How to Build a Five-Year Physical Security CapEx Forecast

A five-year physical security capital forecast is not a prediction of every device that will fail. It is a decision tool.

For the COO, CFO and operations leader, it should answer: What assets exist? Which are risky to support? What must be replaced, when and why? What operating costs follow? What is the consequence of deferral?

Security spending often grows project by project through new sites, repairs, incidents and renovations. The result may be functional, but portfolio data is incomplete and the budget reactive.

A credible forecast brings that portfolio into view. It turns asset condition, end-of-life exposure, service history and business priorities into a sequenced investment plan. It also recognizes that a replacement project is not complete until the new system can be administered, maintained and governed.

Start with the purpose, not the spreadsheet

Before building an inventory, agree on how the forecast will be used. The answer shapes the level of detail.

A finance team may need a five-year envelope and a ranked list of major decisions. Operations may need site-by-site timing to align security work with renovations, lease events, production changes or business continuity windows. IT may need visibility of network, server, identity and cybersecurity dependencies. Corporate Security and Risk may need to see which control gaps are being accepted or addressed.

Define the planning horizon, fiscal-year assumptions and approval thresholds. Confirm which systems are in scope: access control, video, intrusion detection, intercom, visitor management, perimeter systems, associated servers, storage, network dependencies and recurring licences. If certain assets are owned by landlords, tenants or a separate business unit, record that explicitly.

The forecast should be refreshed as sites, failures, technology and business priorities change. Its value comes from that discipline, not a one-time exercise.

Step 1: build a usable asset inventory

The asset inventory is the foundation. It does not need to begin as a perfect configuration management database. It needs to be reliable enough to support decisions and structured enough to improve over time.

Gather integrator documentation, service tickets, drawings, maintenance agreements, software portals, licence and warranty records, invoices and site surveys. Reconcile obvious conflicts rather than importing every list.

Capture at least the following fields for each asset group.

Site, building and area — Links the asset to operational importance and local projects

System and component type — Enables grouping by technology and replacement approach

Manufacturer, model and version — Supports end-of-life, compatibility and support analysis

Installation or commissioning date, if known — Provides a lifecycle starting point

Quantity and configuration — Supports estimating and design validation

Warranty, maintenance and licence status — Identifies immediate commercial exposure

Network, server and identity dependencies — Reveals costs and stakeholders outside the security budget

Criticality and business function — Helps sequence investment according to consequence

Condition and recurring fault history — Separates age from actual performance

Documentation quality — Shows where future service and project risk may be higher

Record confidence as well as data. A site based on recent drawings is more reliable than one based on invoices and a walk-through; that distinction directs validation work.

Step 2: assess condition, supportability and exposure

Age is not a sufficient replacement criterion. Some older equipment remains reliable and supportable; some newer equipment is poorly configured, damaged or dependent on an unsupported application.

A practical condition assessment combines several lenses.

Physical and functional condition

Assess repeat failures, environmental damage, quality degradation, unreliable locks, power, capacity and spares. Review tickets for patterns; recurring faults may indicate a design, power or environmental problem.

End of life and end of support

Track end of sale, end of life and end of support separately. Record the date, source and operational consequence. This is especially important for software, platforms, servers and network-connected devices, where exposure may involve serviceability, cybersecurity or compliance.

Warranty and licence exposure

Bring warranties, service agreements and licences into asset records. A lapsed licence can restrict support; warranty expiry can change the repair case. Show subscriptions and cloud services as operating costs.

Business and risk criticality

Condition must be interpreted in context. A failed camera in a low-consequence area does not have the same priority as unstable access control at a critical facility, even if both assets are the same age.

Assign a simple criticality category tied to operations, safety, regulatory commitments, loss exposure and compensating controls. The purpose is transparent prioritization, not false precision.

Step 3: create a repeatable prioritization model

A simple scoring model explains why one project precedes another; it should inform judgment, not replace it.

For each asset group or project, consider the following factors:

• condition and failure trend;

• end-of-life or end-of-support status;

• business criticality;

• control or compliance gap;

• cybersecurity and technology exposure;

• maintenance cost and serviceability;

• opportunity to align with renovation, relocation or other capital work;

• complexity and lead time; and

• availability of practical compensating controls.

High-criticality assets with unsupported software and recurring failures will usually rise to the top. A stable aging asset can wait for a lower-cost replacement window. Document the rationale so leaders can understand trade-offs and revisit assumptions.

Step 4: turn priorities into a five-year sequence

The five-year plan should not be a flat wish list. Organize it into three horizons.

Year 1: stabilize and close known exposure

The first year usually addresses immediate support, failure, control or compliance concerns. It may include unsupported servers, critical infrastructure failures, urgent documentation remediation, licence renewals or projects already in progress.

Year 1 should also fund asset validation, standards and program controls; without them, future estimates remain unreliable.

Years 2–3: standardize and reduce lifecycle risk

This horizon is often where larger replacements, platform rationalization and site upgrades occur. Bundle work where practical. For example, a site renovation may be the right time to replace legacy access-control panels, improve cabling, update camera coverage and remediate network dependencies in one coordinated project.

Bundle deliberately: weigh mobilization savings and disruption against added scope complexity.

Years 4–5: manage predictable renewal and strategic change

The outer years should show expected renewals, contract or licence milestones, planned expansions and sites approaching lifecycle thresholds. Label their confidence level. Each year, confirm assumptions, firm up scopes and add an outer year.

Step 5: include the operating cost of ownership

A security CapEx plan that excludes operating costs creates an incomplete business case. Every system has an ongoing service model.

Consider the costs below alongside capital investment:

Preventive maintenance — Frequency, inclusions, inspection requirements and site travel

Break-fix service — Labour rates, response commitments, spares and recurring fault trends

Software and licences — Subscription renewals, user counts, device counts and support entitlement

Hosting and infrastructure — Servers, storage, backups, cloud capacity and network changes

Administration — Badge management, access reviews, reporting and user support

Training and documentation — Handover, administrator training and keeping records current

Vendor management — Performance reviews, contract administration and technical oversight

The point is to show whether a capital decision changes the operating cost base and whether the organization can run what it buys.

Step 6: present the forecast in CFO terms

A CFO needs confidence that investment is prioritized, evidenced and tied to business outcomes—not a catalogue of equipment.

Structure the presentation around decisions: portfolio position, material lifecycle exposure, critical gaps, operating commitments, data maturity and the five-year profile grouped by business driver.

Useful categories include risk reduction, lifecycle replacement, business continuity, compliance, site change and efficiency. For each material project, describe the trigger, options, recommended timing, full cost of ownership, consequence of deferral and key dependencies.

Be explicit about uncertainty. Distinguish committed and planned work from forecast exposure and unapproved opportunities, with the confidence level and work needed to refine estimates.

The forecast should also state the decision required. Is the organization being asked to approve a budget envelope, authorize design work, accept a deferral risk or prioritize one site over another? Clear asks prevent a budget review from becoming a technical discussion with no outcome.

Governance keeps the forecast credible

A five-year forecast depends on ongoing ownership. Someone must maintain the asset data, track manufacturer notices, review service trends, update contracts, validate project scopes and convene decisions when priorities change.

This is a core physical security management responsibility. An internal owner, supported by relevant functions, or an outsourced physical security team can maintain the plan and vendor-neutral oversight while the organization retains approval authority.

Use a simple rhythm: asset and contract updates, quarterly risk and project reviews, an annual budget refresh and post-project record updates.

Closing: start with a defensible first version

Do not wait for perfect inventory data before creating a forecast. Begin with the assets and exposures that are known, label assumptions clearly and create a plan to improve the evidence.

A baseline assessment can establish the initial asset, contract and lifecycle view; identify immediate end-of-life or support exposure; and outline the decisions needed for a five-year security budget planning process. That gives leaders a grounded starting point for funding security as a managed enterprise capability.