Security Management and Asset Protection Training Course

Duration 5 days 10 modules · 33 contact hours
Level Intermediate Certificate on completion
Who attends Security Managers, Facilities Managers and others
Fee from USD 1,100 KSh 95,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 7 Nov 2026 Course code SD-SM-022

Before you join: Participants should have basic workplace experience in security, facilities, HSE, operations, business continuity, risk or site management.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Security failures can interrupt operations, expose staff and visitors to harm, enable theft or sabotage, and damage confidence with regulators, customers and insurers. Security managers need more than guards and cameras: they need a defensible process for identifying priority assets, assessing credible threats, selecting proportionate controls, directing incident response and proving that controls work. This course addresses the practical decisions behind an effective asset protection programme.

Participants learn to build a security management plan from risk appetite, asset criticality and business requirements. They assess threats, vulnerabilities and consequences; develop risk registers; design layered physical, technical and procedural controls; and specify requirements for guarding, access control, CCTV, alarms and visitor management. The course also covers security operations, incident command, evidence preservation, supplier assurance, privacy considerations, business continuity links and executive reporting.

Instructor-led delivery combines short technical briefings with sector-based cases, group analysis, site-security scenarios, incident simulations and structured planning. Participants work with examples drawn from corporate offices, industrial sites, logistics facilities, public buildings and critical services. The five-day programme runs from 08:30 to 16:30, providing about 6.5 contact hours each day, either in a classroom in 50+ cities or live online. Participants receive a certificate of completion and leave with a security management plan outline, asset protection risk register, control specification checklist and 90-day improvement plan.

The course suits professionals responsible for security, facilities, HSE, business continuity, operational risk or site management who must coordinate people, systems and procedures to protect valuable assets.

What you will be able to do

  • Conduct asset-threat-vulnerability assessments and document findings in a security risk register
  • Prioritise assets using criticality criteria, business impact analysis and dependency mapping
  • Design defence-in-depth control strategies for facilities, people, information and operations
  • Specify practical requirements for access control, CCTV, alarms, guarding and visitor management
  • Develop incident response playbooks using Incident Command System roles and escalation thresholds
  • Prepare security investment cases using residual risk, control costs and service impacts
  • Audit security controls through inspection plans, test evidence and corrective-action tracking
  • Create a 90-day security improvement plan aligned with priority risks and governance accountabilities

Benefits of attending

For you

  • Produce defensible security risk assessments for sites, assets and operations
  • Specify security controls with clearer requirements for suppliers and internal teams
  • Lead incident escalation using defined command roles and evidence procedures
  • Present security investment priorities in business and risk terms
  • Build a practical improvement plan for an assigned security responsibility

For your organisation

  • More consistent prioritisation of protection spending against critical assets
  • Clearer control requirements for guards, access systems, CCTV and alarm services
  • Faster, better-documented responses to security incidents and disruptions
  • Improved audit evidence for security controls, suppliers and corrective actions
  • Stronger links between security, business continuity, facilities and operational risk teams

Course modules

10 modules over 5 days

Participants can define security governance, responsibilities and performance measures aligned with organisational risk appetite.

  • Security governance aligned with board risk appetite and operating objectives
  • Define protection objectives for people, information, facilities, and critical operations
  • Map accountabilities using RACI charts, escalation thresholds, and decision rights
  • Apply ISO 31000 principles to security management responsibilities
  • Set policy hierarchies: policy, standards, procedures, post orders, and protocols
  • Measure programme performance through leading indicators, lagging indicators, and assurance

Participants can assess security risks and select proportionate treatment actions using documented criteria.

  • Conduct asset-threat-vulnerability-consequence assessments using an all-hazards risk register
  • Distinguish threat likelihood, vulnerability exposure, consequence severity, and residual risk
  • Build risk scenarios using source, event, impact, controls, and assumptions
  • Score risks with calibrated likelihood-impact matrices and documented criteria
  • Select treatment options: avoid, reduce, transfer, accept, or share risks
  • Maintain a security risk register with owners, dates, and actions

Participants can identify critical assets and prioritise protection resources using business impact criteria.

  • Inventory tangible and intangible assets using ownership, location, value, and dependencies
  • Rank critical assets through business impact analysis and maximum tolerable downtime
  • Identify single points of failure in utilities, access, data, and suppliers
  • Classify assets by confidentiality, integrity, availability, safety, and replacement time
  • Map interdependencies between sites, processes, personnel, systems, and third parties
  • Prioritise protection investments using criticality scores and consequence profiles

Participants can design layered security controls that address defined threats and operational constraints.

  • Design defence-in-depth using deterrence, detection, delay, response, and recovery
  • Layer physical, technical, procedural, and personnel controls against defined threats
  • Match controls to risk treatment objectives, operational constraints, and legal duties
  • Develop control specifications for CCTV, access control, alarms, and lighting
  • Apply CPTED principles to site layout, visibility, access, and territorial reinforcement
  • Balance security effectiveness, privacy, usability, maintainability, and lifecycle cost

Participants can assess site protection measures and document practical security-system requirements.

  • Conduct site surveys using perimeter-to-core protection and adversary-path analysis
  • Assess fences, gates, doors, glazing, locks, and protective barriers
  • Specify access zones, credential types, visitor controls, and key management
  • Position CCTV using detection, recognition, identification, and observation criteria
  • Plan alarm monitoring, response times, duress arrangements, and maintenance testing
  • Document security design requirements through drawings, schedules, and acceptance tests

Participants can establish security operating procedures for personnel, visitors, contractors and routine incidents.

  • Establish guard-force post orders, patrol patterns, and supervisor inspections
  • Set contractor and visitor screening, induction, escort, and badge controls
  • Use suspicious-behaviour indicators while avoiding discriminatory profiling and bias
  • Manage keys, cards, credentials, radios, body cameras, and issue records
  • Write incident reports using factual chronology, observations, actions, and evidence
  • Build shift handover protocols for open incidents, vulnerabilities, and priorities

Participants can coordinate security incidents from initial escalation through review and corrective action.

  • Classify incidents by severity, urgency, escalation route, and notification threshold
  • Apply Incident Command System roles: commander, operations, planning, logistics, and liaison
  • Create response playbooks for intrusion, theft, violence, bomb threats, and protest
  • Preserve evidence through scene control, chain of custody, and contemporaneous notes
  • Coordinate police, emergency services, insurers, legal counsel, and senior leaders
  • Conduct after-action reviews using timeline analysis, root causes, and corrective actions

Participants can manage security-system information, supplier risks and physical-cyber dependencies.

  • Identify convergence points between physical security, cybersecurity, and business continuity
  • Protect security systems from credential compromise, network intrusion, and data loss
  • Set privacy controls for CCTV images, access logs, and visitor records
  • Apply least-privilege access principles to security-system administration and remote support
  • Assess supplier security arrangements through contracts, service levels, and audit rights
  • Coordinate incident communications without compromising investigations, privacy, or operational security

Participants can measure security performance, audit controls and prepare risk-based investment proposals.

  • Build security budgets from asset criticality, control costs, and risk reduction
  • Prepare business cases using cost-benefit analysis, residual risk, and service impacts
  • Define service-level agreements for guarding, monitoring, maintenance, and response
  • Audit controls using inspection plans, test records, findings, and corrective actions
  • Track KPIs for incidents, response times, false alarms, losses, and compliance
  • Report security performance to executives using concise risk-based dashboards

Participants can integrate security priorities with continuity arrangements and create an improvement plan.

  • Integrate security arrangements with ISO 22301 continuity strategies and recovery priorities
  • Plan protective measures during relocation, civil unrest, travel, and site closure
  • Test plans through tabletop scenarios, communications drills, and response simulations
  • Convert lessons identified into corrective actions, owners, deadlines, and verification
  • Create a 90-day security improvement plan from assessed priority risks
  • Present protection priorities, investment rationale, and governance actions to sponsors

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. Security management plan template
  2. Asset protection risk register
  3. Asset criticality and dependency model
  4. Layered security control specification checklist
  5. Incident response playbook template
  6. 90-day security improvement plan

Who should attend

  • Security Managers — responsible for designing and directing site or enterprise security arrangements
  • Facilities Managers — accountable for protecting buildings, occupants, contractors and critical infrastructure
  • HSE Managers — coordinating security risks that affect workforce safety and emergency preparedness
  • Business Continuity Managers — linking protective controls with disruption response and recovery priorities
  • Operational Risk Managers — requiring defensible security risk treatment and assurance evidence
  • Site and Operations Managers — managing local security controls, incidents and service providers

Skills and tools covered

Security risk assessmentAsset criticality analysisPhysical security designIncident command coordinationSecurity assurance auditingProtection investment planning

Tools and standards

ISO 31000, ISO 22301, Crime Prevention Through Environmental Design (CPTED), Incident Command System (ICS)

How the course runs

Training methodology

The course uses short instructor briefings to introduce methods, standards and control design principles. Participants analyse realistic cases involving theft, unauthorised access, violence, protest, contractor failures and security-system outages. Group work applies risk registers, asset criticality scoring, control selection and incident command arrangements. Simulations test escalation, communications, scene control and post-incident review. Each participant develops an application plan that translates course methods into actions for their own site, function or security programme.

Requirements and prerequisites

Participants should have basic workplace experience in security, facilities, HSE, operations, business continuity, risk or site management. They should understand how their organisation is structured, what assets or services are important, and the broad security concerns affecting their location or function. Familiarity with incident reporting, contractor management or emergency procedures is useful but not essential. This is an intermediate course, so it does not teach entry-level guarding skills or technical installation of CCTV and alarm equipment. No prior certification, engineering qualification, legal qualification or specialist cybersecurity background is required.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

Participants should have workplace exposure to security, facilities, HSE, operations, risk or continuity responsibilities. No prior security certification or technical systems-installation experience is required.

Bring a laptop if possible, plus non-sensitive examples of current security concerns, asset lists, incident types or site arrangements. Course templates are provided, and participants should not bring confidential plans, personal data or restricted security documents.

It is suited to managers and specialists responsible for protecting facilities, people, information, operations or high-value assets. It also suits staff who supervise security providers or coordinate incident and continuity arrangements.

This course focuses on managing an asset protection programme, rather than teaching front-line guarding techniques or technical cyber defence. It connects physical controls, security operations, risk assessment, supplier management and incident coordination.

Participants can use the risk register, asset criticality model and control checklist to review a site or business function. The final improvement plan provides actions, owners and priorities for discussion with managers and security providers.

The programme runs from 08:30 to 16:30 each day, with about 6.5 contact hours daily. Time is divided between instruction, case analysis, group work, simulations and preparation of work-based planning materials.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.

Ask on WhatsApp info@skillsetdevelopment.com

Related courses in Security Management