IFPO CSS cheat sheet

Protection is built on three pillars: physical security, procedural security, and protective intelligence; a gap in any one pillar degrades the whole protective posture.

The protective detail's core mission is to prevent harm to the principal, not to react to it; reaction is the fallback when prevention fails.

Protective intelligence cycle: direction, collection, processing, analysis, dissemination, and feedback; each stage produces a product the next stage consumes.

Advance work covers route reconnaissance, venue survey, medical facility identification, and evacuation rally points, documented before the principal arrives.

Threat assessment distinguishes capability, intent, and opportunity; removing any one element reduces risk even when the others persist.

Layered defense principle: outer perimeter (access control), inner perimeter (screening), and close protection (body cover) each assume the previous layer failed.

Principal profile factors include public exposure, wealth, controversy, prior threats, and residence accessibility; higher exposure raises baseline risk.

Protective formations: diamond, box, and wedge; the formation selected depends on crowd density, corridor width, and evacuation speed required.

Access control triad: identify, authenticate, authorize; a control that skips authentication is identification only and is not access control.

Post orders define duties, authority limits, reporting lines, and emergency actions for a specific post; they supersede general training when they conflict.

The security log is a contemporaneous record; entries use date, time, location, persons involved, action taken, and signature, and are never altered after the fact.

Patrol patterns: fixed, random, and mixed; random timing defeats observation of pattern by an adversary, mixed balances deterrence and coverage.

Alarm response sequence: verify, assess, dispatch, contain, report; verification before dispatch reduces false-alarm cost but must not delay life-safety response.

Key control requires a signed key register, serialized keys, periodic inventory, and immediate rekeying on loss or unaccounted turnover.

CCTV retention is set by policy and legal requirement; footage must be exported with a hash or audit trail to preserve evidentiary value.

Handover briefing transfers responsibility for the post; it covers incidents in progress, outstanding tasks, equipment status, and pending visitors.

Span of control: a supervisor can effectively oversee roughly 6 to 10 subordinates depending on task complexity and geographic dispersion.

Risk treatment options are avoid, reduce, transfer, and accept; each residual risk is documented with an owner and review date.

Post orders and training records are the two documents most often requested after an incident; supervisors own both.

Performance management cycle: set standards, observe, document, feedback, and follow up; undocumented feedback cannot support discipline.

Incident command uses unity of command; a supervisor must not issue orders to personnel already tasked by the incident commander.

Staffing calculation: posts required multiplied by hours per post, divided by available hours per officer after leave and training, yields headcount.

Delegation transfers task authority but not accountability; the supervisor remains answerable for the outcome.

Audit and inspection differ: an audit tests compliance against a standard, an inspection observes current condition at a point in time.

Citizen's arrest authority is narrow and varies by jurisdiction; security officers generally hold no more power than an ordinary citizen.

Use of force must be necessary, proportionate, and reasonable; force continues only while the threat persists and stops when it does.

Detention requires reasonable grounds and must be for a lawful purpose; a person detained must be told why and turned over to police promptly.

Search authority depends on consent, contract, or statute; employer consent covers workplace property but not a person's body without lawful basis.

Evidence chain of custody records every transfer: who had it, when, and why; a broken chain weakens admissibility.

Confidentiality duty: client, principal, and incident information is disclosed only on need-to-know or legal compulsion.

Ethical tests for a decision: legality, policy compliance, proportionality, transparency, and whether it would survive public scrutiny.

Report writing is a legal document; it states observed facts, not conclusions, and distinguishes what the officer saw from what was reported to them.

Life safety precedes property protection and scene preservation; evacuate and treat before securing evidence.

Evacuation decision rule: evacuate when the hazard is imminent and the route is safe; shelter in place when movement exposes occupants to greater risk.

Incident command system roles: incident commander, operations, planning, logistics, and finance/administration; the commander sets objectives.

Fire response: activate alarm, call emergency services, evacuate, and account for occupants at the assembly point; never re-enter without fire service clearance.

Bomb threat response: do not touch suspicious items, establish a cordon at a distance, and evacuate along routes away from the item.

First aid priorities follow airway, breathing, circulation; an officer trained only in basic first aid should not exceed certified scope.

Assembly point accountability uses a roster or visitor log; unaccounted persons are reported to the incident commander immediately.

Post-incident review captures timeline, decisions, and lessons; it feeds back into post orders, training, and risk assessment.