Sicherheitsfachmann/-frau FA common mistakes
Sicherheitsfachmann/-frau FA · Understand the traps and how to avoid them.
Candidates answer legal questions from gut feeling or from what 'seems reasonable' instead of naming the specific statute, and they confuse the hierarchy of law (e.g., treating a DIN standard as legally binding like a statute, or treating a cantonal regulation as overriding federal law).
Most candidates come from operational security work where practical solutions matter more than legal citation, so they never internalised the difference between mandatory law, delegated ordinance, and voluntary norm; the hierarchy of norms is abstract and rarely rehearsed.
What to do instead
Build a one-page norm pyramid (federal law → ordinance → cantonal → communal → standards/guidelines) and for every legal topic in the syllabus write the exact statute/ordinance article next to it. Practise answering each legal question in two sentences: first the legal basis by name, then the application.
Candidates perform a risk analysis that jumps straight to measures, listing threats and controls without ever quantifying likelihood and impact or documenting the assessment method, so the result is a measure catalogue rather than a defensible risk assessment.
Operational experience makes measures feel obvious, and quantification feels academic; candidates also fear that numbers can be 'wrong' and hide behind qualitative wording.
What to do instead
Always use an explicit, named method (e.g., a defined 5x5 matrix with written band definitions) and produce the full chain: asset → threat → vulnerability → likelihood × impact = risk → prioritised measure with residual risk. Rehearse producing the matrix and the residual-risk statement before writing any measure.
Candidates describe security measures as a flat wish list (cameras, guards, fences) without deriving them from the protection goals and without stating what the measure achieves, who owns it, and how its effectiveness will be verified.
The concept domain rewards structured reasoning, but candidates default to product thinking and to copying measures they have seen in their own workplace.
What to do instead
Structure every concept answer around protection goals (confidentiality, integrity, availability, plus safety goals) and a measure table with columns: goal addressed, layer (organisational/personnel/technical/infrastructural), owner, cost, effectiveness check. Never list a measure without naming the goal it serves.
Candidates mix up the roles and legal powers in the private security service - confusing house rules and self-help rights with police powers, or claiming powers of arrest, search, or data collection that a private security officer does not have.
Day-to-day work blurs the line because private staff often act alongside police, and candidates over-generalise from situations where police were present.
What to do instead
Write out a comparison table: private security vs. police for each action (identity check, search, detention, use of force, data processing), citing the legal basis for the private side (house rules, self-defence, necessity, provisional arrest limits). Test yourself by asking for each action: 'on what legal basis, and how far does it go?'
Candidates plan event or personal security without a documented safety/security concept that covers visitor flows, capacity limits, escape routes, and the interface with authorities and emergency services, treating the task as purely a staffing exercise.
Event work is experienced as manpower planning under time pressure; the concept document and authority coordination are seen as paperwork rather than the core deliverable.
What to do instead
Practise drafting a compact event security concept template (risk assessment, visitor and vehicle flows, capacity and evacuation calculation, command structure, communication plan, interfaces to police/fire/rescue, briefing and debrief). Fill the template for two or three different event types until the structure is automatic.
Candidates answer information security and data protection questions by listing technical controls (firewalls, encryption, backups) while ignoring the legal basis for processing, the purpose limitation, and the rights of data subjects.
IT security and data protection are mentally merged into 'make it secure', and candidates without a privacy background treat the legal data-protection layer as someone else's job.
What to do instead
For every data-processing scenario, run a fixed checklist: purpose, legal basis, data minimisation, retention, access, data subject rights, and security measures. Answer in two parts - 'is this processing lawful?' first, then 'is it secure?' - and never let technical measures substitute for the legal basis.
Candidates treat business continuity and crisis management as a single plan document and forget the recurring cycle: business impact analysis, recovery objectives, exercising, and updating; they also fail to distinguish incident, emergency, crisis, and continuity levels.
Plans are written once in real organisations and rarely exercised, so candidates have no lived model of the maintenance cycle or of escalation levels.
What to do instead
Learn the four-level escalation ladder (incident → emergency → crisis → continuity) with a trigger criterion for each, and be able to state what a business impact analysis produces (critical processes, RTO/RPO, dependencies). Always close a continuity answer with exercise, review, and update.
Candidates answer leadership and communication questions with generic phrases ('communicate openly', 'lead by example') instead of naming a concrete leadership style, a communication model, or a defined approach to a conflict or authority situation.
Soft-skill questions feel like they cannot be wrong, so candidates stop at platitudes and do not connect them to the situational context of security work.
What to do instead
Prepare a small set of named tools (e.g., situational leadership, a sender-message-receiver model with feedback, a defined conflict-escalation procedure, a briefing structure) and force every answer to name the tool, apply it to the scenario, and state the expected effect. Generic sentences must be replaced by a named concept plus a concrete action.
Candidates justify security measures purely on the basis of risk reduction and cannot express cost, benefit, or effectiveness in economic terms, nor distinguish one-off investment from recurring operating cost.
Security staff are trained to think in threats, not budgets, and cost-benefit language feels like it belongs to management rather than to the security function.
What to do instead
For each measure, practise stating investment cost, annual operating cost, expected loss reduction, and a simple comparison (e.g., payback or cost per avoided incident), plus the non-monetisable benefit. Learn to frame security as a business enabler with a defensible cost-benefit statement.
Candidates describe quality management as 'we have a handbook' and cannot name the improvement cycle, the difference between audit, review, and inspection, or how corrective actions are tracked to closure.
Quality management is perceived as documentation work rather than a management system, and candidates have usually seen only the binder, not the cycle behind it.
What to do instead
Learn the plan-do-check-act cycle applied to security processes, and for each quality instrument (audit, management review, key performance indicator, corrective action) be able to state purpose, owner, and output. Practise writing a short corrective-action record from finding to verified closure.