
897 N.E.2d 402 (2008)
Mujtaba AIDROOS; Terry Brus, Executor of the Estate of Michael Brus, Deceased; Gail Wehrheim, Special Administrator of the Estate of Robert Wehrheim, Deceased; Sheila Gale; Brandon Gale; and Donald Garcia, Independent Administrator of the Estate of William Garcia, Deceased, Plaintiffs-Appellants,
v.
VANCE UNIFORMED PROTECTION SERVICES, INC., and Latessa Diamond, Defendants-Appellees.
Nos. 1-06-2009, 1-06-2126.
Appellate Court of Illinois, First District, Fifth Division.
October 31, 2008.
*403 Corboy & Demetrio, (Francis Patrick Murphy of Counsel), Chicago, IL, for Plaintiffs-Appellants Mujtaba Aidroos, Terry Brus and Gail Wehrheim.
Clifford Law Offices (John T. Karnezis and Robert P. Sheridan, of Counsel), Chicago, IL, for Plaintiffs-Appellants Sheila Gale, Brandon Gale and Donald Garcia.
Purcell & Wardrope, Chtd., (Bradford S. Purcell and Jennifer E. Simms, of Counsel), Chicago, IL, for Defendants-Appellees.
Justice O'MARA FROSSARD delivered the opinion of the court:
In this consolidated action involving claims for negligence, wrongful death, and survival damages, the trial court granted summary judgment in favor of defendants Vance Uniformed Protection Services, Inc. (Vance), and Latessa Diamond. Plaintiffs appealed, contending defendants had a duty to protect against criminal conduct where defendants contracted to provide security services. We affirm the judgment of the trial court.

BACKGROUND
This case arose from the shooting deaths and injuries that occurred at Navistar International Transportation Corp. and International Truck and Engine Corp. (Navistar) in Melrose Park, Illinois, on the morning of February 5, 2001. Navistar had hired defendant Vance to provide unarmed, uniformed security officer service according to the specific terms and conditions of their contract. Vance employed defendant Diamond as a security officer.
Prior to February 2001, there was no history of any workplace violence at Navistar's facility. The shooter, Willie Baker, had been fired from Navistar in 1995 for theft, but he had never threatened any Navistar employee before or after his termination. Baker was prosecuted for theft, convicted and scheduled to begin serving a five-month prison sentence on February 6, 2001.
At about 9:45 a.m. on February 5, 2001, Baker parked in Navistar's visitors' parking lot and entered an unlocked door of a gate guardhouse station, carrying weapons concealed in a golf bag. Diamond was on duty there alone and asked if she could help him. Baker said he wanted to drop off the golf bag for an employee. While Diamond retrieved the employee directory, Baker put a gun to her head. He took Diamond hostage and forced her to walk with him to building 10. Building 10 was supposed to be locked, but the door opened without the use of Diamond's keycard. Inside, Baker randomly shot building occupants, killing four and wounding others before killing himself.
Plaintiffs Garcia, Gale, Aidross, Brus and Wehrheim filed complaints alleging *404 that Baker had gained entrance to the facility because defendants had been lax in their efforts and negligently failed to properly secure the premises against intrusion. Those complaints were ultimately consolidated.
Defendants filed a motion for summary judgment pursuant to section 2-1005 of the Code of Civil Procedure (735 ILCS 5/2-1005 (West 2006)), contending (1) defendants did not owe plaintiffs a duty to warn or protect them from the criminal acts of Baker; (2) no genuine issue of material fact existed as to proximate cause; and (3) Baker's criminal acts constituted a superceding, intervening act that severed any causal relationship between defendants' alleged negligence and the plaintiffs' injuries and deaths.
Concerning the lack of duty argument, plaintiffs responded that the duty was created when Vance voluntarily entered into the security contract. Plaintiffs argued that defendants implicitly agreed to protect plaintiffs when Vance undertook, contractually, responsibility to deter and reduce certain types of conduct and risks. In particular, Vance agreed that its security officers would not permit discharged employees to enter the premises.
The pleadings, affidavits and depositions established the following facts. On February 4, 2001, Vance began providing unarmed uniformed security officer service at Navistar. The contract stated that the presence of the security officers:
"is designed to deter and reduce certain types of conduct and risks. However, [Vance is] not a law enforcement agency. The principal function of the Officers is to maintain a presence, to observe and to report. [Vance does] not insure or guarantee the personal safety of any person or the security of any property. [Vance would] not be responsible for any theft, damage, destruction, loss of property, personal injury or death except due to [Vance's] negligence or willful misconduct, and [Vance would] not have any liability arising from the criminal acts of any third parties."
Vance's security officers were unarmed. They used two-way radios to communicate with each other, and Navistar provided their communication equipment. Vance did not design, install or maintain the keycard system used by Navistar employees to access the various buildings on the premises. Navistar was responsible for that system.
Vance and Navistar agreed that post orders would be prepared based on Navistar's needs and the services Vance provided. Any changes to the post orders necessitated by time, need, or any other purpose had to be in writing and agreed to by both Vance and Navistar. According to the post orders, the security officers were required to patrol Navistar's property and monitor employees and visitors, vehicle traffic, and inbound or outbound freight. Their duties were performed to protect and prevent loss from fire, theft, sabotage, vandalism, or horseplay. They should observe the condition of various buildings, equipment, and irregularities, including safety or fire hazards, poor housekeeping, thefts and other security breaches, and report it to supervisory personnel. The post orders required security officers at the gate guardhouse station to observe employees or visitors and not allow them to bring in items that might be detrimental to Navistar or its employees. Furthermore, they should check that people entering the premises had the proper identification to permit ingress. Current employees used their keycards to enter through turnstiles. A visitor would be issued passes at the loss prevention trailer or building 1. The post orders provided that discharged employees should not be admitted, and *405 security officers should direct them to the loss prevention trailer. Furthermore, the post orders stated that private deliveries (like food, gifts, flowers, etc.) could not be made inside the primary security fence. The security officer would have to call the recipient of the food or gift, who must come to the gate to receive the delivery.
In her deposition, Diamond testified that when visitors came to Navistar, the security officer would check their identification and make sure they had a pass. Visitors without passes were sent to the main guard shack or control area. According to Diamond, if a security officer was ever physically threatened, the security officer should report it to a supervisor, the police, or try to escape if possible. The security officer's function was to maintain a presence, observe, and report anything unusual to supervisors. As Diamond explained in her deposition, the security officer at the gate guardhouse was required to exit the guardhouse and check the contents of the trucks, greet visitors, and check their identification. In order to admit trucks, the security officer had to press a button inside the guardhouse to open the gate. The guardhouse had two doors that could be locked from the inside. Out of habit from her previous job as an armed security guard at the Chicago Housing Authority, Diamond locked the doors if she was inside the gate guardhouse alone. However, once employees and truck traffic started arriving during business hours, she was in and out of the guardhouse so frequently that she left the doors unlocked.
Diamond further testified at her deposition that on the date of the shooting, she was inside the gate guardhouse with both doors locked until she was relieved by two officers when she went to building 10 to use the restroom. She testified that she used her keycard to enter building 10. She noticed, however, that the light on the lock never changed from red to green. When she exited building 10, she pulled on the door and noted that it had locked behind her. Upon her return to the guardhouse, the two officers left as a truck was attempting to exit the plant. Diamond did not realize that both doors of the guardhouse were now unlocked. Diamond buzzed the gate open so the truck could drive up to the guardhouse for her inspection. After the truck drove away, Diamond went inside the guardhouse and processed the paperwork. She heard the door that she thought was locked open and then saw Baker at the door inside the guardhouse. She did not have time to close the gate. Baker said he was there to give a friend a golf bag, and Diamond asked him the employee's name and reached for the employee directory. Diamond described how Baker then put a gun to the back of her head, took her hostage, and made her walk with him to building 10, where he randomly fired gunshots at occupants of the building.
The trial court granted defendant's motion for summary judgment, finding that defendants did not owe a duty to warn or protect plaintiffs from criminal acts under the contract terms and did not voluntarily undertake any such duty.
Plaintiffs appealed.

ANALYSIS
In their negligence action, plaintiffs must set out sufficient facts to allege the existence of a duty owed by defendants to the plaintiffs, a breach of that duty, and an injury proximately resulting from the breach. MacDonald v. Hinton, 361 Ill. App.3d 378, 382, 297 Ill.Dec. 162, 836 N.E.2d 893 (2005). The existence of a duty-the legal obligation imposed upon one for the benefit of another-is a question of law to be determined by the court. Martin v. McDonald's Corp., 213 Ill.App.3d *406 487, 489, 157 Ill.Dec. 609, 572 N.E.2d 1073 (1991).
We review a grant of summary judgment by the trial court de novo. Jewelers Mutual Insurance Co. v. Firstar Bank Illinois, 213 Ill.2d 58, 62, 289 Ill.Dec. 635, 820 N.E.2d 411 (2004). Summary judgment can only be entered "if the pleadings, depositions, and admissions on file, together with the affidavits, if any, show that there is no genuine issue as to any material fact and that the moving party is entitled to judgment as a matter of law." 735 ILCS 5/2-1005(c) (West 2006); Prairie v. University of Chicago Hospitals, 298 Ill. App.3d 316, 319, 232 Ill.Dec. 520, 698 N.E.2d 611 (1998). The pleadings, depositions and affidavits must be construed most strictly against the moving party and most liberally in favor of the opponent. Purtill v. Hess, 111 Ill.2d 229, 240, 95 Ill.Dec. 305, 489 N.E.2d 867 (1986). Summary judgment is a drastic means of disposing of litigation and should only be allowed when the right of the moving party is clear and free from doubt. Loyola Academy v. S & S Roof Maintenance, Inc., 146 Ill.2d 263, 271, 166 Ill.Dec. 882, 586 N.E.2d 1211 (1992).
Plaintiffs contend defendants undertook a duty of care to protect plaintiffs from third-party criminal acts when defendants were hired to assist Navistar in providing a safe workplace. According to the post orders, which were incorporated into the contract terms, Vance was required to deny discharged employees admission inside Navistar's premises. Plaintiffs argue that liability can arise from the negligent performance of a voluntary undertaking, and Vance negligently performed the duty to deny entry to discharged employees because Vance's security officer failed to lock a lockable door. According to plaintiffs, Vance is responsible because its negligence increased the risk of harm to plaintiffs.
To determine whether a duty exists in a certain instance, a court considers: (1) the reasonable foreseeability of injury; (2) the likelihood of injury; (3) the magnitude of the burden of guarding against the injury; and (4) the consequences of placing that burden on the defendant. Bajwa v. Metropolitan Life Insurance Co., 208 Ill.2d 414, 427, 281 Ill.Dec. 554, 804 N.E.2d 519 (2004). The question of the existence of a duty turns in large part on public policy considerations. Bajwa, 208 Ill.2d at 427, 281 Ill.Dec. 554, 804 N.E.2d 519.
"Ordinarily, a party owes no duty of care to protect another from the harmful or criminal acts of third persons." MacDonald, 361 Ill.App.3d at 382, 297 Ill. Dec. 162, 836 N.E.2d 893. There are, however, four exceptions to this rule: (1) when the parties are in a special relationshipi.e., common carrier/passenger, innkeeper/guest, business invitor/invitee, or voluntarily custodian/protecteeand the harm is foreseeable; (2) when an employee is in imminent danger and this is known to the employer; (3) when a principal fails to warn his agent of an unreasonable risk of harm involved in the agency; and (4) when any party voluntarily or contractually assumes a duty to protect another from the harmful acts of a third party. Iseberg v. Gross, 227 Ill.2d 78, 88, 316 Ill.Dec. 211, 879 N.E.2d 278 (2007); MacDonald, 361 Ill.App.3d at 382, 297 Ill.Dec. 162, 836 N.E.2d 893.
The only relevant exception in the instant case is the fourth exception concerning a voluntary undertaking. Our supreme court has utilized section 324A of the Restatement (Second) of Torts to analyze voluntary undertaking claims. Cross v. Wells Fargo Alarm Services, Inc., 82 Ill.2d 313, 319, 45 Ill.Dec. 121, 412 N.E.2d 472 (1980); Pippin v. Chicago Housing *407 Authority, 78 Ill.2d 204, 210, 35 Ill.Dec. 530, 399 N.E.2d 596 (1979). Section 324A states:
"One who undertakes, gratuitously or for consideration, to render services to another which he should recognize as necessary for the protection of a third person or his things, is subject to liability to the third person for physical harm resulting from his failure to exercise reasonable care to protect his undertaking, if
(a) his failure to exercise reasonable care increases the risk of such harm, or
(b) he has undertaken to perform a duty owed by the other to the third person, or
(c) the harm is suffered because of reliance of the other or the third person upon the undertaking." Restatement (Second) of Torts § 324A (1965).
Plaintiffs contend that, under a traditional duty analysis, either in conjunction with the Restatement or separately, the imposition of a duty on defendants to take reasonable steps against criminal conduct like Baker's is a small burden compared to the potentially severe harm. Plaintiffs argue that defendants's duty arose under subsections (a), (b) and (c) of section 324A. Specifically, plaintiffs argue that: defendants increased the risk of harm when they failed to take reasonable safety measures by properly locking doors and protecting access points; defendants were employed to fulfill Navistar's duty to protect its employees from third-party attacks; and Navistar and its employees relied on defendants "to secure the facility and exclude feared intruders." Plaintiffs' arguments, however, are not persuasive.
First, the record refutes plaintiffs' assertion that defendants undertook a duty to protect people on Navistar's premises from injury or death due to violent criminal attacks by third parties. "[U]nder the voluntary undertaking doctrine of liability, the duty of care to be imposed upon the defendant is limited to the extent of the undertaking." Castro v. Brown's Chicken & Pasta, Inc., 314 Ill.App.3d 542, 547, 247 Ill.Dec. 321, 732 N.E.2d 37 (2000). In cases that addressed whether the presence of security guards amounted to a voluntary undertaking to protect tenants from criminal acts, the determinative factor was the purpose for hiring the security guards. A duty was found if the hiring agreement showed that the security guards were intended to protect the tenants, but no duty was found if the agreement showed that the guards were intended to protect only property. Compare Pippin, 78 Ill.2d at 207, 35 Ill.Dec. 530, 399 N.E.2d 596 (the security agency assumed a duty to protect the decedent where the security agency contracted with the Chicago Housing Authority to provide armed guards and other protective services for the purpose of guarding property and protecting the people on the premises), with Hill v. Chicago Housing Authority, 233 Ill.App.3d 923, 930, 175 Ill.Dec. 104, 599 N.E.2d 1118 (1992) (no duty to protect the plaintiff from the criminal act where affidavits established that the Chicago Housing Authority hired the security agency to protect only property).
Here, the contract specifically stated that Vance did not guarantee the personal safety of any person and had no liability arising from the criminal acts of any third parties. Moreover, the contract, post orders, and conduct of Navistar and defendants established that the extent of defendants' undertaking was limited to providing unarmed security officers who would maintain a presence, observe and report in order to deter loss from fire, theft, sabotage, vandalism, or horseplay. Vance never promised orally or in writing to supply the guards or guardhouses with *408 emergency communication equipment. Furthermore, Vance had no role with respect to the placement and design of the guardhouses, or the video monitoring or building keycard access systems at Navistar's facility.
Vance's security officers were required to patrol Navistar's property and monitor employees and visitors, vehicle traffic, and inbound or outbound freight. The security officers were required to observe the condition of various buildings and equipment, and report any irregularities to Navistar. While at the gate guardhouse, the security officers were required to observe employees or visitors and not allow them to bring in harmful items. Furthermore, the security officers had to ensure that people entering the plant had the proper identification to permit ingress. If any visitors without passes or discharged employees wanted to enter the premises, the security officers had to direct them to the loss prevention trailer at another entrance point. Contrary to plaintiffs' assertions, Vance's undertaking of that responsibility did not create by implication a broader duty to protect Navistar's employees from criminal attacks. See Phillips v. Budget Rent-A-Car Systems, Inc., 372 Ill.App.3d 155, 163-65, 309 Ill.Dec. 468, 864 N.E.2d 709 (2007) (a security agency that undertook a contractual obligation to prevent vehicles from leaving a rental car facility without proper authorization did not owe a duty to protect the plaintiff from injuries sustained when a stolen rental vehicle collided with her car during a highspeed police chase). See also Frye v. Medicare-Glaser Corp., 153 Ill.2d 26, 32-34, 178 Ill. Dec. 763, 605 N.E.2d 557 (1992) (the court rejected the plaintiff's "overly broad interpretation of the defendants' undertaking" and found that the defendant pharmacy and pharmacist did not assume a duty to warn the decedent of all possible dangers and side effects of a medication by voluntarily placing a drowsiness warning on the prescription).
Second, the record also refutes plaintiffs' assertion that defendants' negligent performance of its contractual duties increased the risk of harm to plaintiffs. The post orders did not require the security officers to keep the gate guardhouse doors locked. Such a requirement would have been impractical because the security officers had to continuously exit the gate guardhouse to inspect vehicles entering and exiting the premises. Moreover, security officers had to greet visitors and direct them to the appropriate entrance if they lacked visitors' passes. Furthermore, any private deliveries for Navistar employees required the security officers to greet the delivery people, collect their information, and summon the appropriate Navistar employee to receive the delivery.
The record reflects that, on the date in question, Diamond complied with the post orders and performed her job duties with reasonable care. The unlocked gate guardhouse door was inconsequential where Baker used the ruse of a private delivery to a Navistar employee to approach and distract Diamond and then surprise her with a gun.
Third, plaintiffs offer no evidence to support their assertion that they relied on defendants "to secure the facility and exclude feared intruders." The record establishes that there was no history of any workplace violence at Navistar prior to Baker's criminal conduct in 2001. Until this 2001 shooting rampage, Baker did not pose a known threat where he had not harassed or threatened anyone at Navistar before or since his 1995 termination.
The trial court properly granted summary judgment in favor of defendants because they had no duty to protect plaintiffs from third-party criminal acts. Because *409 we find that defendants did not owe that duty to plaintiffs, we do not reach the parties' proximate cause or intervening, superceding cause arguments.

CONCLUSION
The trial court's order entering summary judgment in favor of defendants is affirmed.
Affirmed.
FITZGERALD SMITH, P.J., and GALLAGHER, J., concur.
