More organisations are choosing to manage security themselves. It gives them control, builds knowledge that stays in the business and means security decisions are made by people who understand how the organisation works. This article sets out how to build an in-house security function in seven steps, what free tools can cover, and where outside help is worth bringing in.
Key takeaways
- An in-house security function can start with one person, provided that person has clear authority.
- Begin with a risk assessment. It tells you what to protect and where to spend effort.
- Free templates and checklists can cover much of the routine work.
- Outside help is most useful for independent review, specialist problems, peaks in workload and cover for key people.
- Ownership of security should stay inside the organisation, whoever helps.
What does an in-house security function do?
An in-house security function is the person or team inside an organisation that is responsible for protecting its people, information, property and operations. It does not have to do everything itself. Its job is to understand the risks, decide what to do about them, see that the work is done and keep senior management informed.
In most organisations the function covers physical security, personnel security, security of information in the workplace, incident response and a share of business continuity and crisis management.
When does an organisation need one?
- Security decisions are being made by whoever happens to be available.
- The organisation has grown, moved or opened new sites.
- A customer, insurer or regulator has started asking for evidence of how security is managed.
- The organisation works with government, or operates critical infrastructure, and has security obligations to meet.
- There has been an incident or a near miss, and nobody was sure who was in charge.
How do you build an in-house security function?
- Give one person the job. Name a single owner for security, write down what they are responsible for and give them the authority to act. Shared responsibility usually means nobody does it.
- Understand your risks. Start with a security risk assessment. List what you need to protect, who or what could harm it, and how well your current measures would hold. Everything else follows from this.
- Write a short policy and plan. A policy states what the organisation expects. A plan states what will be done, by whom and by when. Two or three pages each is enough to begin.
- Fix the basics first. Locks, keys, access cards, visitor handling, lighting, alarms and cameras that work and are checked. Most incidents exploit a basic gap, not a sophisticated one.
- Train your people. Staff are the first to notice that something is wrong. Short, regular security awareness training does more than a long session once a year.
- Plan for a bad day. Decide in advance who does what in an incident, how a crisis will be managed and how the business keeps running. Then practise it.
- Check and report. Review the controls at least yearly, record incidents and near misses, and report to senior management in plain terms: what the risks are, what has been done and what is still open.
These steps follow the approach in the international risk management standard ISO 31000 and the Australian security risk management handbook HB 167. Government agencies and their suppliers will also need to work to the Protective Security Policy Framework.
What skills does the function need?
The most useful security managers combine practical security knowledge with the ability to work with the rest of the business. They need to be able to:
- assess risk and explain it in plain language
- write a clear policy, plan or procedure
- manage suppliers such as guarding, alarm and camera companies
- run an incident calmly and learn from it afterwards
- win the support of senior managers and staff.
Few people are strong in all of these on the first day. That is normal. Skills can be built over time, and gaps can be covered with outside support while they are.
What can free tools cover?
A good template gives a capable person the structure to produce a sound first version without starting from a blank page. Agilient publishes free templates, checklists and self-assessment tools for exactly this purpose, along with plain-language guides to the main security and resilience topics.
For many organisations, these are enough to complete a first risk assessment, a business continuity plan and a basic review of a site. Use them freely. That is what they are for.
Where does outside help fit?
An in-house team does not need a consultant for its day-to-day work. Outside help earns its place in five situations:
- An independent view. A board, customer or regulator may want assurance from someone who did not design the controls. A security audit by an outside party provides it.
- A specialist problem. Some work comes up rarely, such as protecting a site against hostile vehicles, reviewing a camera system design or assessing a threat to a senior person. It seldom makes sense to keep those skills on staff.
- A second opinion. A short review of a plan or assessment by an experienced practitioner, before it goes to senior management.
- A peak in workload. A new site, a merger or a major event can double the work for a few months.
- Cover for a key person. When the security manager is on leave, or has left, someone needs to hold the role until it is filled.
In each case the outside party should work alongside the team and then step back. Ownership stays with the organisation. Agilient supports in-house security teams in this way, with reviews, mentoring, surge support and cover for key people.
What are the common mistakes?
- Buying equipment first. Cameras and access control should follow the risk assessment, not lead it.
- Placing the role too low. A security manager with no access to senior management cannot get decisions made.
- Writing documents nobody reads. A short plan that is used is worth more than a long one that is filed.
- Never testing. A plan that has not been exercised is a guess.
- Handing over ownership. A consultant can advise and assist. The organisation must still own its security.
Related reading: how to choose between a specialist and a large consulting firm.
