
447 N.W.2d 165 (1989)
Garnet ERICKSON, et al., Respondents,
v.
CURTIS INVESTMENT COMPANY, et al., Defendants and Third-Party Plaintiffs, Petitioners, Appellants,
Leadens Investigation and Security, Inc., Petitioner, Appellant,
Thomas Sabo, Defendant,
v.
NU-WAY HOUSE, INC., Third-Party Defendant.
No. C7-88-1177.
Supreme Court of Minnesota.
October 27, 1989.
*166 James F. Dunn, Janet S. Stellpflug, St. Paul, for Curtis Inv. Co., Inc., Allright Parking MN, Inc. and Allright Auto Parks, Inc.
Richard Mahoney, Victor E. Lund, Minneapolis, for Leadens Investigation and Sec., Inc.
Robert L. McCollum, Lane Kirchner, Bloomington and Gary J. Gordon, Minneapolis, for Garnet Erickson, et al.
Thomas Sabo, Minnesota Correctional Facility, Oak Park Heights, Stillwater, pro se.
Heard, considered, and decided by the court en banc.

OPINION
SIMONETT, Justice.
Does the operator of a commercial parking ramp owe a duty to a ramp customer to protect her from a trespassing rapist? We think so and affirm the court of appeals. As to the legal responsibility of the security firm hired to patrol the ramp, we hold, as did the court of appeals, that there are issues of fact on whether the security firm breached its duty and on causation.
Plaintiff-respondent Garnet Erickson was sexually assaulted and raped in the Curtis parking ramp in downtown Minneapolis late one winter afternoon as she was preparing to drive her car out of the ramp. The ramp was owned by defendant Curtis Investment Company. Curtis, in turn, had leased the ramp (reserving space for its own use) to defendant Allright Parking Minnesota, Inc., a Minnesota corporation, which is a wholly owned subsidiary of defendant Allright Auto Parks, Inc., a foreign corporation. Plaintiff Erickson and her husband sued Curtis and the two Allright corporations, plus defendant Leadens Investigation and Security, Inc., a security firm that had been hired by Curtis to provide certain security services.[1]
After discovery, the four defendants successfully moved for summary judgment. Plaintiffs appealed to the court of appeals. The appeals panel reversed the trial court, holding that Curtis and Allright Parking owed plaintiff a duty to provide her with a reasonably safe parking ramp. The panel also held there was a genuine issue of material fact whether Leadens, the security firm, had properly performed its security functions. Erickson v. Curtis Investment Co., 432 N.W.2d 199 (Minn.App. 1988). We granted petitions for further review by the four defendants. Curtis and the two Allright corporations raise only the issue whether they owed Ms. Erickson a *167 legal duty of care and, if so, what standards would discharge that duty. Defendant Leadens, on the other hand not only questions whether it owed a duty to Ms. Erickson but, if it did, further claims it had discharged that duty.[2]
For some 6 months prior to the assault, Ms. Erickson had been a monthly contract parker at the Curtis Ramp. The ramp is a self-serve, multi-level parking facility, with approximately 330 parking spaces. It is across the street from the Curtis Hotel and connected to the hotel by an enclosed skyway at the second level. (The hotel has since been torn down.) The assault occurred on December 7, 1983. Ms. Erickson went to the ramp after work, at about 5 p.m. She took the elevator to the second level and went to her car, a Chevette hatchback, parked facing inwards. She saw no security guards. She claims the ramp was dimly lit. Ms. Erickson had started the engine when defendant Thomas Sabo opened the driver's door and forced himself inside. Ms. Erickson managed to scream before Sabo clamped his hand over her mouth and shut the door. A struggle ensued. At some point during this time, Ms. Erickson remembers two people getting into the car next to hers and driving off. Later, another car came or left in the stall next to her car. Sabo eventually forced Ms. Erickson into the back of the car and raped her. At one point Ms. Erickson managed to open a door and scream for help, and several times she briefly sounded the car's horn. After Sabo left, plaintiff restarted her car, defrosted the windows, and drove to the main level where she reported the crime to the booth attendant on duty. The security guard learned of the assault at 5:27 p.m. The assault, occurring during rush hour, had apparently lasted about 25 minutes.
In November 1982 Curtis had leased the ramp facility to Allright Parking, reserving about 146 spaces for its hotel guests and personnel plus some spaces rented to a car rental agency. It was the lessee's responsibility to operate the ramp. On the day of the assault, Allright Parking's manager believes he had walked through the ramp twice. At the time of the assault, an Allright employee was in the exit booth and the manager apparently was in his office. Access to the ramp from outside doors and the skyway could not be observed from the attendant's booth. The ramp did not have signs warning of security steps taken, nor was the ramp equipped with television monitors.
In May 1981 Curtis hired Leadens to provide security services for the hotel. At some point, Curtis told Leadens' guards to patrol the parking ramp also. If requested, the guards would also escort women hotel employees and patrons to their cars in the ramp. Robert Buchan, the guard on duty at the time of the assault, testified he patrolled the ramp once every hour, walking through the facility from the top level to the bottom. On the day of the assault Buchan began work at 4 p.m.; he had made two rounds through the ramp by the time he learned of the assault. His log shows he made his second round from 5:08 to 5:24 p.m. Apparently, then, he walked by the Erickson car during the assault. As he walked, Buchan would use a flashlight to look between the parked cars.
There had never been a report of a crime against a person in the ramp prior to the Erickson assault. (In June 1983, a Leadens guard had an altercation with a would-be thief, and in August 1983 two men attempting to steal from the ramp attendant harassed a woman who was calling the security guard.) There were, however, some 85 "security incidents" in the ramp over a period of 3 to 4 years. There were also hundreds of "security related incidents" reported in the Curtis Hotel over this period of time, although the relevancy of many of these incidents (such as asking intoxicated *168 persons to leave the bar, damage to pop machines, altercations within hotel rooms) may be debatable. In addition, less than 2 months before the rape, the manager of the Curtis Hotel had written the 7th Ward council member reporting an increase in "street people" in the neighborhood, an increase in crime both inside and outside the hotel, and the concerns expressed by hotel customers and residents about their safety. In April 1983, similar concerns had been expressed at a public meeting.
Plaintiff's experts, in deposition testimony, criticized the security of the Curtis ramp in numerous aspects, including poor lighting, unmonitored access to the ramp from the street, failure to patrol the ramp more frequently, failure to post signs indicating presence of security, poor training and supervision of the security guards, and decreased security measures at a time when criminal activity appeared to be on the increase. One of the experts stated there is a potential for crimes of personal violence where property crimes occur.
Thomas Sabo, the alleged rapist, has an extensive history of criminal activity and drug abuse, and is alleged to have been intoxicated at the time of the assault. The attack on Ms. Erickson occurred some 8 or 9 hours after Sabo had been released from prison on the morning of December 7.
We will first discuss the duty of care of Curtis and Allright Parking. Apparently because of their mutual use of the ramp under the lease, Curtis and Allright Parking have filed a joint brief. For our purposes here, on the question of whether any duty is owed, we will treat them together.

I.
Does the owner-operator of a commercial parking ramp have a duty to provide security to protect its customers from criminal assaults by third parties?
If the law is to impose a duty on A to protect B from C's criminal acts, the law usually looks for a special relationship between A and B, a situation where B has in some way entrusted his or her safety to A and A has accepted that entrustment. This special relationship also assumes that the harm represented by C is something that A is in a position to protect against and should be expected to protect against.
Thus a duty to protect may be found in the innkeeper-guest and common carrier-passenger relationship. Analogous to the innkeeper-guest case is the hospital-patient relationship. See Sylvester v. Northwestern Hosp. of Minneapolis, 236 Minn. 384, 386-87, 53 N.W.2d 17, 19 (1952); Roettger v. United Hospitals of St. Paul, 380 N.W.2d 856, 859-60 (Minn.App.1986). On the other hand, while there may be a close relationship between a homeowner and a nurse companion, a private homeowner generally is not in a position to protect against third-party criminal activity and is not expected to provide such protection. Pietila v. Congdon, 362 N.W.2d 328, 333 (Minn.1985).
In this case we inquire whether the duty to protect should be extended to another kind of business enterprise, specifically, a commercial parking ramp. As to business enterprises generally, the law has been cautious and reluctant to impose a duty to protect. A mere merchant-customer relationship is not enough to impose a duty on the merchant to protect his customers. In Williams v. Cunningham Drug Stores, Inc., 429 Mich. 495, 418 N.W.2d 381 (1988), for example, a customer of the defendant drugstore was injured during an armed robbery of the drugstore. Even though the drugstore was located in an urban high crime area, the Michigan Supreme Court held that the drugstore had no duty to provide armed security guards to protect customers from criminals. In Goldberg v. Housing Authority of Newark, 38 N.J. 578, 186 A.2d 291 (1962), a deliveryman was injured by robbers in an elevator of a high-rise housing project. Even though there had been criminal activity in and about the housing project, the New Jersey Supreme Court held there was no duty on the part of the municipal housing authority to provide police protection for its complex of buildings.
Whether a duty is imposed depends, therefore, on the relationship of the parties *169 and the foreseeable risk involved. Ultimately, the question is one of policy. Here the defendants stress two basic policy considerations.
First of all, the prevention of crime is essentially a governmental function. Thus defendants contend that tort law should not impose a duty on private citizens to provide their own police and law enforcement measures. If a business is located in a "high crime area," this may be an indictment of the community's response to crime but, say the defendants, it is not a reason to impose tort liability on the business owner for the abdication by the community of its responsibility. "To shift the duty of police protection from the government to the private sector would amount to advocating that members of the public resort to self-help. Such a policy contravenes public policy." Williams, 429 Mich. at 503-04, 418 N.W.2d at 385.
Secondly, point out the defendants, a duty to protect against the devious, sociopathic, and unpredictable conduct of criminals does not lend itself easily to an ascertainable standard of care uncorrupted by hindsight nor to a determination of causation that avoids speculation. There is a difference between a landowner's duty to sand a slippery step on his premises and his duty to contain a slippery criminal. In the latter instance, the landowner is being asked to take defensive measures against a third person not within his control, indeed, someone who tries to outwit any defenses. Yet when a crime does occur, the tendency is not to consider whether the defendant had taken reasonable precautions but what further security measures would have prevented the crime that did occur and to make these further safeguards, ex post facto, the applicable standard of care. Moreover, whether the failure to provide these further security precautions (e.g., more guards, television monitors, and signs) in fact permitted the crime to occur can be quite problematic, thereby raising serious questions whether breach of the duty was a cause of plaintiff's injury. Though resolution of most tort actions involves some hindsight (a fact which the law accepts but prefers not to discuss), the hindsight problem in duty to protect cases is exacerbated.
A third policy consideration, we might add, is the cost-benefit equation. Presumably we do not live in a risk-free society; if this is so, a cost-benefit analysis is unavoidable. To post security guards at each parking ramp level 24 hours a day might be the most effective crime deterrent, but the cost may be prohibitive for both the property owner and the customer. A parking ramp cannot be a fortress. In this case, for example, plaintiff apparently considered cost as a factor in choosing the Curtis ramp for parking rather than another ramp or taking the bus. The question of how much security is adequate raises, therefore, the further question of how much risk is an acceptable risk for members of the public.
This leads us then to the case at hand. We have a large commercial parking ramp facility in a downtown metropolitan area. Several hundred cars, for a fee, are parked within the structure. The interior, with its many levels, its supporting pillars, its stair-wells, its relatively low ceilings, and its rows of unoccupied parked cars, provides places in which to hide or to lurk, especially if the interior is dimly lit. Anyone from the street may enter the structure unobserved by the ramp attendant. The place is relatively deserted, with people present only momentarily to either leave or retrieve their car. The cars, left unattended, attract thieves and vandals, and criminal activity, though generally of the property sort, is not uncommon.
These general characteristics of a parking ramp facility, it seems to us, present a particular focus or unique opportunity for criminals and their criminal activities, an opportunity which to some degree is different from that presented out on the street and in the neighborhood generally. We do not think the law should say the operator of a parking ramp owes no duty to protect its customers. Some duty is owed.
We hold that the duty should be defined and explained to the jury along the following lines: The operator or owner of a *170 parking ramp facility has a duty to use reasonable care to deter criminal activity on its premises which may cause personal harm to customers. The care to be provided is that care which a reasonably prudent operator or owner would provide under like circumstances. Among the circumstances to be considered are the location and construction of the ramp, the practical feasibility and cost of various security measures, and the risk of personal harm to customers which the owner or operator knows, or in the exercise of due care should know, presents a reasonable likelihood of happening. In this connection, the owner or operator is not an insurer or guarantor of the safety of its premises and cannot be expected to prevent all criminal activity. The fact that a criminal assault occurs on the premises, standing alone, is not evidence that the duty to deter criminal acts has been breached.
By casting the operator's duty in terms of a duty to use reasonable care to deter and by requiring the jury to weigh the likelihood of the risk with the financial and practical feasibility of the means to meet that risk, we believe the underlying policy considerations earlier discussed are fairly taken into account. The likelihood of harm is, of course, an important factor. Here, for example, the defendants point out there had never been a sexual assault in the ramp prior to plaintiff's case, an important consideration. On the other hand, in this instance, it would appear that the jury might consider the likelihood of the appreciable increase in criminal activity breeding crimes of violence. There will be cases in which the court may rule as a matter of law that the duty to use reasonable care to deter has been discharged by the defendant. There will also be cases where the facts and circumstances raise conflicting inferences so that the issue of breach of duty will be for the jury. In these cases, we recognize the jury may be deciding not so much a conflict in the facts as making an evaluative policy judgment.[3] In any event, in the case now before us, at least at this preliminary summary judgment stage, we believe the facts and circumstances present a genuine issue of material fact on whether defendants breached their duty of care.

II.
The next question is whether the security firm, Leadens, owed a duty to plaintiff to protect her from Sabo's assault, and, if so, whether there is a fact issue on breach of that duty.
Leadens was hired only by Curtis to patrol the ramp; therefore, argues Leadens, its duty of care extended only to Curtis customers, not to Ms. Erickson, a customer of Allright Parking. In fact, however, Leadens undertook to patrol the entire ramp without distinguishing between Curtis' patrons and Allright's customers. Indeed, as a practical matter, it was impossible to distinguish whose car was whose, much less who was who. In short, Leadens owed a duty of care to Ms. Erickson because it undertook that duty.
But if this is so, says Leadens, it can only be liable to plaintiff if its conduct increased the risk of harm to plaintiff or if plaintiff had relied on Leadens' undertaking. See Restatement (Second) of Torts § 324A (1965) (Liability to Third Person for Negligent Performance of Undertaking). Neither of these conditions for the imposition of liability, says Leadens, has been shown in this case. But section 324A also imposes liability on a defendant who undertakes for another (whether gratuitously or for a consideration) to perform a duty owed by the other to a third person. That is precisely our case here. Leadens may have been hired by Curtis to patrol for Curtis, but it also undertook to perform Allright's duty to protect Allright's customers. Consequently, Leadens' duty to use that degree of care which a reasonably prudent *171 professional security firm would use was owed also to plaintiff.
Leadens next argues that as a matter of law it did not breach its duty to use reasonable care in the performance of its security services. The duties to be performed by Leadens were those assigned it by the Curtis Hotel management. Curtis made the decision on the level of security to be provided. From the record, it appears that Leadens was to supply one security guard for duty at the hotel; this guard was also instructed to walk through the hotel complex once every hour and to include in his rounds a walk across the skyway to the Curtis ramp and a walkthrough of the ramp from the top to the bottom level. The guard was to check for break-ins and vandalism and, presumably, to be alert for any suspicious activity.
The evidence is that the Leadens guard on this particular day did make his hourly check and, indeed, must have walked by plaintiff's car during the assault. The guard neither saw nor heard anything. Neither, apparently, did customers driving their cars out of or into the parking stall adjacent to plaintiff's car. From all the facts and circumstances, however, there would appear to be conflicting inferences on whether the guard should have noticed the assault in progress inside the Erickson car. We agree with the court of appeals that there are genuine issues of material fact on breach of duty and causation with respect to defendant Leadens.
Affirmed.
NOTES
[1]  Plaintiff also sued the State of Minnesota for alleged negligence in supervising the parole of the rapist. Nu-Way Halfway House, to which the rapist had been released, was also brought into the suit as a third-party defendant. The trial court granted summary judgment in favor of the State and Nu-Way Halfway House, and these rulings were affirmed by the court of appeals. Plaintiffs have not sought review of these rulings.

The alleged rapist, Thomas Sabo, is also a named defendant but is in default.
[2]  At the court of appeals level, Curtis and the two Allright corporations also raised several other issues, namely: whether breach of duty by Curtis and Allright (assuming a duty and a breach) was a cause of plaintiff's injuries; whether Allright Auto Parks, Inc., the parent foreign corporation, could be found vicariously liable for any negligence by its Minnesota subsidiary; and whether a fact issue exists as to punitive damages. These issues, however, were not presented in the petition for further review and we do not reach them.
[3]  "[E]very time that a judge declines to rule whether certain conduct is neglect or not, he avows his inability to state the law, and that the meaning of leaving nice questions to the jury is that while if a question is pretty clear we can decide it, as it is our duty to do, if it is difficult it can be decided better by twelve men at random from the street." Oliver Wendell Holmes, Collected Legal Papers 237 (1920).
