Does Your Security Guard Company Need to File OSHA Form 301?
Security guard and patrol companies are classified under NAICS 5616 (Investigation and Security Services), which OSHA lists as a partially exempt industry under 29 CFR 1904 Subpart B, Appendix A — most security firms are not required to keep routine OSHA 300/301 injury logs for their own employees. The exemption does not remove the federal duty to report an employee fatality within 8 hours or an in-patient hospitalization, amputation, or loss of an eye within 24 hours (29 CFR 1904.39), and it has no bearing on the incident documentation client contracts and insurance carriers require independently of OSHA.
The short answer
No — if your business is classified under NAICS code 5616 (Investigation and Security Services), which includes 561612 (Security Guards and Patrol Services), you are not required to keep OSHA's routine injury and illness records: the Form 300 log, the Form 300A annual summary, or the Form 301 Injury and Illness Incident Report. This comes directly from OSHA's own published list of partially exempt industries, not from an interpretation or a workaround.
That's the end of your OSHA-301 obligation, but it is not the end of your documentation obligation. Two things still apply regardless of the exemption, and they matter more in practice than the paperwork you're excused from.
What NAICS 5616 actually covers
OSHA's recordkeeping rule (29 CFR Part 1904) requires most employers to log work-related employee injuries and illnesses. But Appendix A to Subpart B of Part 1904 lists industries with historically low injury and illness rates as partially exempt — meaning the employer doesn't have to keep those records unless OSHA, the Bureau of Labor Statistics (BLS), or a state agency asks in writing. "5616 Investigation and Security Services" is on that list, alongside other professional and administrative-services categories like legal services, accounting, and computer systems design.
This is an industry-based exemption, so it applies at the establishment level, not per employee or per contract. A 300-guard firm and a 3-guard firm are exempt on the same basis.
What the exemption does not cover
The exemption is explicitly partial. Every employer — including one on the exempt-industries list — must still report certain severe outcomes directly to OSHA, on a strict clock, under 29 CFR 1904.39:
| Event | Reporting window | How |
|---|---|---|
| Employee fatality | Within 8 hours | Phone or in person to the nearest OSHA Area Office, or 1-800-321-OSHA |
| In-patient hospitalization | Within 24 hours | Same as above |
| Amputation | Within 24 hours | Same as above |
| Loss of an eye | Within 24 hours | Same as above |
The fatality has to occur within 30 days of the incident to trigger the reporting duty; the hospitalization, amputation, or eye loss has to occur within 24 hours of the incident itself. This applies to an employee — a guard on your payroll — not to a third party involved in an altercation on a client's property.
Separately, OSHA can compel a specific establishment to keep full records anyway: the exemption yields whenever OSHA, BLS, or a state agency running the BLS Annual Survey of Occupational Injuries and Illnesses sends a written request. Exempt firms do occasionally get sampled for that survey, so "we're exempt" isn't a reason to have nothing on file if that letter arrives.
Why most security firms document incidents anyway
The OSHA exemption removes a federal paperwork requirement. It doesn't touch three other reasons security guard companies keep incident records as a matter of course:
- Client contracts. Most commercial security contracts obligate the guarding company to document intrusions, altercations, thefts, and property damage on the client's site — a completely separate obligation from OSHA, owed to the client, not the government.
- Insurance and liability defense. General liability and workers' comp carriers expect a timestamped, signed account of any incident that could become a claim. An OSHA exemption has no bearing on what your policy requires you to produce if something goes to a claims adjuster or a courtroom.
- State security guard licensing. Many states regulate private security/guard companies through a separate licensing board (often under the state police, department of public safety, or a private security bureau), and some of those regimes impose their own incident or use-of-force reporting rules independent of OSHA. Check your specific state board — this varies too much to generalize.
The practical takeaway
Being on OSHA's exempt list is real and worth knowing — it means you can stop worrying about the Form 300/300A/301 paperwork most incident-reporting advice assumes every business needs. What it doesn't mean is that documentation stops mattering: the 8-hour/24-hour severe-injury duty is federal law regardless of NAICS code, and the client- and insurer-driven reasons to keep a clean incident record were never about OSHA in the first place.
Frequently asked questions
Is NAICS 561612 (Security Guards) the same as the 5616 exemption?
Yes. OSHA's partially exempt industries list in 29 CFR 1904 Subpart B, Appendix A is published at the 4-digit NAICS level — "5616 Investigation and Security Services" — which covers the more specific 6-digit codes underneath it, including 561611 (Investigation Services), 561612 (Security Guards and Patrol Services), 561613 (Armored Car Services), and 561621 (Security Systems Services).
Does the exemption apply to armed guards or executive protection differently than unarmed guards?
No — the exemption is based on the establishment's NAICS classification, not the specific duties or armament of individual guards. A firm classified under 5616 is exempt from routine recordkeeping regardless of whether its guards are armed, unarmed, or provide executive protection.
If we're exempt, can we stop tracking incidents altogether?
Only for the purpose of OSHA's own 300/301 paperwork. Most client contracts, general liability and workers' comp insurers, and state-level security guard licensing boards impose their own incident-documentation requirements independently of OSHA — and none of those go away because your NAICS code is on OSHA's exempt list.
What if we have more than 10 employees — does that cancel the exemption?
No, the industry exemption (1904.2) and the small-employer exemption (1904.1) are two separate, independent paths to the same result. A security firm with 200 employees is still covered by the 5616 industry exemption regardless of headcount.
Sources
- 29 CFR 1904 Subpart B, Appendix A — Partially Exempt Industries
- 29 CFR 1904.2 — Partial exemption for establishments in certain industries
- 29 CFR 1904.1 — Partial exemption for employers with 10 or fewer employees
- 29 CFR 1904.39 — Reporting fatalities, hospitalizations, amputations, and losses of an eye to OSHA
Documenting incidents your clients and insurer will actually accept
Whether or not OSHA requires it, IncidentLog gives your guards a mobile report — timestamp, GPS, photos, and signature — filed from the post in under 90 seconds, with a certified PDF ready for a client or a claims adjuster the same day.