A security plan is often written at the point an organisation needs to show that it has one. It may satisfy an audit, support a tender or sit alongside wider risk documentation. That is not security planning for organisations. Planning only becomes valuable when it helps people make better decisions before, during and after a security incident.

The distinction matters. A polished plan will not help a duty manager recognise an emerging concern, a control room operator make a timely escalation, or a site team manage uncertainty while protecting people. Those outcomes depend on clarity, judgement and practice.

For many organisations, the real weakness is not the absence of a policy. It is the gap between what the policy says and what people can actually do under pressure. Modern threats expose old security thinking, particularly where plans rely on assumptions that have never been tested in the operating environment.

Start security planning with the operation

Good planning starts with the organisation’s purpose, people and daily activity. A crowded venue, a distribution centre, a corporate office and a construction project may share broad security principles, but their exposure, routines and response options are different. Borrowing a generic plan and changing the organisation’s name rarely produces useful protection.

Begin by understanding what must be protected and why. This includes people, critical activities, information, physical assets, reputation and the ability to continue operating. Then consider how normal operations create exposure. Public access, lone working, contractor movement, deliveries, cash handling, high profile events, shifts and changing site layouts all alter the risk picture.

Threat, vulnerability and risk assessments should inform this work, but they should not become an exercise in scoring for its own sake. A risk register can identify a concern. It cannot tell a supervisor whether their team understands the indicators they may see, who has authority to act, or what an effective first response looks like.

This is where planning needs operational input. Security managers should work with facilities, operations, HR, health and safety, IT, communications and senior leaders. Frontline staff also have useful knowledge. They know where routines are bypassed, where access controls cause friction and where a concern is likely to be noticed first.

Security planning for organisations needs decisions, not slogans

Most security plans contain familiar phrases: remain vigilant, report concerns, follow procedures and liaise with emergency services. None are wrong. None are enough on their own.

A workable plan defines decisions. It makes clear what staff should report, how reports are assessed, who decides on protective action and how that decision is communicated. It also addresses what happens when the person with nominal authority is unavailable. Incidents do not respect office hours, reporting lines or the timing of management meetings.

Consider a suspicious circumstance at a busy site. The issue may initially be ambiguous. Staff need a proportionate route to raise it without fear of being dismissed for overreacting. The receiving manager needs enough information to decide whether to observe, investigate through appropriate channels, restrict access, pause an activity or seek support. The plan should guide that process without pretending every incident will fit a neat sequence.

This is also where behavioural risk matters. People under pressure can become fixed on one explanation, delay escalation because they do not want to cause disruption, or communicate poorly when events move quickly. Planning should account for these predictable human factors. Clear thresholds, simple reporting routes and rehearsed roles reduce the chance that uncertainty becomes inaction.

There is a trade-off. Plans that prescribe every move become unusable when circumstances differ. Plans that remain too broad leave teams without direction. The aim is not a script. It is a shared operating framework that gives competent people boundaries, priorities and authority to act.

Build the plan around capability

A security plan should identify the capability required at each level of the organisation. Senior leaders need to understand their responsibilities, risk appetite and the consequences of delay. Managers need to coordinate people, resources and communications. Frontline teams need to spot concerns, report accurately and carry out their immediate responsibilities safely.

Training is often treated as the final stage of planning. In practice, it should shape the plan from the beginning. If staff cannot reasonably retain a complex procedure, it needs simplifying. If a role requires judgement, a short awareness briefing will not be sufficient. If a manager is expected to lead an incident, they need opportunities to practise decisions rather than merely read about them.

Online learning has a useful role, especially for establishing common knowledge and evaluating understanding at scale. It is not a substitute for local familiarisation, practical discussion or exercising. An organisation may be able to demonstrate completion rates while still being unable to manage a credible disruption. Certificates record attendance or assessment. Capability is demonstrated in performance.

This is particularly relevant as organisations prepare for requirements associated with Martyn’s Law. Compliance may drive initial activity, but the worthwhile outcome is a better prepared organisation. The question is not whether a plan exists. The question is whether staff can use it when the situation is unclear, communications are imperfect and normal routines have stopped.

Test assumptions before an incident tests them

A plan should be tested in stages. Start with a structured discussion involving those who have responsibilities within it. Use realistic scenarios that reflect the site, operating hours and likely pressures. Ask what information is available, who acts first, who contacts whom and what competing priorities may arise.

Tabletop exercises are valuable because they reveal uncertainty without creating operational disruption. They often expose simple but significant problems: outdated contact details, unclear command arrangements, competing evacuation and access-control priorities, or an assumption that another department owns the decision.

Where appropriate, practical exercises can then test communication, coordination and movement. These should be carefully designed, proportionate and safe. Their purpose is not to catch people out. It is to identify where the plan creates friction and where people need better preparation.

After every exercise or real event, review performance honestly. Avoid the familiar conclusion that the plan worked because no major harm occurred. A fortunate outcome does not prove a sound process. Look instead at how quickly concerns were recognised, whether information reached the right people, whether decisions were understood and whether teams could sustain their response.

The learning must return to the plan, training and operating routines. A lesson logged but not acted upon is simply a record of a known weakness.

Keep ownership alive

Security planning fails when it is treated as an annual document review. The operating environment changes more often than that. New premises, contractors, technology, opening hours, events, workforce changes and public profile can all affect risk and response.

Someone must own the plan, but ownership should not mean one person carries the whole burden. The security lead may coordinate reviews, while operational leaders confirm that procedures remain realistic and senior leaders ensure resources and authority are in place. This is especially important where security is delivered through a contracted service. Contract oversight should test whether the service is contributing to the organisation’s actual risk reduction, not merely meeting staffing numbers.

Useful measures go beyond incident totals. Low reporting may indicate a safe environment, but it may also indicate that staff are unsure what to report or believe nothing will happen. Look at reporting quality, response times, exercise findings, training performance, recurring weaknesses and the time taken to close them. These indicators provide a more honest view of readiness.

Mildot Group’s approach is grounded in a straightforward principle: security theory only matters when it improves action. Plans should make the organisation more able to recognise risk, decide well and recover with control.

The most useful question to ask of any security plan is not whether it is complete. Ask whether the people named in it could use it confidently at 2 am, with incomplete information and real consequences. Their answer will tell you far more about preparedness than the document itself.