How to Choose a Responsible Private Security Provider

A security provider may be responsible for access to buildings, sensitive keys, incident response and the safety of people working at your premises. The appointment should therefore be based on evidence, operational detail and contract control – not price alone.

The Security Industry Authority regulates individuals undertaking defined licensable activities in the UK. It does not license security companies. Buyers should understand that distinction and carry out separate checks on the people deployed, the business supplying them and the proposed service model.

Start by defining the security requirement

Before requesting quotations, set out what the premises actually requires. A vague specification makes proposals difficult to compare and can result in a service that is either inadequate or unnecessarily expensive.

The premises, operating hours and periods of highest risk.
The people, property, information and business activities that need protection.
Known incidents, access problems, alarm activations or vulnerable areas.
Required services, such as manned guarding, mobile patrols, keyholding, alarm response, lock and unlock, vacant-property inspections or reception security.
The actions the provider may take and the situations that must be escalated to the customer, emergency services or another authorised contact.
The records, reports and management information the customer expects to receive.

A site assessment should convert this information into a workable security plan. The final specification should describe outcomes and responsibilities rather than relying on a generic officer schedule.

1. Check the licensing position

The SIA states that a licence may be required where work is supplied under a contract for services and involves a licensable activity. Manned guarding and keyholding are among the activities identified by the regulator.

Ask the provider how it verifies licences before deployment and during the contract. The check should cover the correct licence type, current validity and any role-specific requirement. Buyers can also use the SIA’s public register of licence holders.

2. Verify every approval or accreditation claim

Where a provider states that it is an SIA approved contractor, check the SIA register rather than relying solely on a logo or proposal statement. The SIA describes the Approved Contractor Scheme as a voluntary quality-assurance scheme.

The absence of ACS approval does not, by itself, mean that a company is operating unlawfully. However, a false claim of approval is a serious credibility concern. Apply the same discipline to British Standards, ISO certifications, trade memberships and insurance statements: ask for the current evidence and confirm its scope.

3. Examine screening, right-to-work and recruitment controls

Security personnel may have unsupervised access to premises, keys, vehicles, stock and confidential areas. The buyer should understand how the provider confirms identity, right to work, employment history and suitability for the role.

BS 7858 provides a recognised code of practice for screening individuals working in secure environments. Buyers should ask whether screening follows BS 7858 or another defined, appropriate standard, how gaps are investigated and who approves deployment before screening is complete. Do not accept the phrase “fully vetted” without knowing what it means in practice.

4. Review the site assessment and assignment instructions

Assignment instructions are the operational reference for the people delivering the service. They should be specific to the site and controlled so that current information is available to the right personnel.

Post duties, patrol areas and access-control responsibilities.
Opening, closing, key and alarm procedures.
Authorised contacts and escalation routes.
Actions for fire, intrusion, violence, medical incidents and suspicious activity.
Lone-working arrangements and welfare checks.
Reporting requirements and evidence preservation.
Restrictions on the officer’s authority and matters reserved for the customer.

Ask who writes, approves and updates the instructions. A strong document is useful only if it reflects the premises and the people using it understand their responsibilities.

5. Require a credible mobilisation plan

Mobilisation is where many service problems begin. A proposal should explain what will happen between contract award and the first operational shift or patrol.

Site survey and transfer of accurate operational information.
Recruitment, screening, licensing and training checks.
TUPE assessment where an existing contracted workforce may transfer.
Uniform, equipment, keys, access credentials and communications.
Site induction, familiarisation and competency checks.
Contingency arrangements for absence, delay or incomplete information.
Customer approval and a clear go-live decision.

The provider should also identify assumptions and customer dependencies. Mobilisation cannot be controlled where access information, emergency contacts or authority levels remain unresolved.

6. Understand supervision and service continuity

Ask how the provider will confirm that officers and mobile personnel attend, understand the assignment and perform the required duties. The answer may involve supervisory visits, attendance records, patrol verification, management reviews and direct customer contact.

Continuity arrangements also matter. Establish how sickness, holidays, vehicle failure, severe weather and urgent operational changes will be managed. If subcontracting may be used, the contract should define when it is permitted, how quality will be controlled and who remains accountable.

7. Agree reporting before the service starts

A customer should not have to discover after an incident that essential facts were not recorded. Agree the reporting process, recipients, urgency levels and method of delivery during mobilisation.

Routine shift, patrol or visit records.
Immediate notification of critical incidents.
Structured incident reports distinguishing observation from assumption.
Photographs where lawful, necessary and operationally appropriate.
Outstanding actions with a named owner and target date.
Trend information showing repeated faults, access issues or vulnerable periods.

8. Review the commercial and contractual position

The charge rate is only one part of the commercial decision. Review what is included, what may generate additional charges and whether the proposed staffing model is sustainable.

Pay assumptions, working hours, relief coverage and supervision.
Mobilisation and demobilisation costs.
Uniform, equipment, vehicles, fuel and technology charges.
Price review mechanisms and changes in statutory employment costs.
Payment terms, invoice evidence and dispute procedures.
Insurance, liability limits, indemnities and exclusions.
Service levels, remedies, termination rights and transition support.

A rate that cannot support lawful employment, adequate relief and competent management may create service failure later. The buyer should test the operating model, not simply select the lowest figure.

Buyer’s evidence checklist

The final decision

A responsible provider should be able to explain how the service will work at the customer’s site, what evidence will be produced and who will remain accountable when circumstances change. Clear answers before award are usually more valuable than broad claims in a sales presentation.

Tornado FM Ltd provides manned guarding, mobile patrols, keyholding, alarm response, lock and unlock services, vacant-property inspections, security assessments and concierge or reception security. The appropriate service should be based on the site, operating hours, access arrangements and identified risks.

Discuss your site security requirements with Tornado FM Ltd.

Related Tornado FM Ltd pages

The Terrorism (Protection of Premises) Act 2025, commonly known as Martyn’s Law, establishes new requirements for certain premises and events across the UK. It is intended to improve preparedness and help reduce physical harm if a terrorist attack occurs.

The Act received Royal Assent on 3 April 2025. Home Office statutory guidance was published in April 2026. As at 14 July 2026, the substantive requirements have not yet commenced. The SIA states that the law is expected to come into force in spring 2027, and organisations do not yet need to notify the regulator.

What premises may be in scope?

A premises is not automatically in scope because it is commercial, publicly accessible or considered high risk. The statutory test considers several criteria, including the type of premises, its principal use, the number of people reasonably expected to be present and whether an exclusion applies.

The Home Office guidance states that qualifying premises generally need to be wholly or mainly used for a purpose listed in Schedule 1 to the Act and reasonably expect 200 or more people, including staff, to be present at the same time from time to time.

Standard and enhanced tiers

Certain premises have exclusions or different treatment. Qualifying events also have separate criteria. Organisations should therefore use the statutory guidance and decision tools rather than relying on headline capacity figures alone.

Who is the responsible person?

For qualifying premises, the responsible person is generally the individual or organisation with control of the premises for its relevant Schedule 1 use. This may not always be the building owner. Lease structures, management agreements and event-hire arrangements can create several parties with different areas of control.

Where there is more than one responsible person, or qualifying premises sit within other qualifying premises, the Act includes co-ordination requirements so far as reasonably practicable. Property owners, managing agents, tenants and event organisers should map responsibilities rather than assume another party is dealing with them.

What are public protection procedures?

The statutory guidance identifies four types of public protection procedure. The appropriate procedure will depend on the premises, the incident and the safest available option.

Evacuation – moving people out of the premises or away from a dangerous area.
Invacuation – moving people to a safer place within the premises.
Lockdown – securing the premises to control movement into or out of it.
Communication – alerting people to danger and providing clear instructions, where safe to do so.

Procedures must be capable of being put into effect. A document stored in an office is not enough if reception staff, security officers, managers, tenants or contractors do not understand what to do.

What additional measures apply to the enhanced tier?

Enhanced-tier premises and qualifying events will need to consider appropriate public protection measures, so far as reasonably practicable. The Act groups these around monitoring, movement, physical safety and security, and the security of information.

The responsible person must document the procedures and measures in place or planned, together with an assessment of how they are expected to reduce vulnerability or physical harm. Where the responsible person is an organisation or company, a sufficiently senior individual must be designated to ensure compliance.

What can facilities and property managers review now?

Premises should not buy generic products or training simply because they are marketed as “Martyn’s Law compliant”. The SIA, Home Office and ProtectUK do not endorse third-party products or providers that claim to guarantee compliance.

A sensible preparation programme starts with the site and the people using it.

1. Check whether the premises may fall within the Act’s scope and record the basis for the initial view.

2. Identify who controls the premises for its principal use and whether other responsible persons may exist.

3. Map occupancy patterns, including staff, visitors, tenants, contractors and event attendance.

4. Review current emergency procedures for evacuation, invacuation, lockdown and communication.

5. Check whether access control, reception, guarding and contractor-management arrangements support those procedures.

6. Confirm who can make decisions, activate procedures and communicate with people on site.

7. Review how procedures are communicated to permanent staff, temporary staff, contractors and security personnel.

8. Carry out exercises or structured walk-throughs and record lessons requiring action.

9. Maintain an action plan and monitor official implementation updates from the Home Office, SIA and ProtectUK.

The role of physical security services

A security provider cannot transfer the responsible person’s legal accountability or guarantee compliance. It may, however, support the practical operation of agreed procedures and measures.

Security assessments examining access, vulnerable areas and operational dependencies.
Manned guarding and reception security supporting access control and communication.
Patrols checking physical conditions, perimeter issues and unauthorised access.
Lock and unlock arrangements aligned with authorised opening and closing procedures.
Incident reporting and escalation to create a clear operational record.

The precise security role should be written into assignment instructions and co-ordinated with the customer’s emergency, fire-safety and business-continuity arrangements.

Avoid these common mistakes

Assuming every commercial premises is within scope.
Treating the threshold as the only legal test.
Buying a generic package before understanding the site and its responsibilities.
Confusing a security provider’s service with the responsible person’s legal duty.
Writing procedures without testing whether staff can carry them out.
Failing to co-ordinate with landlords, tenants, neighbouring premises or event organisers.
Publishing a claim that the organisation is compliant before the duties and regulator processes are fully operational.

A proportionate next step

Facilities and property managers do not need to wait until commencement to understand their premises and improve basic preparedness. The correct approach is proportionate: identify potential scope, review procedures, clarify responsibilities and address practical weaknesses that are relevant to the site.

Tornado FM Ltd provides security assessments, manned guarding, mobile patrols, keyholding, alarm response, lock and unlock services, vacant-property inspections and concierge or reception security. Any support connected with Martyn’s Law should be presented as operational security support, not a guarantee of legal compliance.

Arrange a discussion about the physical security and operational procedures at your premises.

Related Tornado FM Ltd pages

Mobile security patrols and static guarding both provide a visible security presence, but they solve different operational problems. The right choice depends on what needs to be protected, when intervention is required and how frequently the site needs attention.

British Standards distinguish static guarding from mobile security services. BS 7499:2020 addresses the management, staffing and operation of static guarding on a site, while BS 7984-3:2020 provides recommendations for mobile patrol services. Neither model should be selected without considering the actual risk and operating environment.

What is static guarding?

Static guarding places one or more security officers at a defined site for agreed hours. The officer may remain at a fixed post or move around the premises as part of their duties.

Controlling staff, visitor, contractor and vehicle access.
Monitoring entrances, loading areas and vulnerable parts of the premises.
Carrying out internal or external patrols.
Responding to incidents within the officer’s authority and assignment instructions.
Maintaining occurrence records and reporting security concerns.
Supporting reception, opening, closing or emergency procedures where specified.

The principal advantage is continuous presence during the contracted hours. This is valuable where the premises has regular activity, frequent access decisions or a risk that requires immediate on-site action.

What are mobile security patrols?

A mobile patrol service sends a trained security operative to inspect one or more premises at agreed times or within defined service windows. Patrols may be scheduled, varied or triggered by a specific requirement.

External checks of doors, windows, gates, perimeter areas and visible damage.
Internal checks where authorised access is provided.
Lock and unlock duties.
Checks of vulnerable areas or known recurring problems.
Recording observations, exceptions and required follow-up.
Providing a visible but intermittent deterrent.

Mobile patrols are commonly suitable where a permanent officer is not required, several locations need visits or the main requirement is out-of-hours checking and reporting.

Direct comparison

When static guarding may be more appropriate

The site has continuous staff, visitor, contractor or vehicle movements.
Unauthorised access needs to be challenged or escalated throughout operating hours.
The premises contains high-value assets, sensitive operations or areas requiring active control.
There is a reception, gatehouse or control point that must remain staffed.
Incidents need an immediate on-site response within clearly defined instructions.
The security role forms part of wider emergency, fire, welfare or business-continuity arrangements.

When mobile patrols may be more appropriate

The premises is closed or lightly occupied for significant periods.
The main requirement is to inspect the perimeter, entrances or selected internal areas.
A property portfolio needs a consistent out-of-hours checking service.
A visible deterrent is required without continuous staffing.
Lock, unlock or vacant-property inspection duties are required.
The customer wants documented checks and escalation of exceptions.

A combined service may be the better answer

The choice is not always binary. A site may use static guarding during busy or higher-risk periods and mobile patrols overnight, at weekends or across satellite properties. Keyholding and alarm response may sit alongside either model.

A combined plan should avoid gaps and duplicated duties. The provider and customer should define who responds, who has authority to enter, what the mobile operative checks and what happens when an incident extends beyond the planned visit.

Questions to answer before selecting a model

1. When is the premises occupied, unoccupied or most vulnerable?

2. Does the site require continuous access decisions or only periodic checks?

3. How quickly must an incident be identified and acted upon?

4. Which areas can be safely and lawfully accessed by a mobile operative?

5. Are there lone-working, welfare or conflict risks for the person attending?

6. What evidence must be produced after every shift, patrol or exception?

7. Could a blended service provide adequate control at a more proportionate cost?

Cost should follow the risk assessment

Mobile patrols often involve fewer on-site hours than static guarding, but they are not automatically suitable or cheaper in every case. Travel, visit duration, frequency, internal access, out-of-hours requirements and incident attendance all affect the operating model.

Static guarding involves continuous staffing costs, including relief, management and employment obligations. The key question is whether continuous presence is justified by the operational requirement and consequences of failure.

Make the decision site-specific

ProtectUK advises that no single security measure will prevent crime or terrorism. Effective physical security is layered and proportionate. Guarding or patrols should therefore work with access control, alarms, lighting, physical barriers, staff procedures and reporting.

Tornado FM Ltd provides both manned guarding and mobile patrols, together with keyholding, alarm response, lock and unlock services, vacant-property inspections, security assessments and concierge or reception security.

Tell Tornado FM Ltd about your premises, operating hours and current security arrangements.

Related Tornado FM Ltd pages

A keyholding and alarm response service gives an authorised security provider responsibility for controlled keys or access information and a defined role when an alarm or attendance request is received. The service should protect the customer’s premises without transferring unclear risks to staff or leaving critical decisions unresolved.

BS 7984-1:2016 provides recommendations for the management, staffing and operation of keyholding and response services. The SIA also identifies keyholding as a licensable activity in relevant circumstances. Buyers should therefore examine licensing, key control, attendance procedures and reporting as a connected service.

Secure key and access-information control

The provider may hold physical keys, access cards, codes or other information that could enable entry. The customer should understand how these items are collected, identified, stored, accessed and returned.

Use a controlled reference that does not unnecessarily identify the premises.
Restrict access to authorised personnel.
Maintain an issue and return record.
Separate sensitive access information from obvious site-identifying details where practicable.
Set a process for lost, damaged, changed or compromised keys and credentials.
Review access information after tenant, staff, alarm or lock changes.

The contract should identify who owns replacement costs and what happens if the customer provides inaccurate or obsolete access information.

Accurate site and escalation information

Alarm response depends on the quality of the information available to the attending operative. A site information record should normally cover:

Full address, safe approach and authorised entry points.
Alarm zones, panel location and any available activation information.
Known hazards, restricted areas and lone-working concerns.
Nominated customer contacts in priority order.
Authority to reset, isolate, secure, wait for a contractor or leave the premises.
Police, fire, alarm receiving centre and specialist-contractor arrangements where applicable.
Animals, machinery, roof access, confined spaces or other material site risks.

Information should be reviewed periodically and after any operational change. An out-of-date contact list can turn a manageable activation into a prolonged incident.

A clearly defined activation process

The provider, customer and alarm receiving centre should understand how an attendance request is authorised and transmitted. The process should identify what information is provided, how receipt is confirmed and what happens if the first responder cannot attend.

Avoid relying on informal telephone arrangements that are not reflected in the contract or site instructions. The customer should know whether the service covers intruder alarms, fire alarms, environmental alarms, access problems or other attendance requests, and what exclusions apply.

Safe attendance at the premises

Alarm response frequently involves lone working, reduced visibility and uncertain conditions. HSE guidance requires employers to manage lone-working risks, train, supervise and monitor lone workers, keep in touch and respond to incidents.

Dynamic assessment of the approach and visible conditions.
Communication and welfare arrangements for the responding operative.
Restrictions on entering where there are signs of intrusion, fire, violence or another serious hazard.
Escalation to emergency services or the customer where the operative should not proceed alone.
Instructions for preserving potential evidence and avoiding unnecessary disturbance.

A security operative is not a police officer, firefighter, engineer or locksmith unless separately qualified and appointed. The service should define the responder’s role and limits.

External and internal checks

The attendance procedure should state what the operative is expected to inspect. This may include the perimeter, doors, windows, alarm panel, visible internal areas or the reported alarm zone where safe and authorised.

The objective is to establish what can reasonably be determined, take authorised action and provide a reliable report. It is not to search unsafe premises or guarantee that no incident has occurred.

Making the premises secure

The contract should define what the provider may do when damage or intrusion is found. Possible authorised actions may include closing an unsecured opening, arranging an approved emergency contractor, maintaining a presence while responsibility is transferred or contacting a nominated manager.

Spending limits, approval requirements and customer availability should be agreed in advance. Without them, an operative may be unable to protect the premises or may incur costs the customer did not authorise.

Reporting after every attendance

The customer should receive enough information to understand why attendance occurred, what was found and what remains outstanding.

Time the request was received and the operative was dispatched.
Arrival and departure times.
Condition of the perimeter and access points.
Alarm information and areas checked.
People contacted and instructions received.
Actions taken, including reset, isolation or contractor attendance.
Photographs where appropriate and lawful.
Outstanding faults, damage or recommended follow-up.

Service reviews and false-alarm patterns

Repeated activations should not become a routine attendance cost without investigation. Reports can identify recurring alarm zones, access failures, environmental causes or contact problems. The customer, alarm company and security provider should review patterns and allocate corrective action.

Questions to ask a keyholding provider

1. How are keys and access details identified, stored and audited?

2. Which SIA licences are required for the personnel delivering the service?

3. What information is required before the service can go live?

4. What hazards or circumstances prevent entry?

5. What authority does the operative have to spend money or instruct contractors?

6. How are lone-worker safety and communications managed?

7. What report will be issued after each attendance?

8. How are site details reviewed and updated?

A service built around the premises

Keyholding is not simply storing a key. It is a managed chain of authority, information, attendance, safety, action and reporting. The service should be designed around the premises and integrated with the customer’s alarm, access and emergency arrangements.

Tornado FM Ltd provides keyholding, alarm response, mobile patrols, lock and unlock services, vacant-property inspections, manned guarding, security assessments and concierge or reception security.

Request an initial discussion about your alarm, access and out-of-hours escalation requirements.

Related Tornado FM Ltd pages

A security report should enable the customer to understand what happened, what the security operative observed, what action was taken and what remains unresolved. A list of vague statements or ticked boxes does not provide effective operational control.

Good reporting supports immediate decisions, investigations, insurance enquiries, health and safety reviews, contract management and longer-term risk reduction. HSE guidance on investigating incidents emphasises gathering information, analysing it, identifying controls and implementing an action plan.

Different reports serve different purposes

The reporting structure should distinguish routine activity from exceptions and urgent incidents.

Shift or occurrence log – a chronological record of relevant activity during a guarding shift.
Patrol or inspection report – evidence that agreed locations and conditions were checked.
Incident report – a structured account of an event requiring action, escalation or investigation.
Alarm response report – details of the activation, attendance, findings, contacts and site condition.
Action log – outstanding issues, responsible persons, target dates and closure evidence.

Using the wrong report type can bury a serious issue in routine information or generate unnecessary incident reports for ordinary activity.

Record the essential facts

A useful incident report should normally include:

Date, time and precise location.
The reporting person and other people directly involved or present.
How the incident was discovered or reported.
What was seen, heard or found.
Immediate risks and any continuing hazard.
Actions taken and the authority for those actions.
People contacted, instructions received and reference numbers.
Evidence secured or preserved.
Outstanding actions and the person responsible for follow-up.

The report should be completed promptly while the details are fresh, but urgent safety and escalation actions take priority over writing.

Separate observation from assumption

Security personnel should record what they directly observed and identify information received from somebody else. They should not present an opinion as established fact.

Where an inference is operationally relevant, label it clearly and state the evidence supporting it. Accurate language protects the customer, the officer and any later investigation.

Create a reliable timeline

Time information helps the customer reconstruct an incident and assess response. Record times consistently and identify whether they come from personal observation, a system record, CCTV, an alarm receiving centre or another person.

Time the incident occurred, if known.
Time it was discovered or reported.
Time security attended or took control.
Time the customer or emergency service was contacted.
Time instructions were received and actions completed.
Time responsibility was transferred or the incident was closed.

Use photographs and video carefully

Images can show damage, position, condition and change over time. They can also contain personal data, confidential information or material relevant to a criminal investigation.

The customer and provider should define when images are appropriate, where they are stored, who can access them and how long they are retained. The ICO’s data-minimisation principle requires organisations to collect and hold personal data that is adequate, relevant and limited to what is necessary for the purpose.

Escalation is part of the report

A report should not be the first time the customer learns of a serious incident. The assignment instructions should identify immediate notification thresholds and the approved communication method.

Threat to life, violence or medical emergency.
Fire, smoke, flooding or a serious safety hazard.
Confirmed or suspected intrusion.
Loss of keys, access credentials or confidential material.
Major building damage or failure of a critical security system.
A person refusing to leave or comply where the situation is escalating.

The report should record the escalation without replacing it. It should show who was contacted, when, what information was given and what instruction followed.

Track actions to closure

A recurring weakness in operational reporting is the failure to close actions. The same broken gate, failed light or access-control fault may appear in several reports without a named owner or completion date.

Give each action a unique reference.
Assign an owner with authority to complete or commission the work.
Set a target date based on risk.
Record temporary controls while the permanent action is outstanding.
Require closure evidence and verify it where necessary.

Use reporting to identify patterns

Individual reports explain individual events. Management information should also show repeated issues by location, time, incident type or cause. HSE guidance on work-related violence recommends recording and reviewing incidents to determine whether further controls are needed.

Repeated alarm activations from the same zone.
Doors or gates regularly found unsecured.
Unauthorised access attempts during the same operating period.
Contractors failing to follow access or lock-up procedures.
Areas where lighting, fencing or visibility repeatedly contributes to concern.

Trend information should lead to decisions. A dashboard that does not trigger ownership or action has limited value.

Protect personal and sensitive information

Security reports may contain names, contact details, vehicle registrations, images, allegations or information about health and behaviour. The customer and provider should identify their respective data-protection roles, lawful basis, access controls and retention requirements.

Collect enough information to fulfil the reporting purpose, but avoid irrelevant personal detail or speculative commentary. Where information may be shared with the police or another authority, record the decision and share only what is necessary and proportionate.

What customers should agree during mobilisation

1. The report types required for each service and incident category.

2. Immediate escalation thresholds and authorised contacts.

3. Mandatory fields and terminology.

4. Rules for photographs, attachments and personal data.

5. Delivery method, recipients and expected timescales.

6. Action ownership and closure procedure.

7. Monthly or quarterly trend and performance information.

8. Quality checks and correction of inaccurate reports.

Reporting demonstrates service control

Professional reporting is not an administrative extra. It is evidence that the service was delivered, risks were identified and decisions were communicated. It also gives the customer information needed to improve the premises and hold the right people accountable.

Tornado FM Ltd provides manned guarding, mobile patrols, keyholding, alarm response, lock and unlock services, vacant-property inspections, security assessments and concierge or reception security. Reporting requirements should be specified for each assignment and agreed before mobilisation.

Ask Tornado FM Ltd how security activity, incidents and outstanding actions would be reported for your site.