You have decided the organization needs security leadership and you have decided a part-time executive is the right way to get it. Now you are wondering what you will actually see for the retainer in the first quarter, and whether you will know by the end of it if the decision was right. Those are fair questions, and the answer should be specific enough that you can hold the person to it.
This article lays out what a fractional security director does in the first 90 days as I run them, week by week. Every engagement is different in the details, but the shape is consistent because the problem is consistent. The organization has been operating on assumptions about its security for years, and the first quarter is about replacing those assumptions with facts and a plan. If you are reading this before you hire, use it as a checklist for the conversation. If you have already hired, use it to measure the progress you are seeing.
Weeks One and Two: Access, Documents, and the First Walk
The first two weeks are about getting inside the organization. I ask for the guard contract and the post orders, every written policy that touches security, the last two years of incident reports, the access control user list, the alarm monitoring agreement, and the floor plans. Most organizations cannot produce all of these on request, and the gaps are the first finding. A policy that nobody can locate is a policy that does not exist. A guard contract that has auto-renewed three times without anyone reading it is a contract the vendor is managing rather than the client.
While the documents are being gathered I walk the primary site, during business hours and again after hours. I am looking at how people enter, where the receptionist can and cannot see, which doors are propped, where deliveries come in, how the parking area is lit, and what the guard does when someone approaches the desk. I also meet the people who will make or break the program: the head of facilities, the HR lead, the IT director, and whoever signs the security invoices. By the end of week two I should have a written list of what exists, what is missing, and what I still need to see.
Weeks Three Through Six: Interviews and Testing
The middle of the first quarter is where the real assessment happens, and most of it is listening. I sit down with department heads, shift supervisors, and front-line staff and ask them what worries them, what they have seen, and what they do when something goes wrong. The night shift lead usually knows about a door that has not latched properly in a year. The HR director usually has a file on a former employee that still keeps her up at night. Leadership rarely hears any of this because nobody has ever been assigned to collect it.
This is also when I stop taking anything on faith. I pull on the doors that are supposed to be locked. I call the alarm company and ask who receives the signal and what they do with it. I watch the guard post at shift change and see whether credentials are checked or whether familiar faces are waved through. I run a short tabletop with the managers who would have to respond to a credible threat and see how far they get before someone asks who is supposed to call whom. My doctrine, which I laid out in Until Tested: Security Is Only Assumed through the P.R.O.O.F. framework, is that a control you have never tested is a control you are only assuming. By week six I want a list of assumptions that survived testing and a list that did not.
Weeks Seven and Eight: The Assessment Leadership Can Read
Around the end of the second month I deliver a written assessment, and I write it for the executive team rather than for security people. It ranks the risks the organization actually faces, based on what I found rather than on what the industry says everyone should fear. It separates the exposures that need money from the ones that need only a decision and a signature. It names the quick fixes that are already underway and puts a rough cost range next to the larger items so the CFO can start thinking about the budget cycle rather than being surprised by it later.
I present this in person to whoever I report to and, if the arrangement calls for it, to the board or a committee of it. The presentation is short and the questions are long, and that is how it should be. Leadership needs to understand the exposure well enough to make decisions about it, and the assessment fails if they leave the room unable to explain the top three risks in their own words.
Weeks Nine Through Twelve: Quick Fixes and the Plan
The last month of the first quarter is where the organization starts to feel different. Some of the fixes cost nothing but attention and I push those through immediately. The access list gets scrubbed of former employees, ended contractors, and vendors whose agreements lapsed. The propped door gets a closer and a sign and a conversation with the department that props it. The post orders get rewritten so the guard knows what the organization actually expects. The alarm call list gets corrected so the signal reaches someone who can act on it.
Alongside the quick fixes I write the plan for the year. It sequences the larger work, names who owns each piece, sets the review cadence, and defines what the organization will test and when. It also sets up the monthly rhythm that the retainer will follow from here: incident review, vendor meetings, department check-ins, and a written brief to leadership. By day 90 the organization should have a clear picture of its exposure, a plan it can fund, and a director with enough relationships to execute it.
What You Should Expect to Have in Hand
If you are the executive on the other side of this engagement, here is how to judge it. At the end of the first quarter you should be holding a written assessment you can read without a translator, a list of what was tested and what the tests showed, a record of the quick fixes that were completed, and a twelve month plan with owners and rough costs. You should also be able to name the person your managers now call when something feels wrong, and that person should have already met them.
If you are missing most of that, ask why. Sometimes the answer is that the organization was slow to produce documents or grant access, and that is worth fixing on your side. Sometimes the answer is that the director spent the quarter proposing equipment rather than finding out what was true, and that is worth fixing by finding a different director. The first 90 days are the clearest test of whether you hired a leader or a salesperson, and you should not wait for the second quarter to decide.
Go Deeper
For the full definition of the role, how it is structured, and how it compares to consultants and full-time hires, start with What Is a Fractional Security Director? The Complete Guide. My book Fractional Security Director walks through the first quarter and every quarter after it in detail, including the templates I use for the assessment and the plan.
Commissioner William Epps is a former elected Fire Commissioner, federal law-enforcement supervisor, and firefighter since 2006, with instructor credentials in Hazardous Materials response, Active Shooter preparedness, and Stop the Bleed®. He spent seven years in federal law enforcement in physical security, executive protection, and incident command, and now serves organizations as a Fractional Security Director. He is the author of The Spirit of Saul, The Spirit of Pharaoh, and other practical books on security, leadership, and faith, built around one idea: knowledge should be practical enough to use when it matters.
Leave a Reply