Security compliance checklist for Colorado schools and government facilities

Most of what follows is not required by a specific statute. Colorado does not mandate a camera count or a door schedule. What Colorado does is set a standard you have to be able to demonstrate you met. The Safe Schools Act (C.R.S. 22-32-109.1) requires every district to adopt and implement a comprehensive safe school plan. The Claire Davis School Safety Act (C.R.S. 24-10-106.3) waives governmental immunity where a school fails to exercise reasonable care against reasonably foreseeable acts of violence, with damages capped at $350,000 per claimant and $990,000 across multiple claimants. Neither law tells you what equipment to buy. Both turn on whether you can show what you had, what you knew, and what you did about it.

Work through this before your next safety plan review or budget cycle. Items that do not apply to your facility can be skipped without weakening the rest.

Access control

• Pull the current credential list and compare it line by line against active employee, substitute, and contractor rosters. Flag every credential that does not map to a current person.
• Confirm in writing who has authority to issue and revoke credentials, and confirm that offboarding revokes access the same day rather than at the next audit.
• Verify that every controlled exterior door reports denials as well as grants. A system that logs only successful entries hides the pattern you most want to see.
• Test door-held-open and forced-door alarms at each controlled exterior opening, then confirm a named person receives them and knows what to do.
• Check that the lock and unlock schedule matches actual building use, including early-arrival staff, custodial shifts, athletics, and after-hours community events.
• Confirm how main-entrance and vestibule hardware behaves on power loss, and confirm that behavior matches what the fire marshal approved. This is a common gap in buildings that have been renovated since the original inspection.
• Confirm the visitor process: who signs in, what record is created, where it lives, and how long it is kept.
• Walk the building and count the doors that are propped, taped, or shimmed during normal operations. Each one is a control you have on paper and not in practice.

Video surveillance, retention, and records requests

• Confirm every camera is recording by checking recorded footage, not the live view. A camera can display a live image and write nothing.
• Verify actual retention in days at the recorder rather than in the original specification. Retention drifts when cameras are added, resolution is raised, or drives fail.
• Confirm who can export footage, whether exports are logged, and who has authority to approve a release.
• Find out which Colorado open records law governs your recorded video and who in your organization decides on release. The answer differs for a school district and a law enforcement agency. Get it from counsel before a request arrives rather than during the response window.
• For schools, determine when recorded video that identifies a student is handled as an education record under FERPA, and who fields those requests.
• Re-walk camera coverage against what each camera was installed to see. Landscaping, portables, new construction, and repurposed rooms change coverage without anyone touching the system.
• Confirm time is synchronized across all recorders and matches the access control system. Footage and door events that disagree on the clock are hard to use together.
• Check available storage and drive health. Recorders fail quietly.

Fire alarm and life safety

• Confirm the annual inspection and test required under NFPA 72 was completed within the last twelve months and that you hold the report.
• Verify the report lists every device tested and every deficiency found, and that each open deficiency has an owner and a closure date.
• Confirm the monitoring communication path is current. Panels still reporting over copper phone lines are a frequent finding in older public buildings.
• Test that a fire alarm activation releases the openings it is supposed to release and does not release the ones it should not.
• Confirm the technicians performing the work hold NICET certification for fire alarm work.
• Keep at least three years of inspection reports somewhere you can hand them to an inspector or an insurer without a search.

Spaces handling criminal justice information

Applies to police and sheriff facilities, dispatch centers, municipal courts, school district offices with law enforcement data sharing agreements, and any room where CJI is processed, stored, or displayed.

• Identify every such room by name and confirm the list is current.
• Confirm physical access to those areas is controlled and logged, and that the authorization list is reviewed on a defined schedule rather than when someone remembers.
• Confirm visitors to those areas are escorted and that the escort is recorded.
• Confirm everyone with unescorted access has completed required screening and training.
• Confirm that integrators, IT vendors, and cleaning contractors working in those spaces are held to the same requirements, and that you have documentation showing it.

Documentation that shows reasonable care

For a Colorado public school this is the section that matters most in hindsight, and it is the one most often thin.

• Keep a written inventory of what security systems exist, where they are, and what they cover.
• Keep every inspection, test, and service record with dates and the name of who performed the work.
• Record the decision trail on known deficiencies: what was found, what was decided, when, and by whom. A documented decision to defer a repair on budget grounds is defensible. The same decision with no record is not.
• Confirm your safe school plan or emergency operations plan describes the systems you have rather than the systems described in a plan written years ago.
• Keep drill records and after-action notes.
• Note the date of your last independent security assessment. If you cannot name it, that is the finding.

What to put on the annual calendar

• Fire alarm inspection and test under NFPA 72
• Full credential audit against current rosters
• Camera coverage walk with the original design intent in hand
• Retention verification at the recorder
• Review of who holds administrative rights in every security system, including former integrators
• Confirmation that monitoring contact and escalation information is current
• Review of the security section of the safe school or emergency operations plan

Frequently asked questions

Does Colorado require schools to have security cameras?

No Colorado statute requires cameras or sets a minimum number. The Safe Schools Act requires each district to adopt and implement a comprehensive safe school plan, and the Claire Davis School Safety Act creates a reasonable care standard that a district has to be able to demonstrate it met. Cameras are one way districts support that standard. Documentation of what you have and how you maintain it carries more weight than the equipment count.

How often should a district audit access credentials?

At minimum annually, and in practice at every point where staffing changes in volume. For most Colorado districts that means the start of the school year, the end of the school year, and after any large contractor engagement. Credentials that outlive the person they were issued to are the most common finding in a district access audit.

How long should a Colorado public agency keep security camera footage?

Long enough to satisfy your own retention policy, any applicable records retention schedule, and any pending records request or litigation hold. There is no single number that fits every agency. The failure to avoid is a written policy that says thirty days while the recorder holds eleven, which is what happens when cameras are added without adding storage.

Who is responsible for fire alarm inspection in a leased public building?

It depends on the lease, and the answer needs to be in writing before the inspection is due. Landlords and public tenants routinely each assume the other is handling it. Ask for the last annual report. If nobody can produce one, that is your answer.

ESI Technologies installs and services access control, video surveillance, intrusion detection, and fire alarm systems for schools, municipalities, and county facilities across Colorado. Technicians hold NICET certification for fire alarm work and CJIS clearance for criminal justice information environments.

Last updated: September 2026