Gallagher security audit
Who holds a card, which doors does it open, and who checks?
We read your Gallagher Command Centre with read-only access: every cardholder and card, every access group and the doors it opens, every operator and what they can change, and every alarm and how it was handled. Then we tell you which gaps matter, in the order to close them. We are independent of Gallagher, and we do not install, sell or maintain security systems.
Who needs a Gallagher security audit
- Organisations that run Gallagher Command Centre and have never had it checked by anyone other than the company that installed or maintains it.
- Organisations after a restructure, a run of leavers or a lost card that want to know who can still get in.
- Public sector agencies that report against the Protective Security Requirements, and organisations that look after sensitive sites, stock or information.
- Owners, boards and risk committees who want an independent view of who can enter their buildings, and who decides.
What we check
Cardholders and leavers
Who holds an active card or mobile credential, matched against your current staff and contractor lists, and how long access stayed open after people left.
Unassigned and shared cards
Cards that are active but not linked to a named person, generic or shared cards, and people who hold more than one active card.
Access groups and doors
Which access groups open which doors and zones, and at what times. Whether each person’s access still fits their role, and whether anyone reviews it on a regular cycle.
Contractors, visitors and expiry dates
Whether contractor and visitor cards expire on their own, and whether the firms your contractors work for tell you when someone leaves.
Operators and privileges
Who can operate Command Centre, which operator groups they belong to, and whether any account can do everything. Shared logons, unused accounts and installer access are included.
HR and directory link
Whether cardholder records are fed from your HR system or staff directory or kept by hand, and what happens to a card on someone’s last day.
Alarms and response
Which alarms fire most often, how operators acknowledged them, and whether alarms that keep recurring are fixed or cleared each time. Tamper and door-forced alarms get the closest look.
Logs, retention and privacy
Whether events are kept long enough to reconstruct an incident, whether anyone reviews them, who can see cardholders’ personal details, and how long movement and visitor records are kept.
Versions and hardening
Your Command Centre version against the versions Gallagher supports and its published security advisories, and the server set-up against Gallagher’s hardening guidance.
Card technology and network
Which card types your readers still accept, including older 125 kHz cards that can be copied, and whether the system sits on its own network or shares the office network.
Independent of Gallagher
AI Auditors is not part of Gallagher, and we are not a Gallagher installer, integrator or reseller. We do not sell, install or maintain security systems, so we have no system of our own to defend.
How it works
Scope call
We agree which sites and servers are in scope and the read-only access or reports we need, and fix the fee before we start.
Read-only access or an export
You set up a read-only operator account for the period of the audit and remove it when we finish, or your administrator runs the reports we list and sends them. Staff can be listed by staff number instead of name. If you have run Gallagher’s Security Health Check, send us its report too.
A short call
A conversation with whoever runs the system day to day: how cards are issued and cancelled, who can change access, and how alarms are handled.
The engine reads everything
Every cardholder, card, access group, operator and alarm record in scope is checked against the same rule set, not a sample.
Review and report
We read every finding, rank it by risk and write the report, with the evidence for each finding and the exact record or setting to change.
What you get
- A short summary for owners and boards: what is exposed, and what to fix first.
- Findings ranked by risk, each with the evidence and the record or setting behind it.
- A list of cards and operator accounts to cancel or change, by card number or staff number.
- A step-by-step fix list your security team or provider can act on.
- A walkthrough call with both of us.
Talk to us about an audit
A short call to scope it. A fixed fee before we start. Big Four experience, without the junior team or the Big Four fee, in days not months.