Hotel security: how to organize it, from the entrance to the night shift

Hotel security is the set of physical and procedural measures that protect guests, staff and property. In Türkiye, Article 17(5) of the Regulation on the Qualifications of Tourism Facilities requires electronic and physical security measures around the facility, at entrances and in general-use areas, and leaves the method to the hotel.

Most hotels already have a security arrangement. What they often lack is a piece of paper that says who is responsible for which door at three in the morning, and what the person on duty should do first. The regulation asks for measures; it does not tell you which ones, so the hotel has to decide. After reading this guide you will be able to run a risk walk, assign responsibility, control access at every door, and write down the five responses your night team will actually read.

What does hotel security mean, and what does Turkish regulation actually require?#

Hotel security is the physical and procedural protection of guests, staff, property and reputation. Turkish regulation states the duty in general terms and leaves the choice of measures to the hotel.

Article 17(5) of the Regulation on the Qualifications of Tourism Facilities (opens in a new tab) (Presidential Decision No. 1134, consolidated to the amendment in force 31 August 2026, published on the Presidency's Legislation Information System) requires electronic and physical security measures to protect guests and staff around tourism facilities, at their entrances and in general-use areas. The same paragraph requires all installations and electrical and mechanical equipment to meet standards, be of good quality and be maintained regularly; guardrails of suitable material and dimensions on terraces, balconies, stairs and open corridors; measures against falls at windows; and warning signs at glass, slippery surfaces and changes in floor level.

It does not list which specific security measures must be used. Cameras, guards, key systems, lighting and access control are the hotel's decision, which is why two hotels of the same size can be compliant with completely different arrangements.

Because the duty is general, the burden of proof is practical: an inspector, an insurer or a court will ask what you decided, why, and whether you did it. A written plan is the evidence.

Private security is a separate question. Under Article 3 of the Private Security Services Law (opens in a new tab) (Law No. 5188, Resmî Gazete 26 June 2004, No. 25504), three things need the governor's permission, given on a decision of the provincial private security commission: protecting persons with armed staff, setting up a private security unit within an organization, and having security services provided by a company. The commission may also set the maximum number and qualifications of security staff, the quantity and type of weapons and equipment, and other physical and technical security measures.

The law does not name hotels. It neither requires a hotel to have private security nor forbids it. Confirm your own case with a legal adviser and your governorship before you sign a security contract or hire armed staff. Dates, scope and local practice vary.

How do you carry out a hotel security risk assessment?#

Walk the property three times with three different pairs of eyes, write down what you see against a fixed list, and score each item by how likely it is and how bad it would be.

Walk one, as a guest: arrive by car, by taxi and on foot, and note where you are unseen, where lighting fails, where a stranger could follow a guest through a door, and where a lift opens onto a floor with no line of sight from the desk. Walk two, as someone who wants in: service door, kitchen delivery bay, laundry, staff entrance, roof access, plant room, car park stairs. These are the doors that are propped open at 06:00 and locked at 11:00. Walk three, as a fire warden: exits, corridors, stairwells, assembly point. The same route serves evacuation and security, so record both uses on one sheet.

Record each finding with location, photograph, time of day and who owns the zone. A finding without an owner does not get fixed.

The zones to walk#

Scoring without a spreadsheet#

Score simply: likelihood high, medium or low, and impact the same. Anything high on both goes to the top of the list and gets a date, not a note. Repeat the walk at the start of each season and after any change of layout, contractor or tenant. A new beach bar or a new car park entrance changes the perimeter.

Keep the register. It is the document that shows what you knew and what you did about it.

Who is responsible for hotel security?#

One named person must own the plan, whatever the model: an in-house unit, a contracted company, or trained duty managers with written procedures.

Model one, an in-house unit: staff on the payroll, direct control, and the permission route under Law No. 5188 Article 3 applies if you set up a private security unit within the organization. Model two, a contracted company: the provider holds the licence and the trained staff, and the permission route applies to having security services provided by a company. An organization with its own unit may still use a company when needed. Model three, no dedicated guard: duty managers, front desk and technical staff carry the procedures, with a named manager accountable for the register. This is common in small and seasonal properties and is a legitimate choice if the procedures are written and practiced.

Whichever model, write the delegation: who may enter a guest room, who may ask a guest to leave, who may call the police, who may release footage, who speaks to the press. Undefined authority is the most common failure at night.

Under Article 4 of Law No. 5188, the provincial private security commission is chaired by a deputy governor and includes representatives of the provincial police directorate, the provincial gendarmerie command and the chambers of commerce and industry. A representative of the applicant joins the relevant meeting, and decisions are taken by majority vote. Ending an arrangement outside temporary cases is also a permission matter: an application is made at least one month in advance and the arrangement can be ended by commission decision and the governor's approval. This governs the hiring of licensed guards. It does not replace a hotel's duty to keep a safe environment under the tourism facility regulation, and the two duties are checked separately.

Train the person who covers the night shift on the same procedures as the day team, and test them with a scenario, not a signature sheet.

How do you control access for guests, visitors, staff and contractors?#

Decide for each group where they may go, how you know who they are, and who lets them in, then make the answer the same at every door.

Guests: the room key opens the room and the guest areas, not the store, the plant room or the roof. If the key system cannot express that, the door needs a lock and a person. Visitors: a register at the desk with name, host, time in and time out. A visitor going to a room is the highest-risk case in most hotels, so write the rule and give the desk authority to apply it.

Staff: access by role, not by seniority. Housekeeping needs floors, the kitchen team needs the delivery bay, and neither needs the key cabinet. Write who holds which key and review the list each season. Contractors: sign-in, identity check, scope of work, escort rule, and a named hotel contact. A contractor inside a plant room at night is an access decision, not a maintenance decision.

Key control deserves its own document: who signed out which key, when it came back, and what happens when one is lost. The separate guide to key control in hotels: master keys, store keys and the key log covers the key log in detail.

Doors: check closers, alarms on fire exits, and whether a propped door is reported or ignored. A door alarm nobody answers is worse than no alarm, because it teaches staff that alarms mean nothing.

What should you decide about keys, doors and cameras?#

Decide what each camera and each door is for, who looks at the output, and how long you keep it, because a camera without a purpose is a cost and a liability at the same time.

Cameras: place them for a stated purpose, such as the entrance, the cash desk, the car park and the service door. A camera pointed at a corridor of guest room doors needs a reason you can write down. In Türkiye, camera use meets personal data law: the notice, the placement rules and the retention question are set out in the guide to CCTV in hotels under KVKK: a checklist for notices, placement and footage; read it before you add a camera, not after a complaint.

Retention: keep footage for a defined period and delete on schedule. Footage kept forever is a store of personal data with no purpose. Who watches: name the people who may view live or recorded footage, and require a written reason and a log entry for every review. This protects guests and protects your staff from accusation.

Doors and hardware: closers, peepholes, secondary locks, a safe in the room, and a working procedure for a guest who has lost a key at midnight. Rekey or recode after a loss that cannot be accounted for. Lifts and stairs: a stuck lift is a security event as well as a technical one, because someone is alone in a box and the desk must know how to talk to them and who to call; the guide to hotel elevators: the rules, the maintenance contract and a guest stuck inside covers the response.

Fire exits must stay usable. Security and fire safety pull in opposite directions at the same door, and the fire rule wins; the answer is an alarm, not a lock.

Which events should a hotel write down before they happen?#

Five: fire or evacuation, a medical emergency, a theft, an aggressive guest or intruder, and a failure of power or systems. Each needs a first action, a lead person and a record.

For each event, write three lines: what the first person does in the first two minutes, who takes charge, and who is called next. Anything longer is not read at three in the morning.

Fire and evacuation: the response, the assembly point, the roll call and the guest list. Fire safety has its own legal and technical requirements, covered in the fire safety rules for hotels in Türkiye: a checklist before the fire report; keep the security plan consistent with it. Medical emergency: who is trained, where the kit is, which hospital, and who accompanies the guest. Decide in advance whether staff may enter a room and what they may touch.

Theft: preserve the scene, do not promise anything to the guest, record what was said, notify the insurer and the police as your adviser directs. Never state a conclusion about who did it. Aggressive guest or intruder: a de-escalation script, a two-person rule, a safe room for staff, and a clear line on when to call law enforcement. Power or system failure: torches, keys that work without power, a paper arrival list, and a named person who can reach the technical team.

Every one of these ends in a written record. The guide to hotel incident reports: what to record after an accident, a theft or a dispute sets out what to record and why the wording matters later.

How do you review and rehearse hotel security each season?#

Rehearse the five events once before the season and once mid-season, review the register after every drill and every incident, and change one thing each time.

A drill is a test of the plan, not of the staff. If the drill fails, the plan failed; rewrite the line that failed instead of blaming the person who read it. Review after every real incident within a week, while memories are exact: what happened, what the plan said, what was actually done, and the single change to make.

Re-walk the site at the start of each season and after any physical change: a new terrace, a new gate, a new tenant, a new car park layout. Re-verify contractors and seasonal staff at the same time: identity, scope, escort rule, and who their hotel contact is. Refresh training on the things people forget under pressure: where the assembly point is, how to call the duty manager, how to say no to a visitor, and what not to say to a guest after a theft.

Keep the paperwork in one place: the register, the zone owners, the five responses, the drill notes and the incident reports. One folder that an inspector, an insurer or a new manager can read in twenty minutes is worth more than five systems nobody opens. Cyber incidents belong in the same review cycle but need their own checklist; a ransomware event and a broken door are handled by different people and the same duty manager. The hotel cybersecurity checklist for owners and general managers covers that side.

What to do next#

Walk your own property this week with the zone checklist, and name one person who owns the register. Everything else in this guide, the access rules, the camera decisions, the five written responses and the seasonal review, hangs off those two things. Regulation 1134 asks for measures and leaves the method to you; the method is a document with names and dates in it, tested once before the season starts.