What to look for in security management software

Security management software mostly grew out of workforce scheduling, which is why so much of it treats compliance as an add-on. For a contractor, that is the wrong way round: a roster that is easy to build but places an unlicensed officer is worse than no roster at all.

Questions worth asking in a demo

• –Can I see licence status on the roster screen, or do I have to leave it?
• –What happens if I try to assign an officer whose licence has expired?
• –Where do screening documents live, and can I produce a complete file for one officer?
• –Can I see who was actually on site last Tuesday, including subcontracted officers?
• –Does the client report come from the same records, or is it assembled separately?

The second question is the most revealing. A system that lets the assignment happen silently is a record-keeping tool; a system that flags it is a compliance tool.

Things that sound important and usually are not

• –Module counts — what matters is whether the modules share one record
• –Mobile apps with long feature lists, if officers only ever book on and log incidents
• –Configurability that requires a consultant to use

Things that sound minor and are not

• –How easily you can export everything, on the day you decide to leave
• –Whether permissions are granular enough to keep vetting files need-to-know
• –Whether an alert reaches the person making the decision, or a shared inbox

On price, see how much security management software costs.

Test it against the Friday night problem

The moment that matters in this sector is short-notice cover. Ask a vendor to demonstrate it: an officer calls in at six, the post needs covering, and the person making the decision needs to see who is available, who holds the right licence, who has the site training, and who is within their hours. If that takes several screens or cannot be answered at all, the system does not fit the actual job.

The second test is licence expiry. Ask to see what happens the day before, the day of, and the day after an expiry — who is told, what escalates, and whether an officer whose licence has lapsed can still be rostered.

Whether it can stop you making a mistake

The distinguishing capability in this domain is prevention rather than recording. A system that records that an unlicensed officer was rostered is documenting a problem; one that prevents the assignment, or warns at the point of decision, is doing the job. Worth establishing which of those a product actually does.

Common mistakes

• –Evaluating record-keeping without testing the short-notice cover decision
• –No warning at the point an unlicensed or untrained officer is assigned
• –Notifications to a shared inbox with no named owner
• –Not testing what the system does around an actual expiry date
• –Assessing the feature list rather than the decisions the team makes daily
• –Deciding without involving the person who builds the rota

What separates a good fit from a good demo

A system that fits is one where the awkward parts of your operation are representable: subcontracted cover, officers working across multiple clients, sites with unusual licensing or training requirements, and the short-notice decisions that get made outside office hours. A good demo shows none of those, because demonstrations are built from tidy examples.

The most useful thing to ask for is a trial with your own data on your most difficult contract. Vendors who resist that are usually telling you something worth hearing.

One practical test: make it refuse an assignment

In any demonstration, try to roster an officer whose licence expires part-way through the shift. Watch what the system does.

Recording that it happened is documentation. Warning the person at the moment they assign it is prevention, and in this sector that difference is the entire value of the product. Most demonstrations never show it because demonstration data has nothing wrong with it.

• –Test validation at the point of assignment, not reporting afterwards
• –Try to create the problem rather than viewing a tidy dataset
• –Check post-level requirements can be held, not just officer attributes
• –Confirm an account's compliance position can be produced quickly
• –Involve whoever builds the rota in the decision

Worth adding: ask what it does not do

A vendor with a clear, specific answer to what their product does not cover generally understands their own boundaries. One who claims everything is covered has either not thought about it or is not telling you, and both are worth knowing before signing.

It is also the quickest way to find out whether the product is built for security specifically or is a general workforce tool with a security label on it.