Allegion's Commercial Family of Brands
.png)
Paul Timm, Director of Education Safety for Allegion, is a board-certified Physical Security Professional (PSP), author of School Security: How to Build and Strengthen a School Safety Program, and a nationally acclaimed expert in physical security. He is also a member of PASS, NCSSD, ASIS International’s School Safety & Security Council and the IASBO (Illinois Association of School Business Officials) Risk Management Committee. He hosts The Changing Face of School Security podcast, highlighting tools & resources from the changemakers in the K-12 industry.
Setting the Scope: Safety vs. Security
Q: What are some of the most common misconceptions school administrators have about what a security assessment actually is, and what it accomplishes?
Paul Timm: The biggest misconception is simply assuming everyone is on the same page about what an assessment entails. I often liken conducting an assessment to planning a vacation. When you say the word “vacation,” one person might picture skiing in the mountains for a long weekend, while someone else pictures two weeks on a tropical beach or a cruise ship. The point is: no two people naturally share the exact same definition.
A security assessment carries that same ambiguity if you don't define the scope early on. Some administrators expect you to audit their security staff. Others think you’re strictly reviewing their Emergency Operations Plan (EOP). Some people even expect a broad risk assessment complete with hazard charts evaluating earthquakes, violence incidents, severe weather, etc.
Another common point of confusion is the difference between school safety and school security. Traditionally:
Securing a school requires a proactive risk-mitigation mindset: protecting assets and people through the intersection of people, processes and technology. Before you begin walking the halls, school leadership and the assessor should sit down to align on goals, clarify definitions and agree on the deliverables. You have to make sure you’re both packing for the same vacation
The Walkthrough Process & The District Layer
Q: The Partner Alliance for Safer Schools (PASS) Guidelines emphasize a layered approach (District-Wide, Digital Infrastructure, Campus Exterior, Building Perimeter, Classroom & Interior). Walk us through your process from the moment you arrive on-site. How do you start, and how does it map to those layers?
Timm: I begin with a 20- to 30-minute meeting with both building and district administrators. This directly aligns with the district-wide layer. Even though most of my questions center on the specific campus I’m assessing that day, there should be quite a bit of standardization across the district, and this gives district leadership a chance to weigh in.
This meeting isn't an evaluation. Instead, it’s an awareness-raising exercise. I’ll start by asking basic inventory and operational questions:
“How many two-way radios do you have in this building?” I can watch the principal mentally count them up: “A few for facilities, some for PE… I think 10?” Then the district administrator may chime in: “Actually, 15 have been assigned to this campus.” Then the principal realizes, “Oh, right, we have one in the main office, one in the nurse’s office…”
Right off the bat, that brief conversation builds mutual awareness, establishes baseline numbers, and helps everyone get aligned.
From there, we don’t necessarily walk each layer in strict, rigid order. The Digital Infrastructure layer, for instance, is a very new and specialized area. I don't claim to have deep IT and cybersecurity expertise, so that checklist is often handed over to the district’s IT director.
For the physical walkthrough, I typically start at the main entrance and walk around the perimeter of the building from the inside and transition naturally through spaces. If I’m checking perimeter doors 8 and 9 and we pass the library or the staff lounge, we’ll step inside.
While we assess every level of the facility, school teams should know that the Classroom & Interior layer is where the highest concentration of audit items lives. That is where students and staff spend the bulk of their day, and it’s where most of the critical physical and operational vulnerabilities are discovered.
Low-Cost Fixes & Hidden Vulnerabilities
Q: Schools often assume they need expensive technology to solve security issues, but they may be addressing areas where gaps don't necessarily exist or overlooking basic vulnerabilities. What low- or no-cost optimizations and fixes do you uncover most often during a walkthrough?
Timm: Many of the recommendations I make are actually low-cost or no-cost. Often, schools already have good infrastructure or systems in place, but they aren’t using them to their fullest capabilities or optimizing them properly.
A great example is optimizing hardwired communication systems. In today’s setting, staff might rely heavily on VoIP phone systems over intercom call buttons. But if the internet goes down, that hardwired intercom system provides essential redundancy. During one walkthrough in a school library, I couldn’t locate the emergency call button near to the PA speaker. When I looked more closely, someone had hung a poster directly over the button. Uncovering it was an immediate, zero-cost fix right there on the spot.
Another common issue is improper system programming. I’ll frequently test the intercom call button in a specialized area, like a P.E. locker room. During one assessment, when the main office answered, I asked them what room number showed on their display. They said, “It says Room 303, but we only have a two-story building.” If an emergency happened and someone pressed that button without being able to speak, the office would have had no idea where to send help. That’s a vulnerability that can cost very little to correct—where potential solutions could include reprogramming or putting a conversion chart by the desk.
We also see simple operational and procedural gaps. Many schools invest in visitor management software but keep a paper sign-in registry sitting open on the front counter. That makes visitor information publicly accessible, potentially creating privacy issues. Adjusting that procedure to keep visitor information confidential costs nothing.
Security signage can also be an issue with an inexpensive solution. Many states require firearm prohibition signs at every exterior entrance, but schools often only post them at the main entrance. You can resolve that across the entire perimeter for very little money. In some jurisdictions, schools can potentially get those signs for free.
The expensive fixes usually come when you’re dealing with antiquated systems, like upgrading a failing video surveillance system, or when hardware costs multiply, such as having to replace classroom locks across dozens of rooms because they don't lock from the inside. But before jumping into major capital investments or high-tech solutions, schools may want to start by identifying the low-hanging fruit and optimizing what they already have.
Frequency & Self-Assessment Strategies
Q: Security isn't a "one-and-done" event. How often should a school conduct a formal security assessment, and what should districts be doing internally to maintain momentum between audits?
Timm: The PASS Guidelines recommend conducting a formal assessment at least once every three years, and I agree with that. While I work with some districts that operate on a five-year cycle, three years usually hits the ideal cadence.
A three-year cycle gives schools a structured way to benchmark their progress over time. For example, the first time you conduct an assessment using the PASS Guidelines, you might find that you meet all Tier 1 baseline criteria and a few Tier 2 items. Continuing the example, three years later, when you reassess, you want to see measurable growth: now you’re fully compliant across Tiers 1 and 2, and actively working your way into Tiers 3 and 4. That kind of continuous, measurable improvement is exactly what PASS is designed to foster.
Between those formal audits, schools shouldn't just wait around. Districts should be conducting self-assessments annually, or even each semester if resources allow. If a district employs a dedicated safety director, part of that person’s job is to keep a constant pulse on building conditions and practices throughout the year. But even if a school doesn’t have a full-time safety director, having building leadership or a local safety planning team walk through with a checklist once a year is immensely valuable.
Fortunately, schools don't have to reinvent the wheel or spend money on assessment frameworks. There are excellent, free resources available:
The important thing is simply maintaining a consistent pulse. Whether through formal third-party audits every three years or internal self-assessments each semester, regular auditing ensures that security stays an active, ongoing priority rather than an afterthought.
Explore our extensive Resources hub to find a complete collection of tools and information to assist and guide you along your journey.
Contact us today to talk about your project needs.
Ⓒ 2025 Allegion all rights reserved
