SB 553 security guard requirements come down to one narrow but important point: California’s Labor Code §6401.9 does not order every employer to hire a guard, but it does force almost every employer to put a written Workplace Violence Prevention Plan (WVPP) in place, and that plan has to say — in writing — how the business will respond to a violent incident, including “security personnel, if any.” If your business already uses guards, the plan has to name them. If it doesn’t, the plan still has to say who does that job instead. This guide walks through what the law requires, where a licensed guard fits Cal/OSHA’s own model plan, and what the statute leaves to your judgment.
What SB 553 actually did
Senate Bill 553 was signed into law on September 30, 2023, as Chapter 289 of the 2023 session. It amended Labor Code §6401.7 and added a new section, Labor Code §6401.9, which is the operative text everything below is drawn from.
Most of the section’s requirements — the written plan, training, and the violent incident log — became enforceable on July 1, 2024. Cal/OSHA’s own employer fact sheet (published June 2024) is the clearest single-page overview of what changed and what it requires.
Who has to comply — and who doesn’t
Labor Code §6401.9(b) covers “all employers, employees, places of employment, and employer-provided housing,” with a short list of exceptions. Employers already regulated under a separate, existing standard don’t get a second plan layered on top — that’s why healthcare facilities complying with Cal/OSHA’s Title 8, §3342 workplace-violence rule for hospitals are exempt from §6401.9: it’s a different, older, healthcare-specific statute, not a carve-out from workplace violence prevention generally.
The remaining exemptions are narrow: employees teleworking from a location the employer doesn’t control, and worksites with fewer than 10 employees that aren’t open to the public. Retail stores, apartment communities and HOAs, warehouses, distribution centers, and offices — the property types GNS actually serves — are squarely inside the law’s scope, with no size floor once the public has access to the site.
The four types of workplace violence the plan has to cover
§6401.9 defines “workplace violence” as any act or threat of violence occurring at a place of employment, and it groups the exposure into four types:
- Type 1 — violence by someone with no legitimate business at the worksite (the classic robbery or trespass scenario).
- Type 2 — violence directed at employees by customers, clients, patients, students, or visitors.
- Type 3 — violence involving current or former employees, supervisors, or managers.
- Type 4 — violence from someone with a personal relationship to an employee that follows them to work.
A plan that only accounts for strangers walking in off the street misses three of the four categories the statute requires an employer to actually evaluate at its own site — a distinction that matters most for apartment and retail sites, where Type 2 and Type 3 exposure is usually the larger share of real incidents.
What the written plan has to contain
Per the Cal/OSHA fact sheet and §6401.9(c), the plan needs, at minimum:
- The name of whoever is responsible for implementing it.
- A process for employees and their representatives to help develop and review it.
- A no-retaliation procedure for accepting and responding to reports of workplace violence.
- Procedures to identify and evaluate hazards, including scheduled inspections.
- Procedures to correct hazards once they’re identified, specific to each work area.
- Training that repeats annually and after any plan change.
- A post-incident response and investigation procedure.
- An emergency-response procedure covering how employees get help.
- A schedule for reviewing the plan’s effectiveness — at least annually, and after any incident.
Cal/OSHA’s General Industry FAQ confirms the plan can live inside your existing Injury and Illness Prevention Program or stand alone as its own document — the law doesn’t dictate the format, only the content, and it has to be written, not just practiced informally.
Where a security guard actually fits §6401.9
This is where the actual SB 553 security guard requirements question gets answered, and it’s also the part most compliance overviews skip, because the statute is deliberately open-ended here rather than prescriptive. The emergency-response subsection, §6401.9(c)(2)(G)(iii), requires the plan to explain “how to obtain help from staff assigned to respond to workplace violence emergencies, if any, security personnel, if any, and law enforcement.”
Read that closely: the law doesn’t say every employer must have security personnel. It says that if you do, the plan has to document how employees reach them during an emergency — and if you don’t, the plan still has to name who fills that role instead, even if the answer is simply “call 911.”
Cal/OSHA’s own Model Workplace Violence Prevention Plan for General Industry goes a step further and puts a guard directly on the list of hazard corrections an employer might choose. Under “Workplace Violence Hazard Correction,” the model plan’s own example list for making a location less attractive to an outside attacker reads: “Hire security guards and have them patrol the workplace interior and perimeter,” alongside better lighting, signage, and surveillance cameras.
That’s the state’s own template naming guard coverage as one recognized control — not a mandate, one option among several a business can document once its own risk assessment identifies the hazard calling for it. In practice, a licensed guard can support a WVPP in two concrete, sourced ways: as the named emergency-response contact under §6401.9(c)(2)(G)(iii), and as a documented hazard-correction measure the way Cal/OSHA’s model plan describes.
A guard’s on-site observations — unusual access attempts, escalating disputes, repeat visitors — may also be useful input to the periodic hazard inspections §6401.9(c) requires, though the statute itself doesn’t name guards as that inspection’s source. None of this substitutes for the written plan itself; a guard on-site with no WVPP on file is still a citable gap on its own.
Check which stage of the rule you’re actually reading
Labor Code §6401.9 is a statute, not yet a full Title 8 regulation, and that distinction matters for anyone bookmarking this page for later. Cal/OSHA’s own Laws in General Industry page confirms the Division was required to propose a formal standard to the Occupational Safety and Health Standards Board no later than December 31, 2025, with the Board required to adopt it no later than December 31, 2026.
Until that standard is adopted, §6401.9 itself is the enforceable law, and Cal/OSHA is already citing employers under it. But the scope, definitions, or specific plan elements a future Title 8 regulation locks in could differ from the statute described on this page. Don’t treat any section number or requirement here as frozen for the next several years — check the Cal/OSHA workplace violence resource hub for the current rulemaking status before your next annual plan review.
Training and the violent incident log
Training has to happen when the plan is first put in place and at least once a year after that, and it has to be interactive — not a slide deck emailed out with no chance to ask questions. Cal/OSHA’s fact sheet lists the required topics: how to get a copy of the plan, how to report an incident without fear of retaliation, job-specific hazards, and how to access the violent incident log.
That log is a separate recordkeeping obligation. Every incident, whether or not it caused an injury, gets logged with the date, time, location, violence type, a description, and what response occurred — with personal identifying information about the people involved left out. Training records must be kept at least one year; the plan, hazard records, and the violent incident log itself must be kept at least five. If your guards are the ones responding to incidents, their incident report documentation is frequently the raw material a WVPP administrator turns into that log entry, which is one more reason the two processes need to be built to match, not maintained separately.
When the guard company isn’t the employer
Most GNS clients aren’t hiring a guard as an employee — they’re contracting a licensed guard company to fill that role, which is exactly the situation §6401.9(c) anticipates. One of the required plan elements is “methods to coordinate implementation of the plan with other employers, when applicable,” per Cal/OSHA’s fact sheet. On a multi-tenant shopping center, a gated apartment community, or a warehouse campus with a contracted guard vendor, that means the property owner’s WVPP and the guard company’s own safety procedures need to name each other, not operate as two unconnected documents.
In practice that’s a short coordination section: who briefs the guard company on the site’s specific hazard assessment, how an incident gets reported to both the property’s WVPP administrator and the guard company’s own supervisor, and who owns the violent incident log when the person responding isn’t a direct employee. Skipping that coordination step is a common gap — the plan looks complete on paper, but the contracted guard force was never actually folded into it.
What happens if a business doesn’t have a plan
The SB 553 security guard requirements question matters less here than the plan itself: SB 553 gave Cal/OSHA’s Division of Occupational Safety and Health enforcement authority over §6401.9 the same way it enforces any other Title 8 safety requirement: by citation and civil penalty. There’s no WVPP-specific penalty schedule — a missing or deficient plan is cited under Cal/OSHA’s general penalty structure, which the agency adjusts for inflation each January. For citations issued on or after January 1, 2025, the maximum for a general or regulatory violation is $16,285, a serious violation tops out at $25,000, and a willful or repeat violation can reach $162,851.
Those figures aren’t unique to workplace violence citations — they’re what Cal/OSHA can assess for any Title 8 violation once an inspection turns one up. What makes a WVPP gap specifically risky is how it surfaces: usually after an incident, when an investigator is already on-site asking whether the plan required by law actually existed beforehand, and whether the hazard that led to the incident had already been identified and left uncorrected.
Putting it together for a real site
A retail location, apartment community, or warehouse working through this usually lands in the same order: write the plan first, or fold it into the existing IIPP; run the hazard assessment across all four violence types rather than just the robbery scenario; and only then decide whether posted or patrolling coverage belongs on the corrective-measures list Cal/OSHA’s own template describes. That order — plan, then hazard assessment, then staffing decision — is the practical version of the SB 553 security guard requirements this whole page has been walking through.
Some businesses arrive at that last step because a carrier flags it after a claim — a pattern covered in more depth in whether business insurance requires a security guard — others because the risk assessment itself turns up a Type 2 or Type 3 exposure a camera alone doesn’t answer. Either way, guard coverage from Guardian National Security’s licensed guard services is priced the same regardless of why a business needs it: unarmed coverage runs $25–$40/hr, armed $35–$65/hr, and GNS will match or beat a comparable competitor’s quote in Southern California.
A note from Isaac Roberts, Security Specialist
I’m not an attorney, and nothing here is legal advice — if you need a determination about your specific plan, exemption status, or exposure, that’s a conversation for California employment counsel or Cal/OSHA Consultation Services directly, not a blog post. What I can speak to, from the guard-coverage side, is how the emergency-response and hazard-correction pieces of a WVPP actually play out on-site: who a frightened employee is supposed to call, how fast that person can respond, and what gets documented afterward.
When a business asks GNS to be the named “security personnel” in their plan, we build the post orders around the specific hazards their own risk assessment already identified — not a generic patrol script. That’s compliance support, not a substitute for the plan itself, and it only works once the plan exists.
SB 553 Security Guard Requirements: Frequently Asked Questions
What is SB 553 in California?
SB 553 is a 2023 California law, signed September 30, 2023 as Chapter 289, that added Labor Code §6401.9 and requires most California employers to adopt a written Workplace Violence Prevention Plan (WVPP). Its core requirements became enforceable July 1, 2024.
The plan has to name a responsible person, cover four defined types of workplace violence, include hazard identification and correction procedures, an emergency-response procedure, annual training, and a violent incident log. It can stand alone or live inside an employer’s existing Injury and Illness Prevention Program, and it has to be written and accessible to employees, not just practiced informally.
Does SB 553 require every business to hire a security guard?
No. Labor Code §6401.9 doesn’t name security guards as a required hire for any California employer, in any industry. What it requires instead is a written plan explaining how employees get help during a violent incident, including “security personnel, if any,” and law enforcement, whoever those turn out to be at a given site.
Whether guard coverage belongs in that plan depends on the hazard assessment the statute requires each employer to conduct. Cal/OSHA’s own Model Workplace Violence Prevention Plan lists hiring security guards as one example hazard-correction measure among several — lighting, signage, and surveillance cameras among them — not a universal mandate applied the same way to every site.
Who is exempt from California’s workplace violence prevention plan law?
Labor Code §6401.9 exempts employees teleworking from a location the employer doesn’t control, and worksites with fewer than 10 employees that aren’t open to the public. Health care facilities already covered by Cal/OSHA’s separate Title 8, §3342 rule are also exempt from §6401.9.
Retail stores, apartment and HOA communities, warehouses, distribution centers, and offices open to the public or with 10 or more employees fall inside the law’s scope regardless of size. There’s no industry-wide carve-out beyond the categories above, and law enforcement agencies meeting existing POST training standards are exempt as well, since that training already covers comparable ground.
What must a California workplace violence prevention plan include?
Per Labor Code §6401.9(c) and Cal/OSHA’s employer fact sheet, a compliant California workplace violence prevention plan needs a named responsible person, employee-involvement procedures, a no-retaliation reporting process, hazard identification and correction procedures, an emergency-response procedure, annual interactive training, and a documented post-incident investigation process for every reported case.
The plan must also set a schedule for reviewing its own effectiveness — at minimum annually and after any workplace violence incident. It must be written, kept accessible to employees and Cal/OSHA representatives, and specific to the hazards of each work area rather than a generic template pulled off the internet and left unedited.
What is the violent incident log and how long must it be kept?
The violent incident log is a required recordkeeping document under §6401.9 that captures every workplace violence incident — whether or not it caused injury — including the date, time, location, violence type, description, and response taken, with personal identifying details left out.
Cal/OSHA requires the log, the written plan itself, and hazard-identification records to be retained for at least five years. Training records have a shorter minimum retention of one year. A security guard’s own incident report is often the source document a WVPP administrator uses to complete a log entry.
If I contract a security guard company, does that satisfy SB 553’s coordination requirement?
Not automatically, and this is a step many California businesses skip. §6401.9(c) requires “methods to coordinate implementation of the plan with other employers, when applicable” — language that covers a property owner and a contracted guard vendor operating side by side on the same site.
That means the property’s WVPP has to actually name the guard company’s role, how incidents get reported to both parties, and who maintains the violent incident log when the responder isn’t a direct employee. A guard company operating with its own separate safety procedures that never reference the property’s plan leaves that coordination requirement unmet on paper, even if the coverage itself is solid.
How much does a licensed security guard cost in California?
Licensed unarmed guard coverage for a California workplace violence prevention plan typically runs $25–$40 per hour in Southern California, and armed coverage runs $35–$65 per hour, depending on the site, shift length, and assessed risk level. These are Guardian National Security’s published regional rates, not a statewide fixed schedule.
Mobile patrol and event coverage are priced separately, generally $45–$70 and $30–$60 per hour. Cost is only one input into the staffing decision a WVPP’s hazard-correction step calls for — the hazard assessment, not the price, is supposed to drive whether guard coverage is warranted at a given site. GNS matches or beats a comparable competitor’s quote in Southern California.
Does hiring GNS for guard coverage count as a complete workplace violence prevention plan?
No, and no single vendor’s coverage can. Guard coverage from Guardian National Security can serve as the named emergency-response contact and a documented hazard-correction measure inside a workplace violence prevention plan, but it isn’t a substitute for the written plan Labor Code §6401.9 itself requires an employer to maintain.
A business still needs its own hazard assessment, its own written plan covering all four violence types, annual training, and a violent incident log, regardless of who provides on-site security. GNS builds post orders around a client’s existing risk assessment rather than issuing legal or compliance sign-off on the plan itself, and recommends employers confirm plan requirements with counsel or Cal/OSHA directly.
