RiskUKApril2017

Security Services: Best Practice Casebook
security market begins to benefit from the
platform created as it moves into the next
logical phase of the industry’s future.
The demand for change is being fuelled by
increasing levels of expectation and a
requirement for flexibility in service provision
called for by today’s discerning clients. Key
transformations are beginning to emerge,
namely specialism and expertise.
Specialism and expertise
First, there are the large-scale, national and/or
multinational businesses. They offer a wide
range of security and facility services, and are
predominantly (although not exclusively)
focused on high value and potentially multiservice
contracts. There’s a clear demand for
this capability. Competitors simply don’t have
the capability or scalability to compete, and nor
should they attempt to do so.
Second, there are organisations that will
continue to focus on specialist services, skills,
clients, contract sizes and geographies, etc.
These businesses truly understand their core
role and continue to be selective in how they
target growth and assess their value
proposition. Our own organisation falls into this
category. We’re focused on the central London
market. We know full well that our model
doesn’t fit everyone and we fully understand
our capability. We’re aware, for example, that
we don’t have the infrastructure to deliver
national accounts with multiple low value
contracts, so we don’t try to do so.
Third, the area where it’s possible to see
accelerated development in 2017, and which to
some degree is the most interesting, is that of
collaborative business partnerships
incorporating convergence and the alignment of
operational and security strategies.
Security suppliers with specific expertise will
be working collaboratively to deliver highperforming,
flexible and complimentary
solutions. The convergence of physical and
cyber security delivers improved information
sharing on risks and can result in synergies and
more effective leveraging of resources.
Convergence can provide the benefit of
comprehensive capability, but with no dilution
in expertise. Individual solution providers will
heighten their knowledge and competencies. In
most cases, there’s a clear lead on provision.
To position this, security is – and should only
ever be – a supporting functionality that’s there
to enable a client’s core business. Many
business operations typically work in separate
silos and use different information and tools.
This can lead to overlapping processes and
higher costs. To alleviate inefficiencies, there
will be a move towards integrating operational
and security risk management.
Integrating disciplines
Often, organisations manage operational risk
and security risk separately. This incorporates
areas such as threat and vulnerability
management and continuous monitoring as
well as incident management.
Security risk management isn’t just about
security operations, but rather a bottom-up
approach that drives ‘actionability’ against
threats, vulnerabilities and incidents in order to
provide assurances for businesses.
While separating both operational and
security risk management has been a common
practice, dynamic changes in the threat
landscape are forcing organisations to integrate
the two disciplines and therefore gain a more
holistic view of risk. The unfortunate truth is
that one can schedule an audit, but one cannot
schedule an attack, in any of its various forms.
In light of this, an integrated approach to risk
that takes compliance, threats and
vulnerabilities as well as business impact into
account will become Best Practice. Without a
clear understanding of the business criticality
that an asset represents, an organisation is
unable to prioritise its efforts. A risk-driven
approach addresses both security and business
impact to increase operational efficiencies,
improve assessment accuracy, reduce attacks
and enhance investment decision-making.
The transition from the traditional
client/contractor relationship into genuine
partner and trusted advisor, and a compliancedriven
approach to a risk-based model, enables
businesses to evaluate the ongoing definition,
remediation and analysis of their risk.
Remote access is an increasing risk, and
indeed for many organisations has become
their key security focus. Furthermore, the
insider threat remains a concern given the
deluge of interconnected devices available.
Looking ahead, the industry will continue to
be subject to evolution rather than revolution in
the short term, but the pace and appetite for
change is increasing. If you look closely
enough, business models are becoming more
specific, technically competent and
sophisticated. This is a critical factor for
success when it comes to corporate stability.
Paul Harvey:
Commercial Director of
Ultimate Security Services
“There appears little appetite from the Government to push
forward with the proposed agenda of compulsory business
licensing. Nor does there seem to be significant
progression in the SIA’s Approved Contractor Scheme”
55
www.risk-uk.com