Security Policies and Procedures Training Course

Duration 10 days 21 modules · 65 contact hours
Level Intermediate Certificate on completion
Who attends Security Managers, Security Supervisors and others
Fee from USD 2,200 KSh 190,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 16 Nov 2026 Course code SD-SM-046

Before you join: Participants should have basic familiarity with workplace security operations, such as access control, guarding, incident reporting, facilities management, risk, compliance or business continuity.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Security policies and procedures turn security intent into repeatable action at sites, offices, warehouses, hospitals, branches and field operations. Without clear rules, defined authorities and tested response procedures, personnel make inconsistent decisions, incident evidence is incomplete, contractors work to different expectations, and management cannot demonstrate due diligence. The challenge is to produce policies that are credible at executive level and procedures that work at 02:00 during a real disruption.

This course develops the practical capability to design, implement, review and govern a security policy framework. Participants assess threats and vulnerabilities, define risk appetite, write enforceable policy statements, map procedures to operational risks, assign roles through RACI, establish access-control and visitor-management rules, and create incident reporting and investigation processes. The course also addresses business continuity, emergency response, contractor security, information handling, training, assurance and policy review.

Teaching combines focused briefings with realistic case work from corporate offices, financial institutions, industrial sites, healthcare facilities and humanitarian operations. Participants analyse security failures, draft policy and procedure clauses, conduct risk assessments, test response arrangements through simulations, and receive structured peer and instructor review. Each participant builds a security policy and procedures pack for a selected workplace, including governance arrangements, risk controls, operational procedures, records and assurance measures.

The course suits security practitioners who already work with protective measures and need to formalise, improve or standardise their organisation's security documentation. It is also relevant to managers accountable for sites, facilities, resilience, risk, compliance or contracted security services.

What you will be able to do

  • Conduct a documented security risk assessment using ISO 31000 principles
  • Draft a security policy hierarchy with clear scope, authority and review controls
  • Translate identified risks into practical site security procedures and work instructions
  • Assign security responsibilities using a RACI matrix and escalation model
  • Design access-control, visitor-management and key-control procedures for operational sites
  • Develop incident reporting, investigation and corrective-action documentation
  • Test emergency and business continuity procedures through scenario-based simulations
  • Present a complete security policy and procedures pack for management approval

Benefits of attending

For you

  • Produce security documentation suitable for management review and operational use
  • Make defensible risk-based decisions on protective measures and security priorities
  • Lead more consistent incident responses using defined roles and escalation thresholds
  • Improve credibility when briefing executives, auditors, site teams and security providers
  • Build evidence of competence in security governance and procedure development

For your organisation

  • Creates consistent security expectations across sites, shifts and contracted providers
  • Reduces control failures caused by unclear responsibilities and undocumented processes
  • Improves incident evidence, corrective-action tracking and management reporting
  • Supports audit readiness through controlled policies, records and review cycles
  • Strengthens preparedness for access breaches, threats, emergencies and disruptions

Course modules

21 modules over 10 days

Participants can structure a security management system and policy document hierarchy.

  • Security policy, standard, procedure and work instruction distinctions
  • Policy hierarchy aligned with governance, risk and operational control
  • Scope statements defining people, assets, locations and activities
  • Management commitment, accountability and delegated security authority requirements
  • Document-control rules for ownership, approval, publication and revision
  • Policy language that states mandatory controls without operational ambiguity

Participants can define the operating context and security interests requiring protection.

  • Asset registers covering people, information, property, operations and reputation
  • Stakeholder mapping for executives, employees, visitors, communities and authorities
  • Criticality criteria based on harm, disruption, legal duty and value
  • Site profiles documenting boundaries, occupancy, operating hours and dependencies
  • Security assumptions recorded before selecting controls and procedures
  • Interdependencies between physical security, safety, resilience and information protection

Participants can assess security threats, vulnerabilities and consequences using a documented method.

  • ISO 31000 principles applied to security risk assessment
  • Threat identification using intelligence, incident data and local context
  • Vulnerability assessment of people, processes, technology and physical barriers
  • Likelihood and consequence scales calibrated for security decision-making
  • Risk registers linking scenarios, controls, owners and treatment actions
  • Inherent and residual risk ratings documented with control assumptions

Participants can select proportionate security controls within defined risk tolerances.

  • Risk appetite statements translated into security control thresholds
  • ALARP reasoning for proportionate treatment of security risks
  • Control categories: deterrence, detection, delay, response and recovery
  • Cost, practicality, legal duty and acceptance criteria compared
  • Treatment plans assigning actions, resources, deadlines and accountable owners
  • Residual risk acceptance documented at the correct authority level

Participants can establish roles, reporting lines and decision rights for security management.

  • RACI matrices for policy ownership, implementation and assurance activities
  • Security committee terms of reference and reporting cadence
  • Escalation thresholds for incidents, emerging threats and control failures
  • Duty-holder responsibilities for managers, employees, guards and contractors
  • Segregation of duties in key, access and investigation processes
  • Executive reporting dashboards for risk, incidents, actions and assurance

Participants can draft clear, enforceable security policies for management approval.

  • Policy purpose statements linked to identified security objectives
  • Mandatory clauses using clear actors, actions and compliance requirements
  • Definitions resolving ambiguity around restricted areas and authorised persons
  • Exceptions process with documented justification, approval and expiry dates
  • Legal, regulatory and contractual obligations incorporated into policy requirements
  • Policy review triggers following incidents, changes and audit findings

Participants can convert policy requirements into usable operational procedures.

  • Procedure flowcharts showing triggers, decisions, actions and records
  • Step-by-step instructions matched to frontline roles and competencies
  • Decision trees for routine exceptions and urgent security events
  • Required forms, logs and evidence specified within each procedure
  • Handover points controlled between departments, shifts and suppliers
  • Acceptance criteria defining correct completion of security tasks

Participants can specify layered physical security procedures for a site.

  • Defence-in-depth model applied to perimeter, building and internal zones
  • CPTED principles addressing natural surveillance, access and territorial reinforcement
  • Perimeter inspection procedures for fences, gates, lighting and signage
  • Security zoning classifications for public, controlled, restricted and critical areas
  • Patrol procedures defining routes, frequencies, observations and reporting
  • Alarm response instructions linked to verification and escalation decisions

Participants can develop controlled access, visitor and key-management procedures.

  • Access authorisation workflows for employees, contractors and temporary workers
  • Identity verification requirements before issuing access credentials
  • Visitor pre-registration, screening, escorting and departure-record procedures
  • Tailgating prevention controls at doors, turnstiles and reception points
  • Key-control registers recording issue, return, duplication and loss
  • Access-right reviews following role changes, suspension and termination

Participants can establish personnel and contractor security controls appropriate to risk.

  • Pre-employment screening criteria aligned with role sensitivity and law
  • Security induction content for employees, agency staff and contractors
  • Confidentiality, conduct and reporting obligations stated in security procedures
  • Contractor security plans covering access, supervision and restricted work
  • Vendor due diligence for guarding, monitoring and alarm-response providers
  • Performance measures for contracted security service-level agreements

Participants can control security records and define procedures for security technology.

  • Security records classification, retention, access and disposal requirements
  • CCTV operating procedures covering purpose, monitoring and evidence handling
  • Alarm-system testing, fault reporting and maintenance-record requirements
  • Access-control system administration with approval and audit trails
  • Chain-of-custody records for footage, devices and physical evidence
  • Data-protection considerations in surveillance and visitor-record procedures

Participants can create incident reporting and first-response procedures for security events.

  • Incident categories defining theft, intrusion, violence, threats and loss
  • Immediate actions prioritising life safety, scene protection and notification
  • Incident report forms capturing facts, witnesses, actions and evidence
  • Notification matrices identifying internal leaders, responders and external authorities
  • Escalation criteria based on severity, exposure, disruption and legal duty
  • Communication controls preventing speculation, disclosure and unauthorised statements

Participants can manage proportionate investigations and track corrective actions to closure.

  • Investigation plans setting scope, roles, evidence sources and timelines
  • PEACE interviewing framework for structured fact-finding conversations
  • Evidence preservation methods for documents, footage, access logs and devices
  • Root cause analysis using five whys and cause-and-effect diagrams
  • Corrective-action registers assigning owners, deadlines and verification methods
  • Investigation reports separating facts, analysis, findings and recommendations

Participants can define preventive and response procedures for threats to personnel.

  • Workplace violence risk indicators recognised and reported early
  • Threat assessment triage based on intent, capability and opportunity
  • Lone-worker procedures covering check-ins, alarms and missed-contact escalation
  • Duress alarm protocols for reception, cash handling and remote staff
  • Travel security procedures addressing route planning, communications and contingencies
  • Post-incident welfare, reporting and return-to-work support arrangements

Participants can align security procedures with emergency response and crisis communications.

  • Emergency response plans for fire, intrusion, violence and suspicious items
  • Command structures using gold, silver and bronze response roles
  • Evacuation, lockdown and shelter procedures matched to threat scenarios
  • Emergency contact lists maintained through defined verification cycles
  • Crisis communication templates for staff, families, clients and media
  • Post-event debriefs capturing decisions, gaps and improvement actions

Participants can connect security procedures to continuity and recovery requirements.

  • ISO 22301 concepts applied to security-related business disruption
  • Business impact analysis identifying critical activities and recovery priorities
  • Security dependencies mapped for premises, personnel, suppliers and technology
  • Alternate-site security procedures for relocation and emergency operations
  • Continuity strategies for access failure, site loss and civil disturbance
  • Recovery checklists restoring security controls before normal operations resume

Participants can plan role-based security training and measure behavioural compliance.

  • Training-needs analysis linked to roles, risks and procedural responsibilities
  • Security induction modules covering reporting, access and prohibited conduct
  • Role-specific briefings for reception, guards, managers and incident responders
  • Awareness campaigns addressing tailgating, suspicious activity and information handling
  • Competence records documenting attendance, assessment and refresher requirements
  • Behavioural indicators used to evaluate security culture and reporting confidence

Participants can audit security procedures and report control performance to management.

  • Internal audit plans based on risk, change and previous findings
  • Audit checklists testing policy compliance, records and operational behaviours
  • Sampling methods for access logs, patrol records and incident files
  • Key performance indicators measuring incidents, response and corrective-action closure
  • Key risk indicators identifying deteriorating controls and emerging exposures
  • Management review packs presenting trends, findings, decisions and resources

Participants can incorporate legal, ethical and human rights considerations into security procedures.

  • Lawful authority boundaries for searches, restraint, surveillance and detention
  • Human rights principles applied to screening, monitoring and access restrictions
  • Use-of-force policies requiring necessity, proportionality and reporting
  • Privacy requirements for personal data, CCTV and access records
  • Non-discrimination safeguards in visitor screening and personnel procedures
  • Ethical reporting channels for misconduct, abuse and conflicts of interest

Participants can plan controlled implementation of revised security policies and procedures.

  • Gap analysis comparing current documents against required security controls
  • Implementation roadmaps sequencing approvals, communications, training and deployment
  • Change-control requests documenting rationale, impacts and authorisation
  • Pilot testing procedures before full site or business-unit rollout
  • Resistance analysis identifying operational concerns and adoption barriers
  • Review schedules ensuring documents remain current after organisational changes

Participants can build, review and present a complete security policy and procedures pack for a selected workplace.

  • Risk register integrating threats, vulnerabilities, controls and residual ratings
  • Security policy drafted with scope, authority, requirements and review cycle
  • Priority procedures covering access, incidents, visitors and emergency response
  • RACI matrix assigning ownership, approval, implementation and assurance duties
  • Assurance plan combining audits, indicators, records and management review
  • Management presentation defending control choices, resources and implementation priorities

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. Security policy hierarchy template
  2. Security risk register and treatment plan
  3. RACI matrix and escalation model
  4. Access control and visitor management procedure templates
  5. Incident reporting and investigation toolkit
  6. Security policy and procedures pack

Who should attend

  • Security Managers — responsible for formalising site and corporate security arrangements
  • Security Supervisors — translating policy requirements into consistent frontline procedures
  • Facilities Managers — managing access, visitors, contractors and physical site controls
  • Risk and Compliance Officers — assessing security controls and evidencing due diligence
  • Business Continuity Managers — aligning protective measures with emergency and recovery plans
  • Contract Managers — specifying, monitoring and improving outsourced security services

Skills and tools covered

Security risk assessmentPolicy draftingProcedure designIncident managementSecurity governanceAssurance auditing

Tools and standards

ISO 31000, ISO 22301, ISO 18788, CPTED

How the course runs

Training methodology

The instructor uses short technical briefings, facilitated discussions, security incident cases and document-review sessions. Participants work individually and in groups to assess threats, draft policy clauses, map procedures, test escalation decisions and evaluate control effectiveness. Simulations address access breaches, suspicious activity, staff threats and emergency communications. Throughout the course, participants apply each method to a selected workplace or case organisation, building a policy and procedures pack that receives instructor and peer feedback.

Requirements and prerequisites

Participants should have basic familiarity with workplace security operations, such as access control, guarding, incident reporting, facilities management, risk, compliance or business continuity. Experience supervising personnel, managing a site, reviewing procedures or working with security providers is useful. Participants should be comfortable reading organisational policies and discussing operational risks. Prior formal security qualifications, law-enforcement experience, military service, specialist cyber security knowledge or previous policy-writing training are not required. The course focuses on physical security management and its connection with organisational governance.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

Participants should understand basic workplace security, facilities, risk or compliance activities. No previous formal security qualification or policy-writing course is required.

Bring any non-sensitive examples of existing policies, incident forms, site rules or audit findings that can inform application work. Participants should not bring confidential incident evidence, personal data or restricted security plans.

It is designed for security managers, supervisors, facilities managers, risk and compliance personnel, continuity practitioners and contract managers. It is particularly useful for people responsible for improving inconsistent or outdated security documentation.

Physical security courses concentrate on protective measures such as barriers, locks, surveillance and guarding. This course focuses on converting risk and control requirements into approved policies, usable procedures, records, accountabilities and assurance arrangements.

Participants build a policy and procedures pack around a selected workplace or case organisation. The templates can be adapted for sites, branches, offices, facilities, warehouses or field locations after internal legal and management review.

Each day runs from 08:30 to 16:30 and provides about 6.5 contact hours. The first week establishes risk, governance and core procedure design; the second week addresses incidents, resilience, assurance, implementation and the final capstone presentation.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.

Ask on WhatsApp info@skillsetdevelopment.com

More courses in Security Management

Security Management Advanced Enterprise Security Management Training Course 10 days · from USD 2,200 · next 16 Nov Security Management Asset Protection and Security Management Training Course 5 days · from USD 1,100 · next 16 Nov Security Management Critical National Infrastructure Protection Training Course 5 days · from USD 1,100 · next 16 Nov Security Management Security Leadership Training Course 5 days · from USD 1,100 · next 16 Nov Security Management Security Management and Asset Protection Training Course 5 days · from USD 1,100 · next 16 Nov Security Management Security Management for Oil and Gas Facilities Training Course 5 days · from USD 1,100 · next 16 Nov Security Management Security Operations Supervision Training Course 10 days · from USD 2,200 · next 16 Nov Security Management Security Surveys and Risk Assessments Training Course 10 days · from USD 2,200 · next 16 Nov