms, vehicles.Field
- Key cabinets secured and out of guest view; safe keys and codes stored per policy.Field
- Remaining magstripe credentials identified for replacement.The standard is blunt: there is no way to prevent a magstripe card from being copied, which is a serious problem for master keys.HTNG 2017
E. Surveillance and information
8 itemsThe classic information-security failure in a hotel is not a hack; it is a front desk agent saying a room number out loud.
- Every camera on the plan is live, aimed, and recording; the plan count matches the system count.Field
- Recording retention meets the stated policy; storage is not full or overwriting early.Field
- Coverage of elevators, stairwells, service corridors, and cash points confirmed against the plan.Field
- Staff-area surveillance is disclosed to staff and complies with applicable privacy law.Field
- Front desk sightlines to the entrance and elevator lobby unobstructed by signage, displays, or queue furniture.One photo from behind the desk settles it, and it is exactly the kind of condition that degrades gradually as furniture moves.Field
- Guest room numbers never spoken aloud or written where a third party can read them.Field
- Staff verify identity before granting room access or disclosing any guest information.Field
- Guest and staff wifi are separate encrypted networks; hotel systems carry current patches.Field
F. Alarms, fire, and emergency response
9 itemsAccording to the US Fire Administration, smoke alarms were absent in 10 percent of nonconfined fires in occupied hotels and motels, and automatic extinguishing systems in 45 percent.
- Hard-wired smoke detector present and functional in every guest room.15 USC 2225
- Sprinkler system present and maintained where the property exceeds three stories, heads unobstructed.15 USC 2225
- Extinguishers placed, charged, unobstructed, and tagged current across kitchens, dining, meetings, and public spaces.Field
- Linen and combustible storage kept away from cooking areas.Field
- Fire, intruder, and duress alarms tested on schedule with results recorded.Field
- Evacuation plan documented with marked routes and named assembly points, rehearsed with staff.Field
- Guest-room evacuation diagrams current against the actual floor plan.Field
- Access route for emergency medical teams kept clear from entrance to elevators.Field
- Written emergency action plan on file, with a chain of command naming who calls law enforcement and emergency services.Field
G. People, training, and legal programs
9 itemsThe biggest omission in every competing checklist: state trafficking-training mandates are real, dated, name hotel roles explicitly, and carry per-day penalties. North Carolina and Florida are the verified examples here; the patchwork is growing, so check your own state.
- Trafficking reporting procedure documented, naming the National Human Trafficking Hotline or local law enforcement route.NC 130A-511
- Housekeeping, food and beverage, and front-desk staff trained on trafficking awareness within the statutory deadline, and retrained on cycle.Florida: annual, and within 60 days of hire. North Carolina: within 60 days for new hires from July 2025, then every two years.Fla. 509.096
- Training records retained for the statutory period.North Carolina requires records for at least three years after the employee leaves.NC 130A-511
- Required trafficking notice posted at the mandated size, type, and languages, accessible to employees.Florida specifies at least 11 by 15 inches in at least 32-point type, at 2,000 dollars per day for non-compliance: one of the few compliance rows a photograph closes outright.Fla. 509.096
- Employee safety devices issued, charged, paired, and tested for staff working alone in guest rooms.No federal mandate exists; several states and cities have their own, and more than 5,000 hotels have deployed devices under the AHLA program.AHLA 5-Star
- Anti-harassment policy in place and available in the languages staff speak.AHLA 5-Star
- Staff wear visible ID and are trained and empowered to challenge unidentified people in staff areas.Field
- Pre-employment background checks completed per policy and applicable law.Field
- Vendors and contractors signed in, badged, escorted where required, and signed out.Field
H. Assets, cash, and hazardous stores
4 items- Hazardous substances in correct containers, in designated storage, secured against theft and tampering.Chemical stores are a theft and tampering target, not just a safety hazard, which is why this row belongs on the security walk.OSHA 1910.1200
- Cash collection times deliberately varied; counting done in a locked area out of guest view.Field
- Staff radios, phones, and tablets logged in and out, accounted for at shift end.Field
- Guest valuables lockers and safe-deposit facilities operational, with access logged.Field
I. Shift and program level
6 items- Handover conducted with open concerns explicitly passed on, not just filed.Field
- Daily security report compiled: incidents, observations, feedback.Field
- Incident reports written to the standard a claim or a court would require: time, location, persons, actions, evidence secured.The report's real consumer is a legal process; scene photographs are the part a camera contributes.Field
- Findings from the walk fed into onboarding, refresher training, and recognition.Field
- The checklist itself reviewed at least quarterly.Field
- Regulator-required certificates posted and current: elevator certificate of operation, fire suppression certification, pool permit.Intervals vary by jurisdiction; photograph each certificate and read its expiry rather than trusting a remembered cycle.Field
For AI agents and integrations
This checklist ships as structured data inside this page: every item with its section, basis, and photo-verifiability rating, in the #checklist-data JSON block of this document. Fetch this URL and parse that block, or copy it directly. Free to use with attribution to RapidEye.
What a photo settles, and what it cannot
Here is the honest tally, and it is the sharpest one in our checklist library: a hotel security checklist is the least photo-verifiable document in the building, and it is the one where a false attestation does the most damage. Only about a third of the rows above are settled by an image. Nearly every high-consequence item is a physical test (does the auto-deadlatch engage when the door sags), a configuration (are the last guest's keys actually voided), or a record (was the training done before the statutory deadline). A checklist app can collect a checkmark for all of them; it cannot make any of them true.
That is not an argument against verification. It is an argument for being precise about which rows a camera closes (the propped service door, the blocked egress route, the trafficking notice at its mandated 32-point type, the certificate expiry) and which rows need a different kind of proof: a push on a door, a key tried against a re-let room, an audit-trail pull. Where photos do carry the load, RapidEye reads them against the property's baseline and flags what changed; for the room-condition side of the same walk, see the hotel room inspection checklist, which shares the HTNG door rows and carries the cleaning and damage rows this page deliberately leaves out.
The standards behind the rows
Two of these authorities are the page's reason to exist: the industry's own lock standard, which no competing checklist cites, and the state trafficking statutes, which none even mentions. Identifiers are precise so your counsel can verify them.
| Authority | What it requires |
|---|---|
| HTNG 2017 | The HTNG Door Lock Security Best Practices v1.0 (February 2017), hosted by AHLA (ahla.com): deadbolt mortise with traceable override, anti-pick auxiliary latch, auto-deadlatch fitted to door-frame tolerances against carding attacks, 20mm minimum mortise, keys inoperable when the interior bolt is thrown, restricted override key blanks, a lock audit trail of at least 1,000 entries, unique IDs on duplicate keys, and voiding of all rental keys at each new occupancy. RFID strongly recommended over magstripe, which cannot be protected from copying. |
| 15 U.S.C. 2225 | The Hotel and Motel Fire Safety Act: hard-wired single-station smoke detectors in each guest room (per NFPA 74) and automatic sprinklers (NFPA 13/13-R) in properties over three stories. |
| OSHA 1910.22 | Walking-working surfaces: safe means of access and egress, surfaces clear of obstructions, regular inspection, and correction before use. The citation behind the blocked-exit row. |
| OSHA 1910.1200 | Hazard communication: labeled containers and accessible safety data sheets for chemical stores, which double as theft and tampering targets on the security walk. |
| NC G.S. 130A-511 | North Carolina's lodging trafficking statute: a documented reporting procedure, training for housekeeping, food and beverage, and check-in staff (60 days for new hires from July 2025, then every two years), records kept three years after an employee leaves, and penalties from 500 to 2,000 dollars per violation. |
| Fla. Stat. 509.096 | Florida's lodging trafficking statute: annual training for housekeeping and front-desk staff within 60 days of hire, plus a posted sign at least 11 by 15 inches in at least 32-point type in English, Spanish, and other predominant local languages. 2,000 dollars per day for non-compliance, with a 45-day first-violation correction window. |
| AHLA 5-Star Promise | The industry's voluntary program: anti-harassment policies in multiple languages, ongoing training, and employee safety devices, deployed at more than 5,000 of roughly 20,000 covered properties. No federal device mandate exists. |
Quick FAQ
What should a hotel security checklist include?
Nine areas: perimeter and approach, entrances and access control, guest-room lock hardware (per the HTNG standard), key and credential control, surveillance and information handling, alarms and emergency response, people and legal training programs, assets and hazardous stores, and shift-level reporting. The two sections most checklists omit entirely are the lock standard and the state trafficking mandates.
Can a previous guest get back into their old room?
Not on a system built to the industry standard: the HTNG Door Lock Security Best Practices specify that all previous rental keys are voided at each new guest occupancy (masters excepted). But that protection is a configuration, not a law of nature; the checklist row is to verify it is actually enforced on your system, and the lock's audit trail (at least 1,000 entries with date, time, and key ID under the standard) is how you prove what happened.
What hotel security training is required by law?
It depends on the state, and the mandates name hotel roles explicitly. Florida requires annual human-trafficking training for housekeeping and front-desk staff, within 60 days of hire, plus a posted sign with specified size and type, at 2,000 dollars per day for non-compliance. North Carolina requires training for housekeeping, food and beverage, and check-in staff on a two-year cycle, with records kept three years after departure. Other states have their own versions; check your jurisdiction.
Can photos verify hotel security?
Less than any other checklist in this library: 30 of these 72 items are photo-settled (propped doors, blocked egress, the trafficking notice at its mandated size, certificate expiries), but the high-consequence rows are tests, configurations, and records: the auto-deadlatch push test, key voiding, audit trails, training deadlines. Use the camera for what it closes, and different proof for the rest.
Sources
Sources are named at the publisher level with their root domain, rather than linked or titled; every figure is verifiable at the named source.
- HTNG Door Lock Security Best Practices v1.0 (2017) and 5-Star Promise program page, American Hotel and Lodging Associationahla.com
- Lodging human-trafficking statute (G.S. 130A-511), North Carolina General Assemblyncleg.gov
- Lodging human-trafficking statute (509.096), Florida Legislatureflsenate.gov
- Hotel and Motel Fire Safety Act text (15 U.S.C. 2225), Legal Information Institute, Cornell Law Schoollaw.cornell.edu
- Walking-working surfaces and hazard communication standards, Occupational Safety and Health Administrationosha.gov
- Hotel and motel fire statistics report (2014-2016 data), US Fire Administrationusfa.fema.gov
- Hotel security guidance and templates, Mitti (formerly SafetyCulture)mitti.com
- Hotel security checklist, GoAuditsgoaudits.com
- Hotel room security inspection checklist, HospitalityLawyer.comhospitalitylawyer.com
- Hotel security checklist, Hotel Internet Serviceshotelwifi.com
- Hotel safety and security checklist assessment, Real Time Networksrealtimenetworks.com