What does security consultancy provide?

The starting point is understanding the organisation and what its security function needs to achieve.

There is no single security solution that works for every organisation.

A factory, financial institution, corporate office, agricultural operation and international business may have very different security requirements.

The consultant therefore needs to understand the environment before recommending a direction.

From information to action

An independent security risk assessment can provide detailed information about the security situation, while consultancy can help the organisation understand what needs to happen with that information. This is an important distinction. An assessment investigates and reports on what is found, while consultancy provides specialist advice on how the organisation can consider and respond to that information. A security advisor may then continue to provide guidance as the organisation considers security decisions, changes and improvements.

The exact scope depends on the organisation’s requirements.

The important principle is that the advice should remain focused on the security function rather than on selling a particular product or service.

Security technology is only part of the solution.

Modern security technology can provide enormous amounts of information. Cameras can identify movement and activity, access control systems can record entries and exits, biometric systems can identify individuals, alarms can generate alerts, and control rooms can bring information from different systems together.

However, information is not automatically secure. The organisation needs to understand what the information means and what must happen next. If an alert is generated, someone must know who receives it and what action is required. If something unusual is identified, there must be an appropriate response. If access is granted, there must be a legitimate reason for that access, and if a contractor’s circumstances change, someone must know what should happen to the contractor’s access.

This is where procedures, instructions, communication and accountability become important.

A consultant therefore looks beyond whether a system has been installed or whether it is functioning. The question is whether the system is contributing to the security function it was intended to support and whether the information it produces is being used appropriately.

Independent advice

Independence is an important part of our consultancy approach. An organisation should be able to receive specialist advice without that advice being influenced by the consultant’s ability to sell a product or service. This creates a different starting point. Instead of asking which product can be supplied, the consultant can first ask what the organisation actually requires.

Existing systems can be considered alongside existing service providers, different technologies, procedures and management processes. The objective is to understand the complete requirement before deciding what, if anything, needs to change.

This approach can also help organisations use their security budgets more deliberately.

Buying more equipment does not automatically improve security. Sometimes the existing equipment is adequate, and the problem lies elsewhere. In other cases, the technology may need to change. There may also be a need for better procedures, clearer instructions or a better understanding of responsibilities.

The consultant’s role is to distinguish between these requirements and provide advice based on what the organisation actually needs, rather than on what can be sold.

Coming SoonSecurity advisor and ongoing consultancy

Security does not stop once a report has been completed or equipment has been installed.

Organisations change over time, as do the people, operations, technology and service providers that support them. As these elements change, the security requirements of the organisation can change with them.

Security requirements can therefore change as well.

An ongoing security advisor or security consultancy relationship can provide an organisation with access to specialist knowledge when these decisions arise.

The advisor can help management consider security questions from a specialist perspective rather than treating every new problem as an isolated issue.

This is particularly useful where an organisation does not have its own dedicated security specialist or where management wants an independent second expert opinion.