At some point someone will suggest that your organization needs a security assessment. It may be your insurance carrier, your board, a new operations leader, or a vendor who happens to offer one for free. The suggestion is usually correct. What is rarely clear to the executive receiving it is what a security assessment actually is, what it should produce, and why the answer to who performs it matters as much as whether it happens at all.
I have performed assessments across law enforcement, private security, and federal settings, and I have read many more that other people performed. The good ones share a structure and a purpose. The poor ones tend to be either a walk-through with a clipboard that produces a list of products, or a report so technical that leadership files it without acting. This article describes what a real assessment covers and how to make sure you get one.
What a Security Assessment Is
A security assessment is a structured examination of what your organization needs to protect, what threatens it, how well the current program addresses those threats, and where the gaps are. It begins with the assets, meaning the people, property, information, and operations whose loss would hurt. It considers the threats that are realistic for your type of organization, your locations, and your history, rather than every threat imaginable. It then examines the controls you have in place, physical, procedural, and human, and it tests whether they work rather than taking their presence as proof.
The output is a written report addressed to leadership. It should rank the findings by the harm they could enable and the likelihood of exploitation, and it should recommend actions in a sequence the organization can fund and execute. It should separate the items that cost nothing but attention from the ones that require budget, and it should be readable by a board member who has never worked in security. If the report cannot be used to make decisions, it has not done its job.
What a Good Assessment Actually Covers
Expect the assessor to walk every site, inside and out, at more than one time of day. Expect them to read every policy that exists and note every one that should exist and does not. Expect them to pull the guard contract and compare what it promises against the post orders and against what the officers are observed doing. Expect them to examine the access control system, including who holds credentials and when the list was last reviewed, and to look at the alarm and monitoring arrangements, including who actually receives a signal. Expect them to review incident reports from the past year or two, because patterns in those reports say more about real exposure than any checklist.
Expect them also to talk to people. The receptionist knows who gets waved through. The night supervisor knows which door sticks. The HR director knows which terminations worried her. A good assessor collects that knowledge, because it is where the organization’s actual security lives. And expect some testing rather than pure observation. An assessor who pulls on doors, watches a shift change, and calls the monitoring company to verify the call list is doing the work. One who only looks at the equipment and writes down what is there is doing an inventory.
Who Should Perform a Security Assessment
The person or firm performing the assessment should have three things. The first is operational experience in security, meaning they have run programs, responded to incidents, and managed the vendors and systems they are evaluating, rather than only having studied them. The second is the ability to write for executives, because an assessment that only a security professional can read will not be acted on. The third, and the one most often overlooked, is independence. The assessor should have no financial stake in what the assessment recommends.
That last point rules out the free assessment from the company that sells cameras, guards, or access control systems. Those firms may employ capable people, and the report may be accurate as far as it goes, but it will be shaped by what the firm sells. It will find that you need more of their product and it will rarely find that you are overpaying for a service they provide. I have written separately about why the vendor who assesses you should not be the vendor who sells to you, and it is one of the few rules in this field I consider absolute.
Can You Do It Yourself?
Parts of it, yes, and you should. An operations leader can walk the doors after hours, watch the guard post at shift change, call the monitoring company, and compare the access list against the current roster. Those tests will show you a great deal, and I encourage every executive to run them before hiring anyone, because the results will tell you how much help you need and make you a far better buyer of that help. What you cannot easily do internally is judge the threats specific to your organization, weigh the findings against each other, or know what a well-run program at a comparable organization looks like. That comparison is what experience provides, and it is what you are paying an assessor for.
Internal staff also carry a natural bias. The facilities manager who installed the current system is unlikely to find it inadequate, and the person who wrote the emergency plan is unlikely to find it unworkable. An outside assessor sees the program with no investment in its history, which is uncomfortable and useful in equal measure.
What Happens After the Assessment
This is where most assessments fail, and it has nothing to do with the quality of the report. The report is delivered, leadership reads it, a few inexpensive items are fixed, and the rest sits in a drawer because nobody owns it. Eighteen months later the organization pays for another assessment that finds the same things. The way to prevent this is to decide before the assessment begins who will own the results. Name the person, give them authority to act, and put a review of the findings on the leadership calendar every quarter until the list is closed.
In many mid-sized organizations there is nobody in a position to own it, and that discovery is often the most important finding of the assessment itself. It means the organization has a security leadership gap. A part-time executive security director can perform the assessment, own the results, run the tests on a schedule, and report to leadership in language leadership understands. The assessment then becomes the first ninety days of a program rather than a document. The testing discipline behind that approach is the subject of Until Tested: Security Is Only Assumed, which lays out the P.R.O.O.F. framework for verifying that a program works through testing rather than assumption.
Go Deeper
For a full description of the part-time executive model and how it compares to consultants and full-time hires, start with What Is a Fractional Security Director? The Complete Guide. My book Fractional Security Director covers the assessment process in detail and explains how it becomes the foundation of a working program.
Commissioner William Epps is a former elected Fire Commissioner, federal law-enforcement supervisor, and firefighter since 2006, with instructor credentials in Hazardous Materials response, Active Shooter preparedness, and Stop the Bleed®. He spent seven years in federal law enforcement in physical security, executive protection, and incident command, and now serves organizations as a Fractional Security Director. He is the author of The Spirit of Saul, The Spirit of Pharaoh, and other practical books on security, leadership, and faith, built around one idea: knowledge should be practical enough to use when it matters.
Leave a Reply