Security Commissioning Checklist for India (2026): Proving It All Works Before Handover

A security system can be fully installed and still not be ready to accept. Every camera is mounted, every reader is wired, the panel powers up — and yet nobody has yet proved that the alarm actually calls up the right camera, that a fire signal releases the egress doors, that the UPS carries the load when the mains drops, or that a single as-built drawing matches what is on the wall. The security commissioning checklist is the document that closes that gap. It is the overarching gate between a system that is built and a system that is accepted.

This is the parent checklist. It sits above the per-subsystem test sheets — the CCTV testing checklist, the access control testing checklist and the equivalent fire-alarm sheet — and pulls their results together with the things no single subsystem owns: installation quality, integration and cause-and-effect, power and backup, network, cybersecurity basics, the documentation set, operator training and the formal sign-off. It is one of the practitioner deliverables in the professional security resources library.

Scope & how to read this. This is a ready-to-adapt professional template, not authoritative, legal or contractual wording. It is a record and an aid — it does not set the standard. Fire and life-safety pass criteria, test methods and frequencies come from the National Building Code (NBC = SP 7:2026), the relevant Indian Standards, the equipment manufacturer and the local fire officer or Authority Having Jurisdiction (AHJ); verify against those, not against this page. Get professional and legal review for contract documents. Commissioning records of people (footage, access logs) are personal data under the Digital Personal Data Protection (DPDP) Act, 2023 — handle accordingly.

What it is and when it is used

Commissioning is the structured proving of a completed installation against its design, drawings and schedules. The security commissioning checklist is the master record of that proving. It is produced by the commissioning engineer or security consultant, witnessed by the client, project manager or their representative, and it becomes the evidence pack that the handover is built on.

It is used at one specific point in the project lifecycle: at the end of installation, before handover — the gate between "built" and "accepted". You do not start it until the installer declares the works complete; you do not close it until every critical line is a genuine pass or a witnessed, agreed exception. Anything that fails goes onto the snag list, and the rule is simple: you do not hand over, and you do not accept, with open critical snags — above all any open life-safety item.

The areas it covers

A good commissioning checklist is grouped so nothing is forgotten. The groups below are the standard spine — adapt the rows to your actual scope.

• Installation and workmanship. Devices mounted correctly and at the right height, cabling neat, dressed and run as per the cable schedule, labelling on both ends of every cable and on every device, containment and glands complete, no damage. The question is: was it built as designed and to a professional standard.
• Each subsystem functional. Each subsystem proved on its own detailed test sheet — CCTV, access control, intruder alarm, fire alarm, public address, barriers. The commissioning checklist does not repeat those tests; it records that each subsystem sheet is complete, passed and attached. Route to the CCTV testing checklist and access control testing checklist.
• Integration and cause-and-effect. The tests that no single subsystem owns — proving that one system correctly drives another. For example: an intruder alarm triggering a camera call-up and recording; a fire signal releasing electrically-locked egress doors; a duress input alerting the control room. These are the highest-value tests because they are the ones most often skipped.
• Power and backup. Mains supply confirmed, UPS and battery backup present, and — critically — a witnessed runtime test proving the load is carried for the specified duration when the mains is removed. Do not accept the label rating on paper; witness it.
• Network and remote access. Devices addressed as per the schedule, bandwidth and switch configuration sane, time synchronised across the system so logs and footage agree, and any remote or app access working through the intended, secured path.
• Cybersecurity basics. Default passwords changed on every device and panel, unique credentials, unused ports and services closed, firmware at the agreed version, and admin access held by the client rather than left standing with the installer.
• Documentation set complete. As-built drawings, device and cable schedules, IP and address list, configuration backups, operation and maintenance manuals, test certificates, warranties and the training record — all present and matching the installed system.
• Operator training done. The people who will run the system can actually operate it — arm and disarm, review footage, manage access, respond to an alarm — and have signed a training record.
• Formal sign-off. A dated statement, witnessed by both sides, that commissioning is complete, listing any agreed open items and their target dates. No critical snag stays open at sign-off.

Prove the integrations — the part most often skipped

Integration and cause-and-effect testing is where commissioning earns its keep. Subsystems are usually tested by the vendor who supplied them and pass in isolation. What almost nobody proves is the wiring between them — and that is exactly where the highest-consequence failures hide.

The most important of these is a life-safety interlock: on a confirmed fire signal, electrically-locked or maglocked doors on the escape route must release so people can get out. This is not an optional convenience test. It is a life-safety function, and its pass criteria, method and the very requirement to interlock come from the fire code (NBC = SP 7:2026), the relevant standards, the door and lock manufacturer, and the fire officer — never from the security integrator's preference and never from this template. Witness it. Prove it fails safe. If it does not release, that is an open critical snag and the system does not hand over.

Worked example — commissioning checklist (extract)

Example only — adapt to your project. Illustrative rows, generic values. The real pass criteria, especially for fire and life-safety, come from the code, the manufacturer and the fire officer — verify.

The two "Fail" rows are the point of the document: they are captured, numbered, pushed onto the snag list, and they block final sign-off until closed or formally agreed.

Blank template — copy and adapt

Copy this into your own sheet. Keep one row per check, group by area, and never leave the "Witnessed by" column blank for a key test. Add a header block for project name, date, system, commissioning engineer and witnessing party.

Field and column guide

• Area — the group the check belongs to; keeps related items together and lets you scan for a whole missing group.
• Check — one clear, testable statement. Write it so the answer can only be pass, fail or not-applicable. Avoid vague checks like "system works".
• Result — Pass, Fail or NA. Use NA honestly for scope that does not apply, and note why. A blank is not a result.
• Witnessed by — who actually watched the test. For life-safety and integration tests this must be a named person, ideally the client representative and, for fire interlocks, the fire officer. An unwitnessed pass is a weak record.
• Notes — the detail: the snag number raised, the agreed exception, the value observed, the follow-up date. This is where a check becomes traceable.

How to run it — a field guide

• Commission against the design and the schedules, not against "looks fine". The cable schedule, device schedule and drawings are what you are proving the installation against.
• Witness the key tests yourself. Integration, cause-and-effect, power runtime and any life-safety interlock are witnessed live, not accepted on the installer's say-so.
• Prove the integrations, especially the fire-to-egress release, as a life-safety function. Prove it fails safe.
• Snag what fails. Every fail becomes a numbered line on the snag list with an owner and a date.
• Do not hand over with open critical snags — and never with an open life-safety item. That is the one rule the whole checklist exists to enforce.
• Defer fire and life-safety pass criteria to the code and the fire officer. The template records the result; it does not decide what "pass" means for a life-safety function.

Common mistakes

• Paper commissioning — signing the sheet from the office without witnessing the tests. A pass nobody watched is not a pass.
• Integrations untested — every subsystem passes alone, but the wiring between them is never proved. This is the classic gap.
• Handing over with open snags — accepting the system "subject to a few items" that quietly include a critical or life-safety failure.
• No witness named — Result columns filled, Witnessed-by columns blank. The record cannot be relied on later.
• Paper-rated backup — accepting the UPS label instead of a witnessed runtime under load.

How it connects to the other documents

The security commissioning checklist is the hub that the surrounding deliverables feed into and out of:

• Below it sit the per-subsystem testing checklists — the CCTV testing checklist and the access control testing checklist — whose completed, attached results this document rolls up.
• Beside it sits the snag list, which captures every fail and tracks it to closure; the commissioning checklist cannot close until the critical snags do.
• After it comes handover — see the CCTV commissioning and testing guide for how acceptance and the documentation set are received and signed.
• For where all of these deliverables sit together, see the professional security resources guide and the wider security resources library.

Key takeaways

• The security commissioning checklist is the gate between built and accepted — used at the end of install, before handover.
• It is the parent record: it rolls up the subsystem test sheets and adds installation quality, integration, power, network, cybersecurity, documentation, training and sign-off.
• Prove the integrations, especially the fire-to-egress life-safety interlock — witnessed, fail-safe, with pass criteria from the code and the fire officer.
• Witness key tests, snag every failure, and do not hand over with open critical snags.
• Fire and life-safety requirements come from the code (NBC = SP 7:2026), the standards, the manufacturer and the AHJ — this template is a record and an aid, not the standard.

References

• National Building Code of India (NBC), published by the Bureau of Indian Standards as SP 7:2026 — the source for fire and life-safety requirements including egress and door-release behaviour; confirm the current edition and any local amendments with the Authority Having Jurisdiction.
• Bureau of Indian Standards catalogue — verify the current edition of any Indian Standard referenced in your specification at https://www.services.bis.gov.in/
• Manufacturer documentation for each panel, controller, recorder and lock — the authoritative source for test method, configuration and firmware; follow it over any generic instruction.
• Digital Personal Data Protection Act, 2023 — commissioning records containing footage or access logs are personal data; keep access controlled and retention limited.

This is an educational template to adapt, not legal, contractual or life-safety advice. Commissioning, electrical work and any fire or life-safety interlock are qualified professional tasks — engage licensed professionals, witness the tests, and defer all fire and life-safety pass criteria to the code, the manufacturer and the fire officer.