The plaintiff, Dana VanDeMark, appeals an order of the Superior Court (McGuire, J.) granting summary judgment for the defendant, McDonald’s Corporation. We affirm.
I. Background
The following facts were found by the trial court or appear on the record. In or around December 1989, the defendant and Colley/McCoy Management Company, LLC (Colley/McCoy) entered into a series of agreements to establish a franchise for a McDonald’s restaurant on Fisherville Road in Concord, including a franchise letter agreement, a license agreement, and an operator’s lease. The defendant is the franchiser and owner of the building in which Colley/McCoy, as franchisee, operates the restaurant. The license agreement provided, in relevant part:
Licensee not an Agent of Licensor. Licensee shall have no authority, expressed or implied, to act as agent of Licensor, McDonald’s____Licensee is, and shall remain, an independent contractor responsible for all obligations and liabilities of, and for all loss or damage to, the Restaurant and its business____
The operator’s lease also provided:
No Agency Created: Lessee shall have no authority, express or implied, to act as agent of Lessor, or any of its affiliates for any purpose. Lessee is, and shall remain, an independent contractor responsible for all obligations and liabilities of, and for all loss or damage to, the Restaurant and its business____
Colley/McCoy operates as a separate entity, independent of McDonald’s Corporation. It is responsible for the cost of purchasing equipment for the restaurant, and paying for the fixtures, food products, advertising, *755maintenance, utilities, and insurance. It hires and trains its own employees. The license agreement provided that the defendant could hold Colley/McCoy in “Material Breach” and terminate the agreement if Colley/McCoy failed, among other things, to “maintain and operate the Restaurant in a good, clean, wholesome manner and in compliance with the standards prescribed by the McDonald’s System.”
In its role as franchiser of McDonald’s restaurants, the defendant published an operations and training (0 & T) manual, which addressed a number of issues related to the operations of McDonald’s restaurants, including safety and security procedures. However, the 0 & T manual provided:
McOpCo employees should consider the rules and regulations contained in this chapter as company policy. Independent owner/operators are encouraged to adopt appropriate policies for their restaurant.
A “McOpCo” is a restaurant that is owned and operated by the defendant itself.
The defendant employed field consultants to monitor McDonald’s restaurants. In early 2001, Christine Perrault assumed the role as field consultant for the Colley/McCoy restaurant. In January 2002, the defendant published a “Quality, Service, Cleanliness (QSC) Play Book” for field consultants to use in evaluating its restaurants and recommending improvements. On June 25, 2002, Perrault conducted a “restaurant systems review” of the restaurant and found deficiencies concerning shift management, food safety, and production. She requested that Colley/McCoy develop an “action plan” to rectify such deficiencies. Perrault also found several deficiencies in the restaurant’s execution of the “Safety and Security” system. She did not request the development of any action plan in response to these deficiencies.
The plaintiff began working at the restaurant in the late 1990’s as an overnight custodian. His shift was from midnight until 8:00 a.m. The restaurant was closed during that time and the plaintiff worked alone. On February 6, 2003, at approximately 3:00 a.m., two intruders attacked the plaintiff while he was taking a break outside of the restaurant. One of the intruders carried a baseball bat and ordered the plaintiff inside the building. Once inside, the intruders tied up the plaintiff and beat him with another pipe-like instrument. The intruders demanded that the plaintiff give them the combination to the safe. When he insisted that he did not know it, they beat him again until he lost consciousness. When the plaintiff awoke, he was face down on the restaurant floor. He remained motionless until the intruders left. At that point, he managed to untie himself and *756make his way to the restaurant’s panic button. After pressing the button, the plaintiff lost consciousness again. He alleges that the panic button was broken and did not alert the Concord police. At approximately 4:45 a.m., an employee reporting for work found the plaintiff unconscious and dialed 911. The plaintiff was transported to Concord Hospital where he was treated for multiple injuries.
The plaintiff brought claims for negligence and vicarious liability against the defendant as a result of injuries he suffered as an employee of Colley/McCoy. The trial court granted the defendant’s motion for summary judgment concerning both claims, finding that: (1) no genuine issues of material fact exist; (2) the defendant did not assume a duty to ensure that Colley/McCoy would follow its security measures designed to protect employees; and (3) the defendant did not retain sufficient control over Colley/McCoy’s security policy so as to subject it to vicarious liability.
On appeal, the plaintiff argues that the trial court erred in granting summary judgment on his negligence and vicarious liability claims by: (1) ignoring evidence in the record that the defendant assumed and breached duties to provide adequate security at the restaurant; and (2) ignoring evidence in the record that Colley/McCoy was an agent of the defendant.
II. Standard of Review
When reviewing a trial court’s grant of summary judgment, we consider the affidavits and other evidence, and all inferences properly drawn from them, in the light most favorable to the non-moving party. Sintros v. Hamon, 148 N.H. 478, 480 (2002). If our review of the evidence does not reveal any genuine issue of material fact, and if the moving party is entitled to judgment as a matter of law, we will affirm the trial court’s decision. Id. An issue of fact is “material” for purposes of summary judgment if it affects the outcome of the litigation under the applicable substantive law. Sandford v. Town of Wolfeboro, 143 N.H. 481, 484 (1999).
III. Negligence
We first review whether the trial court erred in granting the defendant summary judgment on the plaintiff’s negligence claim. The trial court concluded that the defendant “did not assume a duty to ensure that Colley/McCoy would follow several of its security measures designed to protect employees.” To prevail on his negligence claim against the defendant, the plaintiff had to show that: (1) the defendant owed him a duty; (2) the defendant breached this duty; and (3) the breach proximately caused his injuries. See Dupont v. Aavid Thermal Technologies, 147 N.H. 706, 709 (2002).
*757The plaintiff argues that the defendant “voluntarily assumed such a duty by adopting the ‘QSC Play Book,’ a year before [the plaintiff] suffered his attack.” Whether the defendant owed the plaintiff a duty is a question of law. Id. We have not addressed what constitutes a franchiser’s voluntary assumption of a duty to ensure the safety of a franchisee’s employees. We have, however, addressed a similar issue concerning a landlord’s voluntary assumption of a duty to protect tenants from criminal attack. See Walls v. Oxford Management Co., 137 N.H. 653, 658 (1993). As a general principle, landlords have no duty to protect others from criminal attack. Id. We recognized in Walls, however, that consistent with the RESTATEMENT (Second) Of Torts § 323 (1965):
[A] landlord who undertakes, either gratuitously or by contract, to provide security will thereafter have a duty to act with reasonable care. Where, however, a landlord has made no affirmative attempt to provide security, and is not responsible for a physical defect that enhances the risk of crime, we will not find such a duty.
Walls, 137 N.H. at 659. Breach of such a voluntarily assumed duty can create liability to third parties as well. RESTATEMENT (SECOND) Of TORTS § 324 A (1965). Section 324 A provides:
One who undertakes, gratuitously or for consideration, to render services to another which he should recognize as necessary for the protection of a third person or his things, is subject to liability to the third person for physical harm resulting from his failure to exercise reasonable care to protect his undertaking, if
(a) his failure to exercise reasonable care increases the risk of such harm, or
(b) he has undertaken to perform a duty owed by the other to the third person, or
(c) the harm is suffered because of reliance of the other or the third person upon the undertaking.
Id.
We must, therefore, examine whether the trial court erred by concluding that the defendant made no affirmative attempt to provide security to the employees at the Colley/McCoy franchise, and, consequently, assumed no such duty to the plaintiff. In reaching this conclusion, the trial court relied upon the plain language of the 0 & T manual, providing: “McOpCo employees should consider the rules and *758regulations contained in this chapter as company policy. Independent owner!operators [franchisees] are encouraged to adopt appropriate policies for their restaurant.” (Emphasis added.) The trial court, thus, found that Colley/McCoy, as a franchisee, was not required to implement the defendant’s security recommendations.. The trial court also relied upon the deposition testimony of Johnny Webb, McDonald’s divisional security manager, who testified that franchisees like Colley/McCoy were not required to follow the defendant’s security policies, and Christine Perrault, McDonald’s field consultant for the restaurant, who testified that her role was only to recommend and not mandate compliance with security procedures. The trial court also considered the affidavit of John Loftus, Vice President of Colley/McCoy, who stated that Colley/McCoy, and not the defendant, was responsible for security at the restaurant.
The plaintiff did not counter with affidavits or other contradictory evidence under oath to establish that the defendant required Colley/McCoy to follow its security procedures. He argues, however, that the trial court unreasonably ignored the plain text of the QSC Play Book in finding that the security procedures set forth therein were mandatory only for McOpCo restaurants. The plaintiff references the front page of the QSC Play Book, which indicates that the information therein is directed to “Operations Consultants and Owners/Operators, as well as all McOpCo personnel.” The QSC Play Book instructs the field consultant that subsequent to conducting the “restaurant systems review,” he or she should “discuss the impact of missing key success factors ... [t]o gain Owner/Operator or McOpCo Supervisor commitment to put missing key success factors in place.” (Emphasis added.) Specifically, the plaintiff contends that, through such language, the defendant undertook, in relevant part, , to evaluate franchisee compliance with the McDonald’s “Safety and Security” system, and to correct franchisee deviation by gaining a commitment to cure any violations and come into full compliance.
We do not find that language, in itself, to impose an explicit mandate upon the franchisee to implement the defendant’s security policies, and the plaintiff has not highlighted any additional language in the QSC Play Book that classifies franchisee non-compliance as grounds for termination of the franchise relationship. Nor has the plaintiff provided any supporting evidence for his contention that the defendant’s adoption of the QSC Play Book nullified any pre-existing policy, set forth in the 0 & T manual, specifically delegating responsibility for security issues to franchisees. While the plaintiff asserts that the defendant had discretion to terminate the license agreement if a franchisee failed to comply with “the standards prescribed by the McDonald’s System,” he presented no supporting *759evidence that the defendant could terminate the license agreement if a franchisee failed to meet specific security and safety standards set forth in the QSC Play Book.
In the absence of such evidence, the plaintiff urges the court to rely upon Martin v. McDonald’s Corp., 572 N.E.2d 1073 (Ill. Ct. App. 1991), in support of his position. In Martin, an Illinois appellate court affirmed a damages award against McDonald’s for injuries suffered by employees of a franchisee during a robbery of the restaurant. Id. at 1082-83. The court held that “there [wa]s ample support in case law and the facts ... to support a determination that McDonald’s Corporation voluntarily assumed a duty to provide security to plaintiffs and protect them from harm.” Id. at 1078. In Martin, however, the McDonald’s regional security manager “acted directly as security supervisor for the newly acquired [restaurant] ____Since [the franchisee] had neither an operations manager nor a security supervisor, these positions were handled by ... two executives from defendant McDonald’s Corporation.” Id. at 1077. The Martin court also found that the McDonald’s executives “undertook not only the obligation to check for security problems, but also to communicate to the store management what the security policies were and to ‘follow up’ to be certain that the problems had been corrected and the ‘recommended’ security procedures ‘followed.’ ” Id.
The trial court found that the “actions of [the defendant] regarding security in the present case [fell] far short of those described in Martin.” We agree. Colley/McCoy hires its own executives and employees. While in Martin the regional security manager and operations manager conducted security checks, which “included changing locks, and ordering a new security window and alarm system for the back door,” id., there is no evidence in this case that any executive or employee of the defendant participated in implementing a security system at the restaurant. Furthermore, Webb and Perrault testified that they recommended, but did not require, that franchisees like Colley/McCoy follow the defendant’s security policies and procedures.
In the absence of evidence in the record to the contrary, we conclude that the trial court did not err by finding that “no genuine issues of material fact exist and that [the defendant] did not assume a duty to ensure that Colley/McCoy would follow several of its security measures designed to protect employees.”
Next, the plaintiff, citing Iannelli v. Burger King Corp., 145 N.H. 190 (2002), argues that the trial court erred by granting summary judgment on his negligence claim because “landowners (like McDonald’s) bear liability for criminal attacks occurring on their premises where ‘the opportunity for *760criminal misconduct is brought about by the actions or inactions of the owner or where overriding foreseeability of such criminal activity exists.’ ” Specifically, he contends that the defendant created “the opportunity for criminal misconduct by [its] inaction in allowing [the plaintiff] to continue to work alone through the night in a profitable restaurant shrouded by darkness.” The trial court did not explicitly address whether the defendant, as landowner, “created the opportunity for criminal misconduct.”
We have specifically rejected liability for criminal attacks “based solely on the landlord-tenant relationship or on a doctrine of overriding foreseeability.” Walls, 137 N.H. at 659. We recognized in Walls, however, that special circumstances can impose a duty where a landlord created, or was responsible for, “a known defective condition on a premises that foreseeably enhanced the risk of criminal attack.” Id. (emphasis added). In Iannelli, the plaintiffs brought a negligence action against Burger King Corporation for injuries sustained as a result of an assault by teenagers at the restaurant. Iannelli, 145 N.H. at 190. The evidence supported a finding that the restaurant was aware of the teenagers’ threatening conduct towards the plaintiffs and other customers. Id. at 194-95. We, thus, concluded that the restaurant owed a duty to the plaintiffs to protect them from the assault as “the teenagers’ behavior in the restaurant created a foreseeable risk of harm that the [restaurant] unreasonably failed to alleviate.” Id. at 195. Unlike the plaintiffs in Iannelli, however, the plaintiff here has both: (1) failed to submit supporting evidence that the defendant knew, or should have known, that the restaurant was “shrouded by darkness” during the nighttime hours; or (2) failed to claim that the defendant knew, or should have known, of the impending actions of those who assaulted him. We, thus, conclude that the trial court did not err by rejecting a duty premised upon special circumstances and by granting the defendant’s motion for summary judgment on the plaintiff’s negligence claim.
IV. Vicarious Liability
Next, we review whether the trial court erred by granting summary judgment to the defendant on the plaintiff’s vicarious liability claim on the basis that no agency relationship existed between the defendant and Colley/McCoy.
Whether an agency relationship has been established is a question of fact. Herman v. Monadnock PR-24 Training Council, 147 N.H. 754, 758 (2002). “An agency relationship, or lack thereof, does not turn solely upon the parties’ belief that they have or have not created one.” Id. Rather, the *761necessary factual elements to establish agency involve: (1) authorization from the principal that the agent shall act for him or her; (2) the agent’s consent to so act; and (3) the understanding that the principal is to exert some control over the agent’s actions. Id.
The trial court concluded that “the record, viewed in the light most favorable to the plaintiff, does not support a finding that an agency relationship exists.” The trial court relied upon the absence of evidence that the defendant retained any control over Colley/McCoy security procedures, as well as the license agreement and operator’s lease which, as noted above, provided that there was no agency relationship between Colley/McCoy and the defendant.
The plaintiff argues that the presence of the relevant document provisions does “nothing to change the reality of agency.” He contends that by executing the license agreement, “Colley McCoy obtained McDonald’s authorization to act for McDonald’s as a purveyor of the ‘McDonald’s System,’ and Colley McCoy consented to act.” He further contends that:
McDonald’s has maintained a continuous prescription of what Colley McCoy shall and shall not do. McDonald’s mandates compliance with the “McDonald’s System.” McDonald’s mandates particular methods for preparing foods, as well as food preparation and service times. McDonald’s mandates through the “QSC Play Book” that franchisee restaurants such as Colley McCoy implement “key success factors” in their restaurants. Moreover, McDonald’s sends out field consultants such as Ms. Perrault to Colley McCoy to ensure that McDonald’s specifications are met.
We have yet to address the issue of the vicarious liability of a franchiser for the security breaches of its franchisee. The trial court correctly recognized, however, that although case law in other jurisdictions is not uniform, the weight of authority construes franchiser liability narrowly, finding that absent a showing of control over security measures employed by the franchisee, the franchiser cannot be vicariously liable for the security breach. See, e.g., Folsom v. Burger King, 958 P.2d 301, 309 (Wash. 1998) (en banc) (concluding that while Burger King reserved the right to enforce its standards and required that franchisees comply with the guidelines in Burger King’s manual, it had not “retained control over the security of the franchise restaurant”); Helmchen v. White Hen Pantry, Inc., 685 N.E.2d 180, 182-83 (Ind. Ct. App. 1997) (concluding that although the franchiser published a security manual and engaged in efforts to “heighten awareness” and “offer suggestions” concerning security to *762franchisees, it was not vicariously liable for the alleged negligence of its franchisee as it did not “specifically mandate any security measures”); Hoffnagle v. McDonald’s Corp., 522 N.W.2d 808, 814-15 (Iowa 1994) (concluding that even though McDonald’s required its franchisees to use its business manuals and attend training programs, its authority was “no more than the authority to insure ‘the uniformity and standardization of products and services offered by a [franchiser’s] restaurant’” and, thus, McDonald’s was not vicariously liable for the criminal assault by a third party at the franchisee restaurant).
In analyzing this issue, the trial court relied primarily upon Wendy Hong Wu v. Dunkin’ Donuts, Inc., 105 F. Supp. 2d 83 (E.D.N.Y. 2000), in which the United States District Court for the Eastern District of New York surveyed extensive state and federal case law concerning the vicarious liability of a franchiser for the security breaches of its franchisee. In Wendy Hong Wu, an employee of a Dunkin’ Donuts’ franchisee brought a vicarious liability claim against Dunkin’ Donuts after she was raped and assaulted while working the night shift. Id. at 86-87. The court specifically examined whether Dunkin’ Donuts had control over the alleged “instrumentality” that caused the harm. See id. at 87-88. The court held that since there was no evidence that Dunkin’ Donuts actually mandated specific security equipment or otherwise controlled the steps taken by its franchisees in general to protect employees, it was not vicariously liable for the alleged lapse in security. Id. at 94. The court reasoned that the franchise agreement was “primarily designed to maintain uniform appearance among its franchisees and uniform quality among their products and services to protect and enhance the value of the Dunkin’ Donuts trademark. [The franchisee] remain[ed] solely responsible for hiring, firing, and training its employees and for making all day-to-day decisions necessary to run the business.” Id. at 91. In addition to finding a lack of control over security matters within the franchise agreement, the court stated that “the undisputed evidence in the record demonstrates that [Dunkin’ Donuts] merely made security equipment available for purchase and suggested that alarm systems and other burglary prevention techniques were important.]” Id.
The plaintiff urges the court to rely instead upon Butler v. McDonald’s Corp., 110 F. Supp. 2d 62 (D.R.I. 2000), a case not addressed by the trial court. In Butler, the plaintiff brought suit against McDonald’s for injuries he sustained when the door of a franchisee restaurant shattered on his entry. Id. at 64. The plaintiff claimed that the injury was caused by the franchisee’s negligent failure to repair the premises but sought to hold McDonald’s vicariously liable pursuant to an agency relationship between McDonald’s and its franchisee. Id. McDonald’s argued that there was no *763agency relationship based upon the plain language of the franchise license agreement, which explicitly stated that “no agency had been created,” and an affidavit from a corporate officer of McDonald’s, stating that it did “not own, operate, or have a right to control the franchise restaurant.” Id. at 67. The plaintiff countered that McDonald’s exercised a right to control through its requirement that the franchisee conform to “the McDonald’s ‘comprehensive’ system, the frequent and detailed inspections of the premises and its operations, the taking of profits, and the right of defendant to terminate the agreement for material breach.” Id. The United States District Court for the District of Rhode Island concluded that the plaintiff offered sufficient evidence to demonstrate McDonald’s requisite right to control the franchise restaurant, and that a reasonable jury could have found the existence of an agency relationship. Id. at 67-68.
We find the reasoning employed by the Wendy Hong Wu court, which examined facts similar to those here, more persuasive than that in Butler, as we believe that this issue turns narrowly upon the defendant’s level of control over the alleged “instrumentality” which caused the harm. Wendy Hong Wu, 105 F. Supp. 2d at 87-88. The Butler court, by contrast, found an agency relationship based upon indicia of general control, see Butler, 110 F. Supp. 2d at 67; it did not determine whether McDonald’s specifically maintained a right to control repairs to the premises.
We agree with the trial court that the evidence demonstrates that although the defendant maintained authority to insure the uniformity and standardization of products and services offered by the Colley/McCoy restaurant, such authority did not extend to the control of security operations. See Hoffnagle, 522 N.W.2d at 814. Thus, there was no genuine issue óf material fact as to whether the defendant exercised control over the relevant security policies at the restaurant through adopting the QSC Play Book.
Because we conclude that the defendant did not retain sufficient control over Colley/McCoy’s security policies so as to subject it to vicarious liability, we hold that the trial court did not err in granting the defendant’s motion for summary judgment on the plaintiff’s vicarious liability claim.
Affirmed.
Broderick, C.J., and Duggan, Galway and Hicks, JJ., concurred.