UPMSP High School Security cheat sheet

Confidentiality, Integrity, Availability (CIA triad): confidentiality limits disclosure to authorised persons; integrity keeps data accurate and unaltered; availability ensures timely access for legitimate users.

Defence in depth: layered controls (perimeter, building, room, asset) so that failure of one layer does not expose the asset; each layer should be independent of the others.

Least privilege: a person or process receives only the access needed for the assigned task, for only as long as needed.

Need to know: access to information is granted by relevance to duties, not by rank or seniority alone.

Risk = likelihood x impact. Risk treatment options are avoid, reduce (mitigate), transfer (insurance/contract) and accept; residual risk is what remains after controls.

Threat is a potential cause of harm; vulnerability is a weakness that a threat can exploit; exposure is the state of being open to loss.

Three lines of protection in guarding: deter (visible presence, lighting, signage), detect (patrols, alarms, CCTV), respond (intervention, escalation, evacuation).

Separation of duties: no single person should both authorise and execute a sensitive transaction such as issuing an access card and approving its level.

Security is a management function, not a police function: the guard's authority derives from the employer's policy and the law, not from personal power.

Perimeter layers: fence line, gatehouse, building envelope, controlled lobby, secure zone. Each transition point is a control point requiring identification and authorisation.

Access control decision sequence: identify (who are you) -> authenticate (prove it) -> authorise (are you permitted here now) -> record (log the event).

Something you know (PIN), something you have (card, key), something you are (biometric). Two different factors = two-factor authentication; two cards = not two-factor.

Tailgating (piggybacking) is unauthorised entry on another person's valid access; controls include turnstiles, mantraps, anti-passback and guard challenge.

Anti-passback prevents a card being used to enter twice without an intervening exit, blocking card sharing and pass-back at doors.

Key control: keys are signed out to named holders, logged, and returned on leaving; master keys are held under dual custody.

Visitor management: verify identity, issue a dated badge, record host and purpose, escort in secure areas, and log exit time.

CCTV placement follows purpose: identification (face capture at entry), recognition, detection or monitoring. Camera height, lighting and field of view determine evidential value.

Lock types: mortice lock, cylinder lock, padlock, electromagnetic lock (failsafe = unlocks on power loss), electric strike (failsecure = stays locked on power loss).

Standing orders are permanent instructions; post orders are site-specific duties for a given post; special orders are temporary instructions for a defined period or event.

Incident report content: date, time, location, persons involved, sequence of events, action taken, witnesses, evidence, signature and designation of the writer.

Reports record facts, not opinions: write 'door found open at 02:15' rather than 'guard was careless'. Quote speech directly and attribute it.

Logbook entries are made at the time of the event or immediately after, in ink, without erasure; corrections are struck through, initialled and dated.

Handover/takeover procedure: outgoing guard briefs the incoming guard on keys, equipment, incidents, pending tasks and special orders, and both sign the register.

Patrol types: fixed post, foot patrol, vehicle patrol, random patrol. Randomised timing defeats pattern observation by intruders.

Chain of custody: every transfer of evidence (time, from, to, purpose, signature) is documented so the item's integrity can be demonstrated.

Escalation path: guard -> supervisor -> duty manager -> police/emergency services. Each level is notified within the time stated in standing orders.

Fire triangle: fuel, oxygen, heat. Removing any one side extinguishes the fire; the tetrahedron adds the chemical chain reaction.

Fire classes: A solid combustibles, B flammable liquids, C gases, D metals, F cooking oils. Electrical fires are isolated by switching off power, then treated as the appropriate class.

Extinguisher selection: water (A), foam (A and B), CO2 (B and electrical), dry powder (A, B, C, electrical), wet chemical (F). Never water on live electrical equipment or on burning oil.

PASS technique for extinguishers: Pull the pin, Aim at the base of the fire, Squeeze the handle, Sweep side to side.

Evacuation priorities: alarm, evacuation of occupants, containment, then firefighting by trained persons only. Life safety precedes property protection.

Assembly point rules: proceed to the designated point, conduct a roll call against the visitor and staff list, and report missing persons to the fire service.

Never use lifts during a fire evacuation unless a designated evacuation lift is operated under fire service control.

RACE sequence: Remove/Rescue those in danger, Activate the alarm, Contain the fire (close doors), Evacuate or Extinguish if trained.

Fire doors must be self-closing and kept unobstructed; propping a fire door open defeats compartmentation.

Adult BLS sequence: check safety, check response, shout for help, open airway, check breathing and pulse for no more than 10 seconds, then start chest compressions.

Compression rate 100-120 per minute, depth 5-6 cm in an adult, full recoil, with a compression-to-ventilation ratio of 30:2 for one or two rescuers (adult).

AED use: power on, attach pads to bare dry chest, follow voice prompts, ensure nobody touches the casualty during analysis and delivery of the shock.

Recovery position: for an unresponsive casualty who is breathing normally; protects the airway and allows drainage of vomit.

Choking adult: encourage coughing; if ineffective give up to 5 back blows between the shoulder blades, then up to 5 abdominal thrusts, alternating.

Severe bleeding: apply direct pressure with a dressing, elevate if possible, and use a tourniquet only when direct pressure fails; record the time applied.

Burns: cool with running water for at least 20 minutes, remove jewellery and loose clothing before swelling, do not burst blisters, do not apply ice or grease.

Fracture immobilisation: support the limb in the position found, immobilise the joints above and below, check circulation beyond the injury.

DRABC: Danger, Response, Airway, Breathing, Circulation - the primary survey order.

Hierarchy of controls, most to least effective: elimination, substitution, engineering controls, administrative controls, personal protective equipment (PPE).

PPE is the last line of defence because it protects only the wearer and only if correctly fitted and used.

Hazard types: physical (noise, vibration, heat), chemical (solvents, dust), biological (pathogens), ergonomic (manual handling, repetitive strain), psychosocial (stress, violence).

Manual handling rule: assess the load, keep it close to the body, bend the knees not the back, avoid twisting while lifting, and use mechanical aids where available.

Confined space entry requires an entry permit, atmosphere testing (oxygen, flammable gas, toxic gas), a standby person at the entrance, and rescue arrangements.

Lockout/tagout (LOTO): isolate the energy source, lock and tag it, verify zero energy, and restore only after the work is complete and the area is clear.

Work at height: guardrails and harnesses with anchor points; three points of contact on ladders; ladders are for access, not as a work platform for prolonged tasks.

Noise action levels: hearing protection becomes necessary when exposure reaches the levels set in local regulations; hearing damage is cumulative and irreversible.

Slips, trips and falls are controlled by housekeeping, spill response, cable management, adequate lighting and non-slip flooring.

Communication model: sender -> encoding -> channel -> decoding -> receiver, with feedback and noise (physical or psychological interference) affecting fidelity.

Active listening: give full attention, avoid interrupting, paraphrase to confirm understanding, and reflect the speaker's feelings before responding.

Open questions ('what happened?') gather information; closed questions ('did you see the man?') confirm specific facts.

Non-verbal signals - posture, eye contact, tone, distance - carry meaning; aggressive posture escalates, calm open posture de-escalates.

De-escalation sequence: remain calm, lower voice volume, maintain safe distance, listen, acknowledge the concern, offer options, and call for support if the person remains violent.

Radio protocol: listen before transmitting, use call signs, keep messages brief, use plain language and phonetic alphabet for letters (Alpha, Bravo, Charlie).

Assertive, not aggressive: state the observation, the rule, and the required action, e.g. 'You cannot enter here; please step back to the lobby'.

Barriers to communication include jargon, noise, language differences, prejudice and emotional state; each must be recognised and compensated for.

Report writing communicates facts to people who were not present; it must be clear, chronological, objective and free of unexplained abbreviations.

A security guard's powers are those of a private citizen unless specific statutory powers are granted; the guard does not have police authority.

Citizen's arrest is lawful only for an offence committed in the guard's presence (or as defined by local law), and the person must be handed to police promptly.

Use of force must be lawful, necessary and proportionate; force is justified only to prevent harm or effect a lawful arrest, never as punishment.

Arrest vs detention: a guard may detain a suspect under citizen's arrest provisions but must not interrogate, search without consent or use threats.

Search policy: personal search requires consent or a contractual/statutory basis stated in site rules; searches are conducted by a person of the same sex and witnessed.

Confidentiality: information about staff, visitors and incidents is disclosed only to those with a need to know or on lawful authority.

Evidence handling: preserve the scene, do not handle items unnecessarily, record the chain of custody, and do not alter CCTV footage.

Ethics: honesty in reporting, no discrimination, no acceptance of gifts that could influence decisions, and no misuse of access data.

Negligence requires a duty of care, a breach of that duty, and resulting loss; accurate records are the primary defence against a negligence claim.

Intrusion detection zones: perimeter, area (volumetric), and point (door/window contact). Each zone reports to the control panel with an identifier.

PIR (passive infrared) sensors detect changes in infrared heat energy and are prone to false alarms from sunlight, heaters and animals.

Dual-technology detectors require both PIR and microwave triggers, reducing false alarms at the cost of some sensitivity.

Access control card technologies: magnetic stripe (low security, easily copied), proximity (RFID, common), smart card (chip, higher security), biometric (highest identity assurance, privacy issues).

CCTV recording: retention periods are set by policy and law; time synchronisation across cameras is essential for evidential value.

Alarm response: verify the alarm (CCTV, second sensor, callback), then dispatch; unverified alarms are a major source of wasted response.

Fire detection: smoke detectors (ionisation for flaming fires, optical for smouldering), heat detectors, and manual call points on escape routes.

Tamper protection: enclosures and detectors signal when opened or removed, preventing defeat of the device.

Equipment checks: daily user checks, periodic maintenance and calibration, and a fault log for any device found defective.

Drill frequency is set by site policy and local fire regulation; typical practice is at least one evacuation drill per period, with unannounced drills testing real readiness.

Drill documentation: date, time, scenario, participants, evacuation time, roll call result, issues identified, corrective actions and reviewer sign-off.

Debrief after every drill and real incident; findings feed back into the emergency plan and training.

Records retention: incident reports, fire drill logs, key registers, visitor logs and training records are kept for the period stated in policy or law.

Report quality test: could a reader who was not present reconstruct the event from the report alone, including times and actions?

Corrections to records are made by striking through, initialling and dating; never by erasing or overwriting, which destroys credibility.

Daily occurrence book is the primary source for shift handover and later inquiry; entries are sequential and time-stamped.

Statistics: incident counts, response times and drill evacuation times are tracked over time to show whether controls are working.

Confidentiality and storage: records are stored securely, access limited, and personal data handled in line with data protection rules.