2

Core Competencies to Create Effective Protection Programs

Abstract

To accomplish the goals of successful management practice, what's important has to be determined. This chapter looks at the evolution of security as a management activity. The growth of services, products, and systems is provided. Most important security threats are presented.

Keywords

security programs history of security security and the law security unions leading management security issues national critical infrastructure

Private security is more than twice the size of federal, state, and local law enforcement combined.

-The Hallcrest Report II

Security activities for an organization are often centered within a department dedicated to delivering value to the organization through services. As the previous chapter indicated, much flux occurs in the nature of organizations themselves and within various departments providing such services. Still, some generalizations can be made that will be appropriate for various types of managerial situations. This chapter examines the means whereby organizations with dedicated security departments are organized to serve the entire operation. It further looks at the relationship between organizations that contract out for routine security services. We begin by examining core competencies of security operations.

Core Competencies of Security Operations

Core competencies refer to the fundamental abilities a protective program needs in order for it to deliver services effectively. These needs will vary according to the type of organization, its size and geography, recent history, criticality of resources, vulnerability to losses, and other factors. No single executive is expected to be competent in all demands required of the position, but the subsequent subsections serve as a means of generating thought as to what a protective operation's value to the organization is or could be. This list is dynamic and reflects the changing nature of the requirements of security programs and of the expectations of people heading them.

Initiating and Managing Security Programs

As discussed in the previous chapter, problems and opportunities require appropriate response. The circumstance might be minor, requiring brief intervention. Or it could be a situation requiring the creation of new managerial protocols. That is, a program needs to be developed. The identification of these situations, their analysis after fact-finding, the organizing of an appropriate program, the appointing of a deputy to operate the new program, and its supervision and constant improvement are reasonable expectations. Three skills reflect the core competencies executive management expects from the senior security personnel: 1. Initiating new programs. Organizations are never static. New issues require fresh responses. Assume that in 5 or 7 years the organization will be considerably different than it is today. Security management programs change in parallel with other activities in the workplace. 2. Operating existing programs. The ability to initiate a successful program is a strategic skill, whereas the operation of existing programs is less challenging. Nonetheless, this is the basis of most daily work and includes opportunities for creativity and constant program improvement, much as what occurs in the initiating of such activities. Another core skill is the ability to collect information that is critical to the operation and assess the success of ongoing programs (see Box 2.1). The manager or director for such operations normally manages the budget for these activities (see Chapter 8). 3. Handling personnel administration. The recruiting, screening, hiring, training, supervising, promoting, disciplining, terminating, and conducting of other personnel-related activities are expectations of high-performance security operations (see Chapters 3-7).

Box 2.1   Collecting and measuring what's important

Once goals are set, data are needed to evaluate how successfully aims are being reached. Relevant data collection can also point to other issues that require more attention than what was initially apparent. Managers believe that data - the metrics - are indispensable in creating a sensible program. Much of the burden of collecting systems inputs can be collected through automated systems. The data can then be analyzed, sometimes with the use of computer programs that can produce extensive reports, nuanced to the issues that are important. Analysis is improved. This is partially why security operations have provided greater measurable value over the years. Criminal incidents must be collected for legal and risk management purposes and also so that they can be measured for any relevant trend. Services performed by security personnel may be collected and measured for the same reasons. The following reflects the information a security department might collect to assess programmatic developments. Number of criminal incidents, including: Robbery Aggravated assault Other assault Burglary Larceny (theft): employee Larceny: nonemployee Motor vehicle theft Forgery and counterfeiting Fraud and embezzlement within the facilities Vandalism on or near property Trespassing Other Network interfaces (computer crime), including: Virus and worm incidents Computer system crashes (utilities problems) Flooding or denial-of-service (DoS) attacks Spoofing (appropriation of an authentic identity by nonauthentic users with the attempt to cause fraud or attack critical infrastructure) Intellectual property infringement Other Number of noncriminal emergencies, including: Accidents (within the facility) Accidents (automotive) Accidents (in the proximate area) Dangerous behavior Fires and smoke conditions False alarms Losses of utilities Malfunctions of critical equipment Slips and falls Water and flood damage Wind damage Other Number of service activities, including: Complaints and miscellaneous Compliance - regulatory Employee records checks Escort services Executive protection detail Information provided Investigations (internal) Investigations (personnel-related) Investigation (external) Key runs Lock or key service Lost and found Visit by inspectors or regulators Initiating new programs, operating existing ones, and dealing with personnel issues are expectations of all managers, not just those concerned with asset protection. However, some tasks are specific to loss prevention staff: Contract services management. Since a large portion of security services nationwide is provided by contract personnel, operations must be able to select, motivate, supervise, and discipline contract vendors and their personnel so that goals are met (Chapter 9). Private investigations. Investigations within the workplace may be managed internally or contracted to outside investigators or consultants. But the security manager in charge is likely to monitor the assignment to assure that objectives are pursued diligently. Assess security technology. Security practitioners are not expected to be engineers. However, they are required to be familiar with current technologies to serve the protective objectives of the organization. They should further be able to procure such technology and services under favorable terms for management (see Chapter 10). Other expectations. As indicated above, security programs have considerable variations in their operational goals. Therefore, some organizations will have such core competency objectives as executive protection, international affairs, risk management, competitive intelligence, data security,...