Introduction to Purchasing Security Introduction to Purchasing Security The key objective of this briefing is to bridge the gap of the complexities involved in buying security services. This has been achieved by incorporating the experiences and perspectives of both parties. The UK security sector is currently undergoing a period of rapid legislative change. Against a background when security and procurement professionals were found to have misunderstandings about each others role, a guide to good practice aimed at both groups was viewed as timely. Executive Summary contract management philosophy. All of • Whether those that quote the minimum Chief executives look to purchasing and which will encourage security providers to price can deliver on all aspects of the supply management to control costs and become superb suppliers and build contract. manage risks by removing vulnerabilities in unconditional trust with the client • The veracity of tender documents. the value chain.These are no less important organisation. The client organisation • Setting meaningful communication. when buying security. should be adaptable and should bring no • What you can get from a good supplier surprises. that you will not from a bad one. One of the important messages is that • Why an overarching security strategy is procurement is not an isolated activity within • Contract negotiation important. the organisation and when it comes to When negotiating a contract for a security • How to get behind the sales pitch. security many representatives should be provision, careful consideration will need brought together to help inform the buying to be given as to the types of clauses used. This business briefing on purchasing from the decision. For example, facilities management For example, many clauses used in service security services sector has been developed to are often linked to the provision of security, so contracts are generally termed boilerplate alert both security services and purchasing & taking account of their requirements is clauses, however, attention needs to be supply management (P&SM) professionals of crucial. given to more substantive clauses that will the common aspects of good practice. need to be embedded into the contract. The key to good security is to develop a 1. Introduction robust risk profile that considers the impact • Contract management Globalisation has brought about a rapid and of all the security risks upon all aspects of the - Service Level Agreements (SLAs) are extensive change in the way organisations business, ensuring that the security provision critical to the success in defining the operate. This change will increase has an appropriate balance between relationship between the client opportunities for wealth and well-being but technological and human resources. Clearly, organisation and its security provider. It also create new channels for risk and security services need to be cost effective and is becoming an increasingly important insecurity. proportionate to the risk.The following must document as it defines the basic be taken into account: - functional parameters such as service Business leaders are looking at ways to and quality. improve their own organisational readiness • Project definition - Key Performance Indicators (KPIs) are and responsiveness to address the above Defining the security requirements is one critical in all security agreements. It which are further complicated by issues such of the vital elements of the procurement ensures that the client organisations as pandemics, terrorism, natural disasters and process. The proposed specification needs expectations are not only defined, but even cyber threats. to be treated as a serious communication KPIs also serve to explain to the device that allows the security provider to security provider how their Ensuring organisations have the right balance gain a good understanding of what is performance will be appraised. between the ability to mitigate threats and the required. ability to respond to them is crucial for doing In conclusion, it is important that all parties business in the 21st century. Organisations • Prequalification involved in the procurement of security who maintain this fine balance will have the Prequalification criteria need to be broad services understand: - ability to weather the increasingly complex and cover at least the following: Details of • The nature of security risks and the precise business environment. the security provider’s organisation, the impact that security measures can make. commercial aspects of the offering and • The benefit of using accredited suppliers. 3 Introduction to Purchasing Security There is a growing need to ensure that an 2. Security & the changing UK difficult to find the right security provider. In organisation’s security provision adopts a landscape fact, organisations have been owned by proactive approach to the protection of The security services sector in the UK is a people with serious criminal records; it is tangible and intangible assets not only within growth industry. It covers a range of services anticipated as a consequence of PSIA 2001 your own organisation but also the supply from the application of physical hardware to licensing will bring about an end to this type chain you operate in.As organisations business wide electronic security systems that of malpractice. continue to outsource services or even require administration level operation and establish physical assets in this more complex management.As well as manned guarding and In the Information Technology sector, some business environment the protection of both wheel clamping. engineering standards have been developed tangible and intangible assets will require a through the efforts of the BSIA and other more strategic approach to buying security Until recently security services and security industry inspectorates to establish some base services. systems provision have been seen as tactical line requirements for security systems.These and operational and little thought has been standards are concentrated mainly in the area The UK security market now has an given to its strategic intent. For some time key of Intruder Detection and Remote Monitoring approximate net worth of £3 billion - £4 players within the security sector have been by using graded systems to meet a certain billion per annum, and this looks set to rise working hard to ensure a more professional level of security threat such as in the Banking according to Professor Martin Gill of provision of security services and this is now and Financial Sectors versus low level systems Perpetuity Research & Consultancy Ltd becoming a reality. for Domestic or Small Retail Systems.These (PRCI). Professor Gill argues that 43 per cent security systems standards have mainly been of organisations involved in buying security In January 2001 the Private Security Industry put in place due to the high number of police had seen a visible increase in security spend Act (PSIA) 2001 was published and the call-outs to false alarms or unverified requests as opposed to just 8 per cent who had seen a purpose of this legislation was to set up a to attend a situation reported through decline. He also states that 25 per cent of regulatory body, now known as the Security unqualified security systems that have not met organisations involved in the research were Industry Authority (SIA).The SIA was set up in these stringent standards. Relevant British planning to further increase their security April 2003, but the full impact for manned Standards are BS8418 for alarm verification spend, outnumbering those organisations security services did not come about until and BSI PD6662 for installation of intruder planning to reduce it. March 2006.This new legislation dictates that systems incorporating BS4737 requiring the anyone who provides unlicensed contracted use of graded equipment under EN50131 In response The Chartered Institute of security personnel is operating illegally and parts 1 to 6. Purchasing & Supply (CIPS) are partnering committing a criminal offence; the penalties with Perpetuity Research & Consultancy for which range from fines to 5 years Understanding the technology and setting up International (PRCI) who are spearheading the imprisonment.The effect on the market place the equipment requires a trained technician or Security Research Initiative (SRI).This of this legislation is difficult to anticipate at programmer with a logical understanding of initiative is supported by The Security this stage. However, it is not inconceivable to the organisation the system is effectively Institute (TSI),The British Security Industry expect higher prices and a reduced skilled controlling.Trained & qualified staff should be Association (BSIA) and ASIS International.The workforce from which to select manned audited to ensure the provider is able to meet SRI members include, Case Security, CMP, security providers as a consequence of this the specification or design.The use of HSBC, Initial Security, Johnson Controls, uncertainty. Organisations may just disappear consulting engineers is commonplace in KPMG, Norbain, OCS-Resolution, Securiplan, off the landscape because of associated costs security systems but it is difficult to qualify Spinnaker International,The Corps,Wilson of licensing or through mergers and experience in this field of expertise. James and Wyeth Pharmaceuticals acquisitions.This could result in a Membership of an institute or industry consolidation of the remaining suppliers, association