Security Industry Authority (SIA) Licence Close Protection Specialist Module Syllabus

What are the main steps of the risk management process in close protection?

Identify the threats/hazards, assess the risk (likelihood and impact), evaluate against tolerance, then control/treat the risk by avoiding, reducing, transferring or accepting it — followed by monitoring and review.

List the hierarchy of options for treating a risk, in order of preference.

1) Avoid/eliminate the risk, 2) Reduce/mitigate it with protective measures, 3) Transfer it (e.g. insurance, contractors), 4) Accept the residual risk — avoidance is always preferred in close protection.

What is the difference between a hazard and a risk?

A hazard is something with the potential to cause harm; a risk is the likelihood of that harm occurring combined with its severity/consequence.

What does 'defence in depth' (concentric rings of protection) mean?

Layering protective measures in successive rings around the principal — inner (personal escort), middle (team/venue security) and outer (advance/intelligence/perimeter) — so an attacker must defeat multiple layers, giving time to detect and respond.

What is the purpose of reconnaissance (recce) in close protection?

To gather information about routes, venues and accommodation in advance — identifying hazards, entry/exit points, safe havens, hospitals and choke points — so that planning is informed and surprises are minimised.

Distinguish between a route recce and a venue recce.

A route recce assesses the journey (roads, alternative routes, choke points, ambush points, traffic, en-route safe havens/hospitals). A venue recce assesses a destination (access control, layout, exits, safe rooms, parking, communications, local contacts).

Why should a CPT always plan a primary route and alternative routes?

To avoid predictability and to provide options if the primary route is blocked, compromised or ambushed — varying routes and timings reduces the chance of a successful pre-planned attack.

What is a 'choke point' on a route, and why is it significant?

A point where a vehicle/foot movement is forced to slow, stop or funnel into a narrow area (junctions, bridges, gates, traffic lights). It is significant because it is a likely attack/ambush location where the principal is most vulnerable.

What is a 'safe haven' (safe house) in route and journey planning?

A pre-identified secure location along a route (e.g. police station, hospital, embassy, friendly premises) to which the principal can be taken in an emergency for refuge or medical aid.

Define surveillance in the close protection context.

The systematic, often covert, observation of a person, place or activity to gather information — used by hostile parties to plan an attack, and the very activity CPOs aim to detect.

What is counter-surveillance, and how does it differ from anti-surveillance?

Counter-surveillance is the deliberate detection and identification of hostile surveillance (often by a separate team). Anti-surveillance is the actions the principal's party takes to detect, evade or shake off surveillance during their own movements.

What does the 'attack cycle' (hostile planning cycle) teach a CPO about defeating attacks?

Attacks follow predictable stages — target selection, surveillance/information gathering, planning, rehearsal, execution, escape. Because surveillance precedes the attack, detecting hostile reconnaissance early allows the attack to be disrupted before execution.

What does the acronym TEDD help an operative recognise hostile surveillance?

Time, Environment, Distance and Demeanour — if the same person/vehicle is seen over multiple Times, in different Environments, over varied Distances, with poor/suspicious Demeanour, it strongly indicates hostile surveillance.

What is the basic principle behind close protection foot formations?

Formations position team members around the principal to provide 360-degree cover, react to threats from any direction, control the principal's movement, and create a protective bubble that can adapt to the environment (open, crowded, narrow).

Describe the role positions in a typical box (diamond) formation for one principal with multiple operatives.

The principal is in the centre; operatives are positioned front, rear and on both flanks (a box/diamond) giving all-round cover. The Team Leader/PES controls movement, with arcs of observation assigned to each operative so all directions are watched.

In a single-operative escort, on which side and where does the CPO generally position themselves?

Slightly to the rear and to one side of the principal (typically on the side of greatest threat or kerb side), within arm's reach — close enough to cover and evacuate the principal but not impeding their movement.

What is meant by 'arcs of observation/responsibility' in a formation?

Each operative is assigned a sector (arc) of the surrounding area to watch and cover, so that collectively the team maintains continuous 360-degree observation with no blind spots and clear accountability for each direction.

What is the CPO's immediate priority during an attack on foot?

To get the principal away from the threat — cover (shield) and evacuate the principal to a safe location/vehicle. The priority is extraction, not engaging the attacker; protection is about distance and cover, not confrontation.

What is the principle of 'cover and evacuate' versus 'fight'?

The protective doctrine is to use the operative's body and movement to shield the principal and remove them from danger (cover and evacuate). Fighting/engaging the attacker is only justified when it is the only way to create the opportunity to escape.

Why is the embus/debus phase (entering and exiting vehicles) considered high risk?

Because the principal is stationary, exposed and often at a predictable location/time (choke point), making it the most vulnerable moment of a journey — a prime point for ambush and kidnap.

What is the recommended order for embus and debus relative to the principal?

Operatives should secure the area first; the principal is normally the last to embus (board) and the first to debus (alight) so that they spend the minimum time exposed and the surroundings are already secured/covered by the team.

In a single protected vehicle, where does the Team Leader/CP commander typically sit and why?

In the front passenger seat — to navigate, communicate, observe the route ahead, control the driver and react, while the principal sits in the rear (usually offside/behind the front passenger) where they are least exposed and can be shielded.

What is a vehicle 'reverse-into-park'/tactical parking principle for secure transport?

Vehicles should be parked facing the direction of escape (e.g. reversed into a bay or nose-out) so the team can drive away immediately without manoeuvring, reducing the time the principal is exposed during departure.

What basic anti-ambush driving response should a security driver take if blocked?

Avoid stopping in the kill zone: use evasive driving to ram/push past a blocking vehicle, reverse out, or perform a J-turn to escape — the priority is to drive the principal out of the ambush, not to stop and fight.

What is the purpose of access control at a venue or residence?

To regulate who enters and leaves — verifying identity and authority, screening for weapons/threats, preventing unauthorised access, and maintaining a record — so that only vetted persons reach the principal's environment.

What is a 'safe room' (panic room) and what features should it have?

A reinforced, lockable room where the principal can shelter during an intrusion until help arrives. It should have a solid door, independent communications, lighting, basic supplies/first aid, and ideally CCTV and a duress alarm.

What outer-to-inner layers should be assessed when securing a residence?

Perimeter (fences, gates, lighting, CCTV), grounds/approach, building shell (doors, windows, locks, alarms), internal access control, and the inner sanctum/safe room — applying defence in depth around the principal.

What does the acronym SAFE/the emergency response priorities remind a CPO to do at an incident scene?

Prioritise: cover and evacuate the principal first, then assess danger to self and team, raise the alarm/communicate, manage the scene, and seek medical/emergency support — the principal's safety always comes first.

What is an emergency action/anti-ambush drill, and why is it rehearsed?

A pre-planned, rehearsed immediate response to a specific incident (attack, breakdown, medical emergency, fire). Rehearsal means the team reacts instantly and instinctively under stress, reducing reaction time and confusion when seconds matter.

What is the difference between an evacuation and a lockdown response?

Evacuation removes the principal from danger to a safer location (used when the threat is at/approaching the current location). Lockdown secures the principal in place behind defences (safe room) when moving them would be more dangerous than staying.

Why is effective communication essential within a CPT, and what should radio procedure be?

Coordination, threat warnings and incident response all depend on clear, real-time communication. Radio procedure should be brief, clear, use agreed call signs/codewords, confirm receipt, and keep the net free for priority traffic.

Define conflict management and its relevance to a CPO.

Conflict management is the use of communication, de-escalation, body language and positioning to prevent or resolve hostile/aggressive situations without force — vital for CPOs handling crowds, fans, paparazzi or aggressive individuals around the principal.

Name techniques a CPO uses to de-escalate a confrontational situation.

Calm tone and open body language, active listening, maintaining a safe reactionary gap/distance, non-threatening positioning, signposting consequences, giving the person a face-saving exit, and avoiding triggers — while staying alert to the need to extract the principal.

What is the 'reactionary gap' and why does a CPO maintain it?

The minimum safe distance kept between the operative/principal and a potential threat (often around an arm's length or more) that gives time to perceive and react to a sudden attack before it can reach the principal.

In close protection, when is physical intervention by a CPO justified?

Only as a last resort, when reasonable, necessary and proportionate to protect the principal (or in self-defence/defence of others), and only for as long as the threat persists — the lawful aim is to create the opportunity to cover and evacuate.

What is the purpose of disengagement skills for a CPO?

To enable the operative to break away from a grab, hold or assault and create distance, so they can return to their primary duty of covering and evacuating the principal rather than becoming embroiled in a fight.

Why is the CPO's first-aid priority sometimes summarised as treating life-threatening conditions in order?

Because in an emergency you treat the most immediately fatal problems first — using a structured primary survey (e.g. catastrophic bleeding, then Airway, Breathing, Circulation, Disability, Exposure) to keep the casualty alive until medical help arrives.

What does the primary survey sequence <C>ABCDE stand for in trauma first aid relevant to CP?

Catastrophic haemorrhage (control major bleeding), Airway, Breathing, Circulation, Disability (neurological status), Exposure/Environment — addressing the most rapidly life-threatening problems first.

Why should a CPO know the principal's medical details and the locations of hospitals en route?

So that allergies, conditions and medications can be communicated to medics quickly, and the principal can be taken to appropriate care without delay during a medical emergency or injury — pre-planned hospital routing saves critical time.

What is the difference between proportionate and excessive use of force, in law?

Proportionate (reasonable) force is the minimum necessary in the circumstances as the operative honestly perceived them to address the threat. Excessive force exceeds what is necessary/proportionate and is unlawful, exposing the CPO to criminal and civil liability.

On what legal basis can a CPO in the UK use force to protect the principal?

Force may be used in self-defence, defence of another, or prevention of crime, provided it is reasonable, necessary and proportionate in the circumstances as the operative honestly believed them to be (common law self-defence and s.3 Criminal Law Act 1967).

Does a CPO have any greater legal powers than an ordinary member of the public in the UK?

No — a CPO has no special legal powers; they act with the same rights and limits as any citizen (e.g. citizen's arrest, self-defence) and are fully accountable for their actions under the law.

What is the SIA, and which licence relates to close protection in the UK?

The Security Industry Authority (SIA) is the UK regulator for the private security industry under the Private Security Industry Act 2001. Close protection work requires a front-line SIA Close Protection licence (which also covers door supervision activities).

Why must a CPO keep accurate records, logs and reports of incidents?

For accountability, legal evidence, continuity of information, demonstrating that actions were reasonable and lawful, supporting any prosecution or defence, and improving future planning — proper documentation protects both the principal and the operative.

What is the relationship between confidentiality and data protection law for a CPO?

Personal information about the principal must be handled lawfully under data protection legislation (UK GDPR/Data Protection Act 2018): collected for legitimate purposes, kept secure, shared only on a need-to-know basis, and not disclosed without authority.

What is a 'need-to-know' principle and how does it apply to CP operations?

Sensitive information (itineraries, the principal's identity, movements, vulnerabilities) is shared only with those who genuinely require it to perform their role, limiting the chance of leaks that could compromise security.

What does the protective concept of 'time, distance and shielding' mean in an attack response?

Minimise the time the principal is exposed, maximise the distance between the principal and the threat, and use shielding (operatives' bodies, cover, hard structures) — together these reduce the probability and severity of harm.

What is an Operational/Assignment Order (briefing) and what does it typically contain?

A structured pre-task brief covering the situation/threat, mission, execution (routes, timings, formations, roles), administration/logistics, and command/communications — ensuring every team member understands the plan and their responsibilities.

Why is predictability the CPO's enemy, and how is it countered?

Predictable routines, routes and timings let hostiles plan an attack. It is countered by varying routes, timings and patterns, conducting counter-surveillance, and avoiding fixed habits — denying attackers a reliable opportunity.