An officer finds a backpack behind a dumpster with what looks like stolen merchandise inside. Another recovers a knife dropped during a scuffle in a parking garage. A third is handed a cell phone by a tenant who says they found it near the mailboxes. In each case the officer has to decide, in about four seconds and usually alone, whether to touch it, move it, log it, or leave it where it is and call. Chain of custody security practice exists to make that decision boring — so the officer follows a rule instead of improvising, and so whatever they do survives being questioned six months later.
This is operational guidance, not legal advice. What private security officers may lawfully do with property, and what obligations attach to found or seized items, vary by state, by license type, and by the terms of the client contract. Verify your program with your own counsel and with your state regulator before writing it into post orders.
What a chain of custody actually protects
The phrase gets used loosely, so start with the mechanism. A chain of custody is an unbroken, documented account of who had an item, from the moment it came into anyone’s control to the moment it left. Every transfer is a link. Every link records who, when, where, and why.
Its purpose is not to prove the item is guilty of something. Its purpose is to close off the argument that the item was altered, swapped, contaminated or planted while it was in your possession. That argument is the easiest one to make and the hardest to disprove after the fact. If there is a four-hour window where nobody can say where the phone was, an entire investigation can collapse around that window — not because anything happened, but because nothing can be shown not to have happened.
The first decision: collect, secure, or don’t touch
Most evidence problems in contract security start with an officer being too helpful. The instinct to pick something up, bring it inside, and set it on the desk “so it doesn’t get taken” is generous and destructive.
The usable default for most posts is a three-way rule written into the post orders.
Do not touch. Anything that appears connected to a crime against a person, anything that looks like a weapon in place, anything at a scene where police are en route, and anything hazardous — blood or other body fluids, needles, unknown chemicals, suspected narcotics. The officer’s job here is to establish a perimeter, keep people away, note the time, and hand the scene to law enforcement intact. Officers should not be handling suspected drugs at all; that is a bright line worth stating in plain language.
Secure in place. Property that is not part of an active criminal scene but should not stay where it is — an unattended bag in a corridor after a bomb-threat protocol has been ruled out, a laptop visible in an unlocked car. Secure means control access to it, not carry it around.
Collect and log. Ordinary found property, and items the client’s own policy directs the officer to take in. Lost phones, keys, wallets, badges, tools left by contractors. This is the bulk of what a guard force actually handles, and it is where a chain of custody is most often skipped precisely because it feels routine.
The officer’s judgment is limited on purpose. If the classification is unclear, the rule is to stop, secure the area and call. Nobody should be deciding alone whether a scene is criminal.
Documenting the recovery
The record starts before the item moves. Photograph it in place, wide enough to show where it was and close enough to show what it is. If the site has cameras, note the time so footage can be pulled against it. Then write the recovery entry.
A usable entry answers: what the item is in neutral terms, where exactly it was, what time it was found, who found it, who else was present, what condition it was in, and how it was handled. Neutral terms matter: “one folding knife, black handle, approximately four inches closed” is a description; “the suspect’s weapon” is a conclusion a defense attorney will enjoy reading back to them.
Filing this from the mobile app at the scene rather than from a desk two hours later does more for the record than any form design. The entry carries its own time and location, the photos attach to it directly, and the officer writes while the detail is still accurate. Anything reconstructed at end of shift is a memory, and it will read like one.
Labeling, packaging and storage
Every collected item gets a unique identifier and that identifier appears on the item’s packaging, on the recovery entry, and on every subsequent transfer.
Package so that the item is protected and tampering is visible. Sealed bags or envelopes with the seal signed and dated across the closure, so that reopening is obvious. Paper is generally preferred over plastic for anything that can hold moisture. Do not clean, test, empty, unlock or power on an item to “check” it — an officer scrolling a found phone to identify the owner has just contaminated a device and possibly created a privacy problem for the company.
Storage means a locked container in a controlled area with a very short list of people who hold the key, and an access record. A drawer in the guard shack that four officers can open is not evidence storage, and calling it that in a report is worse than admitting it was in a drawer. If the site has no adequate storage, the correct policy is that the item does not get collected — it stays secured in place until someone who can store it properly arrives.
The transfer log is the chain
Every movement of the item creates an entry: released by, received by, date, time, purpose. Both parties sign. That includes handing property to its owner, to the client, to law enforcement, and to your own supervisor.
The two links most often lost are the mundane ones. The first is the return to the owner — an officer hands back a wallet, gets a verbal thanks, and writes nothing, and three days later the owner says two hundred dollars was missing. The second is the handoff to police, where an officer gives an item to a responding patrol unit without recording the officer’s name, unit and case number. Ask for it and write it down; that number is how the chain continues to exist after it leaves you.
Chain of custody security: audit it quarterly
Evidence handling degrades quietly, and nobody notices until the one time it matters.
A quarterly audit is straightforward: pull every recovery entry for the period from the incident record, then physically account for each item. Anything still in storage should have a reason it is still there. Anything gone should have a signed transfer. The gaps will not be dramatic — an unsigned release, a missing case number — but those are exactly the ones that get exploited later. Tying the audit to your incident and daily activity reporting rather than running it as a separate paper exercise is what makes it survivable; if the recovery entry lives in the same record as the incident, the audit list builds itself.
The limits worth saying out loud
Security officers are not investigators, and treating a post like a crime lab creates risk in both directions. Officers should not be interviewing suspects to build a case, should not be searching persons or property beyond what their license, state law and client contract clearly permit, and should not be forming or writing conclusions about guilt. The value a guard force adds to an investigation is accurate, timely, neutral documentation and an uncontaminated scene. That is genuinely valuable — detectives will say so — and it is achievable at every post without any additional authority.
Write the rule simply enough that a new officer can follow it at 3 a.m.: do not touch what belongs to police, secure what you cannot store, log everything you collect, sign every transfer, and call when unsure. A guard force that does those five things consistently will have better records than most, and will never lose a case because of a gap it created.
If you want to see how incident records, photos and evidence entries hold together in one operation, explore CGuardPro or get in touch.