BS 7499 Static Guarding Record Keeping: UK Guide 2026

Last updated: 21 October 2026

BS 7499 static guarding record keeping means maintaining occurrence books, incident logs, key registers and communication records to the standard set out in BS 7499:2020, the 24-page British code of practice for static guarding. Pulse Operations notes that it requires incident records to be kept for a minimum of 12 months, sequentially numbered, with the guarding contractor normally responsible for compliance unless the contract states otherwise.

Key Takeaways

• BS 7499:2020 requires incident records to be retained for a minimum of 12 months from the date of the event, with entries numbered sequentially, per the BSI Standards Publication BS 7499:2020.
• Telephone and radio communications logged by officers and supervisors must also be kept for at least 12 months under the same standard, per BS 7499:2020.
• Key registers must be physically checked against stored keys every three months by a supervisor or manager, a requirement carried from BS 7499:2013 guidance.
• BS 7499:2020 superseded the 2013 edition on 30 April 2020, per en-standard.eu / Intertek Inform.
• Equipment and uniform records under the related standard BS 10800:2020 must be kept for 36 months, longer than the 12-month BS 7499 minimum, per Provision of Security Services — BS 10800:2020 training slides.

What is BS 7499 and what does it cover for static guarding?

Pulse Operations explains that BS 7499 is a British Standards Institution code of practice that sets out how static guarding security services should be provided, supervised and documented across UK sites. Static guarding means officers posted to a fixed location — a reception desk, a gatehouse, a construction site cabin — rather than roaming patrols covered separately under BS 7960.

The current edition, BS 7499:2020, runs to 24 pages and replaced the 2013 version on 30 April 2020, according to en-standard.eu / Intertek Inform. It covers officer selection and supervision, assignment instructions, equipment, communications, and — critically for anyone running a contract — the documented records a provider must keep to prove the service actually happened.

BS 7499 sits alongside the SIA's Approved Contractor Scheme (ACS) as a benchmark auditors use when assessing a guarding company's service delivery. It's referenced by certification bodies including the National Security Inspectorate (NSI) and the SSAIB, both UKAS-accredited schemes that audit guarding firms against it. For a London estate manager or a facilities director, BS 7499 is effectively the yardstick that decides whether a provider's paperwork would survive an audit, a claim, or a court case.

What record-keeping requirements does BS 7499 set out?

Pulse Operations sets out that BS 7499 record-keeping requirements specify that occurrence books, incident logs, communication records and key registers must be maintained accurately, chronologically, and retained for defined minimum periods. The standard treats documentation as evidence of service delivery, not administrative overhead.

Under BS 7499:2020, every reported incident must be recorded with entries numbered sequentially and retained for a minimum of 12 months from the date of the event. Gaps in numbering, missing pages, or retrospective entries are exactly what an auditor or a claimant's solicitor will look for first.

Communication records carry the same 12-month minimum. Telephone and radio calls made by officers and supervisors during a shift must be logged and kept for at least 12 months, per BS 7499:2020. This matters because a radio log is often the only independent corroboration of when a patrol was raised, an alarm acknowledged, or a lone-worker check made.

Key registers get their own discipline. NSI Technical Bulletin No. 0025 states that supervisory staff or management must check and confirm, every three months, that all stored keys match the key register. On a site with multiple buildings — plant rooms, service yards, residential cores — that quarterly reconciliation is where most key-custody disputes get caught before they become a liability issue.

This is precisely the gap Pulse Operations's own founding operation encountered on a prestige central-London estate running 16 buildings on one nightly round. Before a proper system was in place, the estate could not see delivered-versus-contracted patrols without ringing the office, and multi-building rounds are where patrols quietly go missing. Setting each building up as its own site with its own checkpoints and evidence trail turned one vague "round complete" into 4,100+ recorded patrols since March 2026 — roughly 250 to 280 per building, with 100% of checkpoint completions photo-verified (production data, July 2026). That's the record-keeping discipline BS 7499 is actually asking for, made continuous rather than retrospective.

Who is legally responsible for BS 7499 compliance — guarding company or client?

The guarding company is normally the party responsible for maintaining BS 7499-compliant records, since it employs the officers and controls the occurrence book, patrol logs and communication records on site. Responsibility is a contractual matter, not an automatic legal default — it should be stated explicitly in the service agreement.

In practice, liability can blur. A client who supplies its own occurrence book, insists on paper logs the guarding firm doesn't control, or fails to provide secure storage for key registers can inherit some responsibility for record failures. This is why tender documents increasingly ask bidders to evidence screening to BS 7858 with records per person, not just a policy statement — the same logic applies to BS 7499 record keeping, per Pulse Operations's guide, How to win your next security tender.

Under the Private Security Industry Act 2001, the SIA licenses individual officers, but it's the employer — the guarding contractor — who is accountable for supervision and documentation standards. A client commissioning static guarding should confirm, in writing, who owns the occurrence book, where records are stored, and who produces them if the Health and Safety Executive (HSE) or the police request them after an incident.

Clear contractual ownership also matters for Martyn's Law readiness. The Terrorism (Protection of Premises) Act 2026 will require many publicly accessible venues to evidence security planning, and record-keeping gaps discovered after the fact are far harder to defend than gaps fixed before a contract starts. Pulse Operations's Martyn's Law guide covers the assessment duties this creates for venue operators.

What types of records must be maintained under BS 7499?

Pulse Operations notes that static guarding contracts must maintain several distinct record types, each serving a different evidential purpose: occurrence books, incident reports, patrol logs, visitor logs, key registers and communication logs. Each has its own format conventions and retention expectations under BS 7499:2020.

• Occurrence book — a chronological, sequentially numbered record of everything notable during a shift, from deliveries to contractor access to minor faults.
• Incident reports — detailed accounts of security-relevant events: break-ins, assaults, fire alarms, medical emergencies — retained for a minimum of 12 months per BS 7499:2020.
• Patrol logs — timestamped evidence that scheduled checks or rounds actually took place, ideally with location proof.
• Visitor logs — a record of who entered a site, when, and under whose authorisation; essential for construction sites and multi-occupancy buildings.
• Key registers — a master list of issued keys, reconciled against physical stock quarterly, per NSI Technical Bulletin No. 0025.
• Communication logs — radio and telephone call records, kept for a minimum of 12 months under BS 7499:2020.

The weak point auditors find most often is patrol logs with no independent proof — a signed sheet that only confirms an officer was somewhere, not that the checkpoint itself was actually reached. Pulse Operations addresses this with a mandatory watermarked photograph for every checkpoint — officer, site, GPS, time — so the photo is the completion, not a separate claim about it. Pulse Operations's Guide to proving patrols sets out why this matters more than tag scans, which only prove a device was tapped, not that a check was carried out properly.

How long must static guarding records be retained?

Pulse Operations notes that static guarding records must be retained for a minimum of 12 months under BS 7499:2020 for incidents and communications, while related equipment records under BS 10800:2020 require a longer 36-month retention period. These are minimums, not targets — many contracts and insurers specify longer.

A sensible operational rule is to retain everything for the longest applicable period rather than tracking multiple expiry dates by record type. Civil claims in England and Wales can be brought up to six years after an incident under the Limitation Act 1980, so some security firms and insurers prefer records held well beyond the BS 7499 minimum, provided this doesn't conflict with data protection obligations.

How does BS 7499 record keeping interact with UK GDPR?

BS 7499's retention requirements can sit in tension with UK GDPR, the data protection law that limits how long personal data may be kept to what's necessary for its purpose. Occurrence books and incident reports routinely contain names, vehicle registrations, CCTV references and sometimes health information — all personal data under the UK GDPR and the Data Protection Act 2018.

The Information Commissioner's Office (ICO) enforces the storage limitation principle: data must not be kept longer than necessary. A 12-month BS 7499 minimum is defensible as a legitimate business and legal reason to retain security records, but a guarding firm holding visitor logs for five years with no justification would struggle in an ICO investigation.

Good practice is to separate the operational record from personal data within it where possible — redacting visitor names once a retention period lapses, while keeping anonymised incident statistics longer for trend analysis. This is also why a tamper-evident digital system matters: it proves records weren't altered after the fact, which satisfies both the BS 7499 integrity requirement and GDPR's accountability principle under Article 5(2).

BS 7499 versus BS 7858 and BS 10800: what's the difference?

BS 7499 governs how static guarding services are delivered and documented day to day, while BS 7858 governs the pre-employment screening and vetting of security personnel, and BS 10800 sets broader quality and service provision requirements across the whole security sector. They're complementary, not competing, standards.

BS 10800:2020 has become increasingly important because many SIA ACS assessors now expect to see it referenced alongside BS 7499 and BS 7858 as part of a joined-up quality management system. BS 7858 screening records feed directly into the "People" criterion of the ACS self-assessment, which checks how well a contractor applies BS 7858 and verifies licences against the SIA's register, per Pulse Operations's guide, The ACS self-assessment: how to evidence it.

Understanding which standard governs which record prevents a common confusion: a contractor can be fully BS 7858-compliant on vetting and still fail a BS 7499 audit on occurrence book gaps, because they're separate obligations assessed separately.

What compliance failures appear in static guarding record audits?

The most frequent failures auditors find are gaps in sequential numbering, retrospective entries, missing communication logs, and key registers that haven't been reconciled on the required three-month cycle set out in NSI Technical Bulletin No. 0025. These are the patterns auditors are trained to spot.

Common failure points include:

• Numbering gaps in occurrence books, suggesting pages were removed or entries skipped.
• Patrol logs with no independent verification — a signature alone, with no photo or location proof, is easy to backfill.
• Key registers last reconciled months ago, missing the quarterly check required under BS 7499 guidance.
• Communication logs stored separately from incident reports, making cross-referencing during an investigation slow or impossible.
• Paper records damaged, lost, or illegible after being stored in a guard hut for the required 12 months.

Under the SIA's Approved Contractor Scheme, achieving accreditation requires a score of zero against the scoring framework, with a maximum of +175 points available for good practice beyond the baseline, per ACS Pacesetters / CiTRiX Consultancy Services. Record-keeping failures are exactly the kind of baseline gap that prevents a contractor reaching that zero score, because assessors review site documentation directly rather than taking a policy statement at face value.

Pulse Operations's hash-chained (SHA-256), tamper-evident audit log closes most of these gaps structurally. Every entry is sequentially linked and a built-in integrity check walks the whole chain, so a missing or altered entry is detectable rather than just suspected (as of August 2026).

Paper occurrence books versus digital logging: which format meets BS 7499?

BS 7499 doesn't mandate a specific format — paper occurrence books and digital logging systems can both meet the standard, provided records are accurate, sequential, retained for the required period, and resistant to tampering. The practical difference is how easily each format proves integrity under scrutiny.

Paper logs are familiar, require no technology investment, and are accepted by most certification bodies. Their weakness is physical: pages tear, books get left in guard huts, handwriting is illegible, and nothing stops a retrospective entry being added days later with no trace.

Digital systems timestamp entries automatically and can enforce sequential numbering by design. Pulse Operations's officer app is offline-first with self-healing sync, meaning officers can log incidents and complete checkpoints without signal, with records syncing once connectivity returns — most improvements reach phones over the air the same day (as of August 2026). Checkpoints are completed only by a mandatory watermarked photograph showing officer, site, GPS and time, deliberately without QR or NFC tag scanning, because the photo is itself the proof rather than a claim about a scan.

For context, a landmark West London mixed-use development running 152 checkpoints across retail, residential and plant areas had no way to prove which plant room was actually checked at 3am before this approach was introduced. Making all 152 checkpoints photo-mandatory meant a missed area now shows as a gap in the record immediately, rather than surfacing as a dispute six weeks later — over 540 patrols were logged in the first five months live, from February 2026 (production data, July 2026). This is one of Pulse Operations's founding operation case studies, run inside the team's own London security and FM business before the platform was offered to other operators.

"Book on and book off from the app, against the roster, as it happens. When pay comes from the same record as the patrols, the timesheet argument disappears — and so does the hour of reconciliation your Sunday used to lose." — Mo Hassan, Founder, Pulse

How can a client verify their security provider's BS 7499 compliance?

A client can verify BS 7499 compliance by requesting sample occurrence book extracts, asking who holds NSI or SSAIB certification against the standard, and checking whether retention periods and key register reconciliation match the 12-month and three-month minimums the standard sets. This should be done before signing, not after an incident.

Practical verification steps:

• Ask for the provider's NSI Gold or SSAIB certification number and confirm it covers static guarding specifically, not just alarm monitoring.
• Request redacted sample records — an occurrence book page, an incident report template, a key register extract — to check numbering and dating conventions.
• Confirm retention policy in writing, including who stores records if the contract ends.
• Check SIA licences on the public register for named officers, since BS 7499 compliance means nothing if the workforce underneath it isn't licensed under the Private Security Industry Act 2001.
• Ask how records would be produced for a police request or insurance claim, and how quickly.

This is also where tender evaluation matters. Per Pulse Operations's guide, How to win your next security tender, public-sector buyers under the Procurement Act 2023 regime increasingly score bids on verifiable evidence rather than generic assurance statements — the same scrutiny a private client should apply before committing to a static guarding contract.

Your BS 7499 record-keeping checklist

• Confirm the contract states who owns and stores occurrence books, incident reports and key registers.
• Number every occurrence book entry sequentially with no gaps, and retain it for at least 12 months.
• Log all radio and telephone communications and keep them for a minimum of 12 months per BS 7499:2020.
• Reconcile the key register against physical key stock every three months, signed off by a supervisor.
• Retain equipment and uniform repair records for 36 months in line with BS 10800:2020.
• Review retention policy against UK GDPR's storage limitation principle at least annually.
• Request sample records from any prospective provider before signing a contract.
• Move patrol verification to photo or GPS-based proof rather than signature-only logs.

FAQ

What is BS 7499 in simple terms?

BS 7499 is a British Standards Institution code of practice for how static guarding security services should be delivered, supervised and documented. The current edition, BS 7499:2020, is a 24-page standard published on 30 April 2020.

How long do BS 7499 records need to be kept?

Incident reports and communication logs must be retained for a minimum of 12 months from the date of the event, per BS 7499:2020. Related equipment records under BS 10800:2020 require 36 months, so many firms retain everything on the longer cycle for simplicity.

Who is responsible for keeping BS 7499 records, the client or the guarding company?

The guarding company is normally responsible, since it employs the officers and controls the occurrence book and communication logs. Responsibility should still be stated explicitly in the service contract, because clients who supply their own records or storage can inherit shared liability.

Is BS 7499 a legal requirement in the UK?

BS 7499 is a voluntary code of practice, not a statute, but SIA licensing of officers under the Private Security Industry Act 2001 is a legal requirement. Certification bodies such as NSI and SSAIB audit against BS 7499 as part of wider quality schemes many contracts require.

What's the difference between BS 7499 and BS 7858?

BS 7499 governs how static guarding services are delivered and documented, while BS 7858 governs pre-employment screening and vetting of security personnel. Both feed into the SIA's Approved Contractor Scheme, but they assess different parts of a provider's operation.

Can static guarding records be kept digitally instead of on paper?

Digital logging systems can meet BS 7499 provided they keep records accurate, sequential and tamper-evident for the required retention period. Many providers now prefer digital systems because they enforce sequential numbering automatically and timestamp entries, closing a common gap paper logs leave open.

How does GDPR affect how long security records are kept?

UK GDPR's storage limitation principle requires personal data to be kept no longer than necessary, which can create tension with BS 7499's 12-month minimum. A defensible approach is to retain the full record for the BS 7499 minimum while reviewing and redacting personal data beyond that point, under ICO guidance.

Keeping proof, not promises, on every static contract

Static guarding record keeping only matters when it survives the moment someone actually needs it — an insurer, a solicitor, an SIA assessor, a client asking what happened at 3am. Pulse Operations builds that proof into the job itself: every checkpoint on a static contract is completed by a mandatory watermarked photograph showing officer, site, GPS and time, feeding a hash-chained, tamper-evident daily occurrence book with 18 incident types, rather than a notebook that can be edited after the fact.

That's the same approach that turned 16 buildings on one nightly round from a single vague "round complete" into a verifiable, building-by-building record for Pulse Operations's own founding operation, Priority First, in central London. The client portal shows delivered-versus-contract honestly, including empty states where nothing happened, which is itself useful evidence.

If your current occurrence book, key register or patrol log wouldn't survive an NSI or SSAIB audit tomorrow, it's worth seeing how this works on a real site. Get in touch with Pulse Operations to talk through a BS 7499-aligned setup for your contract, or take the product tour to see the compliance runway and photo-verified patrols in action.

Related Reading

• SIA ACS Self-Assessment Workbook: 2026 UK Guide
• How to Get SIA Approved Contractor Status (2026 Guide)
• ACS Audit Checklist 2026: SIA Assessment Guide (UK)

★ Add pulse-operations.co.uk as a preferred source on Google