Security Industry Authority (SIA) Licence Security Guarding Specialist Module Syllabus

What does the access-control principle of 'authorisation, authentication and accountability' mean?

Authorisation = confirming the person is permitted access; Authentication = verifying they are who they claim (ID/pass/biometric); Accountability = recording the entry/exit so there is an audit trail of who was where and when.

What is 'tailgating' (or 'piggybacking') in access control and how is it prevented?

Tailgating is an unauthorised person following an authorised person through a controlled door before it closes. It is prevented by anti-tailgating measures such as turnstiles, mantraps/airlocks, single-person interlocks, staff challenge culture and 'one badge, one entry' rules.

What is a 'mantrap' (airlock) in access control?

A small interlocked space with two doors where the second door cannot open until the first has closed and the person is verified. It physically prevents tailgating and allows one person through at a time.

What is the purpose of 'key control'?

To account for every key at all times, prevent unauthorised access and copying, and maintain security of the premises. Lost or uncontrolled keys can compromise an entire site and may force expensive re-keying or lock changes.

What records must be kept in a key register/log?

For each key issue: the key number/identifier, who took it (name and signature), date and time issued, authorisation, and date/time returned with signature. The register provides accountability for every key movement.

What does 'key holding' responsibility mean for a security company?

The security provider holds keys to client premises and attends in response to alarm activations or emergencies (often instead of the keyholder), giving access to police/fire, securing the premises afterwards and resetting alarms — keeping the client's own staff out of danger.

Why should keys never be labelled with the address or door they open?

If lost or stolen, a labelled key tells a thief exactly which premises and door it fits, allowing direct unauthorised entry. Keys should carry only coded reference numbers cross-referenced in a secure register.

On what legal basis can a security officer search a person, their bag or vehicle?

Only with the person's consent. A security officer has no power to search without consent. The right to search is usually a condition of entry/employment (e.g. stated in the contract or site rules); if consent is refused, the officer can refuse entry but cannot use force to search.

What is the recommended procedure for searching a person to maintain propriety?

Gain consent; conduct the search in view of a witness; ideally search same-sex (a female searches a female); ask the person to empty pockets/open bags themselves rather than putting hands into pockets; be systematic and respectful; record the search.

Describe a systematic method for searching a vehicle.

Search in a logical, methodical order — exterior then interior — covering engine bay, wheel arches, under the vehicle, boot/trunk, under seats, glovebox, door pockets, behind panels and roof lining. Use a consistent clockwise/sectional pattern so nothing is missed, with the driver present.

What is the difference between a 'random' search and a '100%' (full) search regime?

A random search checks a selected proportion of people/vehicles (e.g. every nth person or by selection) as a deterrent; a 100% search checks everyone/everything. Random is less resource-intensive but relies on deterrence; 100% gives full coverage but is slower and costlier.

What is the basic principle of how an intruder alarm system works?

Sensors (detectors) monitor protected areas; when a sensor is triggered while the system is 'set/armed', a control panel processes the signal and activates a response — sounders/strobes and/or a signal to an Alarm Receiving Centre (ARC) which notifies keyholders or police.

Compare 'perimeter' detection with 'volumetric/space' detection in alarm systems.

Perimeter detection protects entry points and the building shell — door/window contacts, glass-break and vibration sensors — triggering as an intruder breaks in. Volumetric/space detection (e.g. PIR movement detectors) covers the open volume of a room, triggering on movement inside.

How does a Passive Infrared (PIR) detector work?

A PIR senses changes in infrared (heat) radiation across its field of view. When a warm body (person) moves across the detection zones, the change in infrared pattern triggers an alarm. It is 'passive' because it emits nothing, only detects radiated heat.

What is a 'dual-technology' detector and why is it used?

A detector combining two sensing technologies (typically PIR + microwave) that must BOTH trigger to raise an alarm. Requiring agreement greatly reduces false alarms caused by drafts, heat or movement that would fool a single technology.

What is an 'Alarm Receiving Centre' (ARC)?

A 24/7 monitoring station that receives signals from monitored alarm systems, verifies activations, and initiates the appropriate response — calling keyholders, dispatching a keyholding/response officer, or requesting police attendance under an agreed URN.

What does the 'set/unset' (arm/disarm) state of an alarm mean, and why does the entry/exit timer exist?

'Set/armed' means detectors are active and will trigger; 'unset/disarmed' means they are inactive for authorised occupation. The entry/exit timer gives an authorised user a fixed delay to enter and disarm (or to exit after setting) without causing a false alarm.

What does CCTV stand for and what is its primary security purpose?

Closed-Circuit Television. Its purposes are deterrence, detection, real-time monitoring/surveillance, and providing recorded evidence of incidents for investigation and prosecution.

What is the difference between a fixed camera and a PTZ camera?

A fixed camera covers one set field of view continuously. A PTZ (Pan-Tilt-Zoom) camera can be remotely moved to pan, tilt and zoom to follow activity and cover a wider area, but only views where it is currently pointed, so it can miss events elsewhere.

Under data protection law, what key obligations apply to CCTV operation in the UK?

CCTV must comply with the UK GDPR/Data Protection Act 2018: there must be a clear purpose, signage informing people they are being recorded, secure storage with limited access, retention for no longer than necessary, and the ability to handle subject access requests. The Surveillance Camera Code of Practice also applies.

What is a CCTV 'incident log' and why is it important for evidence?

A record kept by the operator of what was observed, when, on which camera, and any action/recording taken. It supports continuity (chain of custody) of footage, demonstrates proper operation, and makes recordings admissible and credible as evidence.

State the correct radio voice procedure principles (e.g. RSVP / the radio check).

Speak with Rhythm, Speed, Volume and Pitch (RSVP): speak clearly and steadily, slightly slower than normal, at adequate volume and even pitch. Listen before transmitting, press-pause-then-speak, identify yourself and the recipient, keep messages brief, and acknowledge receipt.

What do the radio terms 'Over', 'Out', 'Roger' and 'Say again' mean?

'Over' = I have finished speaking and expect a reply; 'Out' = transmission ended, no reply expected (never 'over and out'); 'Roger' = message received and understood; 'Say again' = repeat your last message.

In the NATO phonetic alphabet, give the words for the letters S, I and A.

S = Sierra, I = India, A = Alpha. The phonetic alphabet is used to spell out words, names and registrations clearly over radio to avoid letters being misheard.

What does PPE stand for and give three examples relevant to security work.

Personal Protective Equipment. Examples: high-visibility jacket/vest, safety boots, hard hat/helmet, ear defenders, eye protection, cut-resistant or rigger gloves, torch, and protective gloves for searching/first aid. Employers must provide PPE free under PPE/Health and Safety law.

Under which law is PPE provision governed, and whose duty is it to provide it?

The Personal Protective Equipment at Work Regulations 1992 (as amended) and the Health and Safety at Work etc. Act 1974. It is the employer's duty to provide suitable PPE free of charge and to maintain it; the employee must use it correctly as instructed.

What is a 'lone worker' device and why is it important for security officers?

A personal safety device (often combining GPS, two-way audio and a panic/SOS button, sometimes with man-down detection) that lets an isolated officer summon help and be located in an emergency. It is important because security officers frequently work alone in remote or high-risk settings.

What is a 'threat' versus a 'vulnerability' versus a 'risk'?

A threat is a potential source of harm (e.g. a burglar, fire, terrorist). A vulnerability is a weakness that the threat could exploit (e.g. an unlocked gate). Risk is the likelihood of the threat exploiting the vulnerability and the resulting impact — often expressed as $Risk = Likelihood \times Impact$.

Express the standard risk-rating relationship as a formula.

$$Risk = Likelihood \times Impact$$ where likelihood is the probability of an event occurring and impact is the severity of its consequences; multiplying them gives a score used to prioritise controls.

List common types of threat a security officer must identify on an assignment.

Theft/burglary, robbery, vandalism/criminal damage, arson/fire, trespass and unauthorised access, violence/assault, terrorism, fraud, sabotage, and natural/environmental hazards (flood, gas leak). Officers stay alert to suspicious behaviour, packages and vehicles.

What does the acronym 'HOT' stand for when assessing a suspicious package?

Hidden (deliberately concealed?), Obviously suspicious (wires, smell, leaks, unusual features?), and Typical (is it typical of what should be there or out of place?). If a package is HOT, do not touch it — clear the area and follow the suspicious-item/terrorism procedure.

What immediate steps should an officer take on discovering a security breach or intrusion?

Raise the alarm and inform the control room; assess the situation and your own safety (do not put yourself at unnecessary risk); observe and gather information; summon police/assistance as required; protect the scene/evidence; and make an accurate written report afterwards.

Why should a lone security officer generally observe and report rather than physically confront intruders?

Because a security officer has limited legal powers and personal safety is the priority; confrontation risks injury and legal liability. Accurate observation and reporting (descriptions, direction of travel, vehicles) lets police respond effectively while the officer stays safe.

What is the correct procedure for receiving and checking a delivery?

Verify the delivery is expected and authorised, check the driver's/company identity, match goods against the delivery note/order, inspect for damage or tampering, record details in the log, obtain signatures, and direct the vehicle to the correct controlled area without leaving it unattended in a secure zone.

What security risks arise from goods movement and deliveries, and how are they controlled?

Risks include theft (goods taken out concealed in vehicles), unauthorised access via delivery routes, and bogus/illegitimate deliveries used to gain entry. Controls: booking-in procedures, ID checks, escorting drivers, comparing in/out loads against documentation, search regimes and CCTV at loading bays.

What is 'business continuity' and why does a security officer contribute to it?

Business continuity is an organisation's ability to keep critical functions running, and to recover quickly, during and after a disruptive incident (fire, flood, attack, IT failure). Security officers contribute by preventing/limiting incidents, protecting people and assets, and following the Business Continuity Plan to aid rapid recovery.

What are the four broad categories of assets a security officer protects?

People (staff, visitors, public), property/physical assets (buildings, equipment, stock, cash), information/data (documents, IP, personal data), and reputation/business operations. Protecting all four underpins the client's continued operation.

What is a Business Continuity Plan (BCP) and what does it typically contain?

A documented plan for maintaining and restoring critical operations after a disruption. It typically contains a business impact analysis, identified critical functions, roles and responsibilities, emergency contacts, response and recovery procedures, communication plans, and alternative arrangements/sites.

Define the security principle 'need to know' and its relevance to protecting information assets.

'Need to know' restricts access to sensitive information to only those whose duties genuinely require it, regardless of their rank or clearance. It limits the spread of information, reducing the chance of leaks, espionage and insider threat, thereby protecting information assets.