Close Protection Operations cheat sheet

Risk = Threat x Vulnerability x Impact; reducing any factor to zero drives composite risk toward zero.

Threat likelihood tiers: negligible, low, moderate, high, critical; each tier maps to a distinct protective posture, not to a single fixed response.

Principal threat sources are categorized as criminally motivated, ideologically motivated, state-sponsored, insider, and nuisance/incidental.

Vulnerability assessment inventories every access point, choke point, and predictable routine; each item is scored for exploitability and consequence.

Intelligence confidence is graded separately from threat severity: a low-confidence report of a severe plot still triggers interim mitigation.

Capability-intent matrix: a subject with intent but no capability ranks below one with capability and demonstrated hostile reconnaissance.

Residual risk is the risk remaining after mitigation; it must be formally accepted in writing by the client or principal.

Assessment cycle is continuous: re-score on every route change, venue change, schedule change, or new intelligence report.

Advance timeline anchors: reconnaissance 24-72 hours before, site sweep within 2 hours, final walk-through within 30 minutes of arrival.

Advance product set includes route card, venue diagram, medical plan, communications plan, contingency matrix, and principal itinerary.

Protective intelligence cycle: direction, collection, processing, analysis, dissemination, and feedback; each stage has an owner and a deadline.

Source grading uses a two-axis scheme: source reliability (A-F) and information credibility (1-6); only A1-B2 material drives hard decisions alone.

Liaison contacts are recorded for venue security, local police, medical facilities, and transport providers, each with name, number, and confirmation time.

Arrival and departure routes are planned as separate paths; identical entry and exit routes create a predictable ambush pattern.

Stand-off distances are mapped for each venue: reaction distance, containment distance, and evacuation distance from the principal's position.

Primary, alternate, and emergency routes (PACE) are each driven and timed before the movement, not merely mapped.

Route selection weighs threat density, traffic predictability, choke points, medical access, and escape options over shortest distance.

Choke points (bridges, tunnels, underpasses, toll plazas) are minimized; unavoidable ones are crossed at speed with the team on alert.

Time-on-route variance is measured against the planned schedule; deviations exceeding the margin trigger a route change.

Vehicle package composition: principal vehicle, follow vehicle, and optional lead or advance vehicle; each has a defined role and radio call sign.

Route card lists turn-by-turn instructions, call signs, hospital locations, and rally points, and is distributed to every driver before departure.

Rally points are pre-designated locations where the team reassembles if separated; each has a primary and an alternate.

Contingency triggers are pre-agreed conditions (accident, pursuit, blockage, medical) that authorize deviation without further approval.

Venue layers: outer perimeter, inner perimeter, controlled access zone, and principal's protected zone; each layer has a defined control point.

Access control requires positive identity verification plus credential check; possession of a badge alone is not verification.

Sweep sequence proceeds from the principal's position outward, then back inward along the arrival and departure paths.

Safe room criteria: single controlled entry, hardened door, independent communication, and a secondary egress where achievable.

Stand-off for explosive threat is estimated by package size and containment; unidentified items trigger evacuation, not inspection by the team.

Visitor and staff lists are reconciled against credentials; unlisted persons are held at the outer perimeter until resolved.

Camera and lighting coverage gaps are recorded on the venue diagram and covered by a posted team member or a patrol interval.

Bodyguard positions: point (front), principal's flanks, rear (follow), and rear guard; the principal sits between the two flank positions.

Diamond formation is used in open areas; the tighter box formation is used in crowds and confined spaces.

Hands-on contact with the principal is maintained in dense crowds; the principal is moved by steering, not by pulling or pushing.

Vehicle drill: the principal exits on the side away from the threat; the bodyguard opens the door and places the body between the door and the exposure.

Embuss/debuss is the highest-risk moment; the team secures a 360-degree cordon before the principal leaves the vehicle.

Break-and-cover: on contact, the nearest bodyguard physically covers the principal and moves to the nearest cover, not to the nearest exit.

Vehicle convoy spacing is 1-3 seconds in traffic and tightens in open road; the follow vehicle never loses visual on the principal vehicle.

Counter-ambush driving: reverse out of a blocked path rather than forward into an unknown, and drive off the line of fire before stopping.

Surveillance detection route (SDR) is a planned, seemingly normal route that creates opportunities to observe a follower without alerting them.

Detection indicators: repeated vehicle, matched pace, mirrored turns, occupants adjusting position, and vehicles that reappear after being dropped.

The three-times rule: a subject observed in three separate locations or time windows is treated as confirmed surveillance.

Counter-surveillance is passive observation, not confrontation; the team records descriptions and reports rather than engaging.

Surveillance detection is run before the principal joins the route, not with the principal aboard.

Recording format: vehicle make, model, color, plate, occupant count, and time-stamped location for each sighting.

If surveillance is confirmed, the response is to abort the planned destination and move to a secure location while notifying command.

Radio discipline: short, plain-language transmissions; no names, titles, or locations in clear text when codes are in use.

Prowords standardize traffic: Roger, Say again, Stand by, Break, and Emergency traffic takes priority over all other transmissions.

Primary and alternate communication channels exist for every operation; loss of primary for a set interval is itself a contingency trigger.

Command structure is a single designated team leader; the principal's instructions are filtered through the team leader, not given directly to operators.

Call signs are assigned per operation and rotated; the principal is referred to by a code name, never by name on air.

Duress and all-clear signals are pre-agreed, work without voice, and are tested before every operation.

Communication check-in intervals are scheduled; a missed check-in triggers a defined escalation sequence.

Incident priorities in order: principal's safety, team safety, containment of the threat, preservation of evidence, then reporting.

Immediate action drill on contact: cover the principal, move off the line of fire, establish a casualty collection point, and account for all team members.

Casualty care sequence follows the recognized major-hemorrhage-first protocol; tourniquets and pressure dressings are carried by every operator.

Medical evacuation plan names the nearest trauma facility, the route, and the estimated travel time, verified during the advance.

Post-incident sequence: secure the scene, render aid, notify command and police, preserve witness details, and separate the principal from media.

Accountability roll call is taken at the rally point; every team member and the principal are confirmed before movement resumes.

Evidence preservation includes not moving items unnecessarily and recording times, positions, and descriptions while memory is fresh.

Use of force is governed by necessity and proportionality; the response must be no greater than the threat reasonably perceived.

Self-defense authority is generally limited to imminent unlawful force; pre-emptive force against a perceived future threat is not lawful self-defense.

A close protection operator's legal status varies by jurisdiction: local law, licensing, and the client contract define the authority actually held.

Detention of a person is a use of force; a private operator generally holds only citizen's-arrest authority where local law provides it.

Duty of care runs to the principal, to bystanders, and to team members; foreseeable harm from team action must be avoided.

Confidentiality obligations cover the principal's schedule, medical details, and family information; disclosure requires authorization or legal compulsion.

Use-of-force reporting is written immediately after the incident, factual and time-stamped, and retained for legal review.

Mission briefing covers threat picture, route, venue, communications, contingencies, and individual assignments; it ends with confirmation of understanding.

Task organization assigns every operator a primary role and a backup role so no position is vacant after a casualty.

Client liaison sets expectations in writing: what the team will and will not do, response times, and the limits of authority.

The principal's preferences are accommodated where they do not create unacceptable risk; refusals are documented and escalated.

Team welfare factors: rest rotation, hydration, and shift length; fatigue degrades reaction time and decision quality.

After-action review is conducted within 24 hours while details are fresh, and findings feed the next risk assessment.

Discipline is maintained through clear standards and consistent enforcement; public criticism of a team member in front of the principal undermines command.