PSC Kenya cheat sheet

Governing statute: Private Security Regulation Act, 2016 (No. 13 of 2016), administered by the Private Security Regulatory Authority (PSRA).

PSRA functions: license private security service providers, register and license individual guards, set training standards, and discipline erring providers.

A private security service provider must hold a valid PSRA licence; operating without one is an offence attracting fines and/or imprisonment.

Guards must be registered and issued a certificate of registration; employers must verify registration before deployment.

Licence conditions include record-keeping, uniform and badge standards, and reporting obligations to PSRA.

Private security officers have no police powers: powers of arrest derive from the Criminal Procedure Code (Cap 75) citizen's arrest provisions.

Key statutes to know: Penal Code (Cap 63), Criminal Procedure Code (Cap 75), Evidence Act (Cap 80), Occupational Safety and Health Act 2007, Data Protection Act 2019.

Contract law basics: a guard's authority comes from the client contract; acting outside the assignment scope creates liability for the provider.

Core duties: obey the law, protect life and property, act with honesty and integrity, and remain accountable to employer and client.

Confidentiality rule: client information, security layouts, and access codes are disclosed only to authorised persons on a need-to-know basis.

Conflict of interest: a guard must not accept gifts, bribes, or side payments that could influence security decisions.

Uniform and identification: standards require correct uniform, visible identification, and no misrepresentation as police or public officers.

Reporting duty: misconduct, corruption, or criminal acts by colleagues must be reported through the chain of command.

Professional boundaries: no sleeping on duty, no intoxication, no unauthorised absence from post, no personal use of client property.

Ethical decision test: is it lawful, is it within my authority, is it consistent with company policy, and would it withstand public scrutiny?

Defence in depth: perimeter, building envelope, interior zones, and asset-level protection, each layer delaying and detecting intrusion.

Access control triad: identify the person, verify entitlement, then grant or deny entry; log every grant and denial.

Credential types: photo ID badges, visitor passes, keys, PINs, biometrics; each has different cloning and sharing risks.

Visitor management: sign-in, host confirmation, badge issue, escort rule, and sign-out reconciliation at end of shift.

Tailgating and piggybacking are defeated by one-person-per-swipe rules, turnstiles, and guard observation at entry points.

Perimeter measures: fencing, lighting, CCTV, intrusion alarms, and clear zones; lighting should remove concealment along approaches.

Key control: serialised keys, signed issue and return register, and immediate re-keying after loss or staff departure.

Search rules: searches must be lawful, based on posted policy or consent, conducted respectfully, and witnessed where practicable.

Post orders define duties, patrol routes, reporting lines, and emergency contacts; guards must be briefed on them before deployment.

Shift handover must record incidents, outstanding tasks, keys and equipment issued, and any changes to instructions.

Daily occurrence book (OB) is the primary operational record; entries are chronological, factual, timed, and never erased or altered.

Deployment principle: match officer numbers and skills to risk assessment, site layout, and hours of highest exposure.

Site risk assessment covers assets, threats, vulnerabilities, existing controls, and residual risk rating.

Equipment checks at start of shift: radio, torch, keys, PPE, fire equipment, and CCTV/alarm status.

Contract and client liaison: service level agreements set staffing, response times, and reporting deliverables.

Patrol types: fixed post, foot patrol, vehicle patrol, and random or clock-based patrols; random timing prevents pattern prediction.

Patrol method: observe, listen, check locks and windows, verify lighting, and record time at each checkpoint.

Incident report structure: who, what, when, where, why/how, actions taken, witnesses, and items secured.

Reports must be factual and first-person; record observations, not opinions, guesses, or conclusions about guilt.

Corrections to a report are made by dated, signed addendum, never by overwriting the original entry.

Evidence preservation: secure the scene, do not touch items unnecessarily, note positions, and hand over to police with a record.

Report timelines: serious incidents (fire, injury, break-in, arrest) are reported immediately to supervisor and police, then documented.

Emergency priorities in order: life safety, incident stabilisation, then property protection.

Evacuation principles: alarm, orderly exit via designated routes, assembly point roll call, and no re-entry until authorised.

Kenya emergency numbers: 999 or 112 for police, fire, and ambulance; know the site's internal emergency contacts too.

Fire response (RACE): Rescue, Alarm, Contain/Confine, Evacuate/Extinguish only if trained and safe.

Bomb threat: stay calm, record exact wording, note caller background noise and time, do not use radios near suspected devices.

Medical emergency: scene safety first, then call for help, then first aid within training; hand over to medics with a factual report.

Incident command: a single officer coordinates until the supervisor or emergency services arrive and assume control.

DRSABCD: Danger, Response, Send for help, Airway, Breathing, CPR, Defibrillation.

Adult CPR: compressions at 100–120 per minute, depth 5–6 cm, ratio 30 compressions to 2 breaths.

Severe bleeding: apply direct pressure with a clean dressing; use a tourniquet only for life-threatening limb bleeding.

Choking adult: encourage coughing; if ineffective, give up to 5 back blows then up to 5 abdominal thrusts, alternating.

Recovery position for an unconscious but breathing casualty; monitor breathing continuously until help arrives.

Burns: cool with running water for at least 20 minutes, remove jewellery, do not burst blisters, do not apply oils or creams.

Fire classes: A (solids), B (flammable liquids), C (gases), D (metals), F (cooking oils), E (electrical); match extinguisher to class.

PASS for extinguisher use: Pull the pin, Aim at the base, Squeeze the handle, Sweep side to side.

Crime triangle: offender, target, and opportunity; security work removes or reduces opportunity.

Situational crime prevention: increase effort, increase risk, reduce reward, reduce provocation, remove excuses.

CPTED principles: natural surveillance, natural access control, territorial reinforcement, and maintenance.

Target hardening: locks, grilles, safes, lighting, and alarms raise the effort and risk for an offender.

Routine activity theory: crime occurs when a motivated offender meets a suitable target in the absence of a capable guardian.

Risk assessment formula: risk = likelihood × impact; controls reduce likelihood, impact, or both.

Deterrence works best when measures are visible and consistently applied, not sporadic.

Observation accuracy factors: lighting, distance, duration of exposure, stress, and expectancy bias.

Description order: sex, approximate age, height, build, complexion, hair, clothing, distinguishing features, direction of travel.

Perception limits: memory decays quickly; record observations immediately and independently before discussing with others.

Chain of custody: every transfer of an item is recorded with date, time, from whom, to whom, and purpose.

Do not contaminate evidence: wear gloves where available, avoid handling, and package items separately.

CCTV evidence: preserve the original recording, note the time offset, and record who accessed and exported footage.

Testimony credibility is strengthened by recording exact words spoken, timing, and conditions at the scene.

Radio protocol: listen before transmitting, identify yourself, keep messages brief, and use plain language.

Phonetic alphabet (e.g., Alpha, Bravo, Charlie) and numbers spoken digit by digit reduce mishearing.

Message structure: who you are, where you are, what you have, what you need.

Report immediately, accurately, and completely; do not speculate on air about causes or suspects.

Confidential channels: sensitive information is passed by secure means, not open radio or personal social media.

Listening skills: paraphrase to confirm, ask clarifying questions, and confirm receipt of critical instructions.

Written communication: clear, factual, dated, signed, and free of jargon or abbreviations not agreed in the unit.

First contact rule: greet, identify yourself, state purpose, and ask how you can assist.

Service recovery: acknowledge the concern, apologise for the experience, act to resolve, and follow up.

Professional tone: calm voice, neutral body language, no arguing, no sarcasm, no physical gestures that escalate.

Access refusal: explain the policy reason, offer alternatives (host contact, visitor pass), and record the decision.

Complaint handling: record the complaint, escalate within defined timeframes, and never promise outcomes outside your authority.

Vulnerable or distressed visitors are treated with patience and referred to appropriate support.

Reputation effect: security staff are often the first and last impression of the client's site.

Employer duties under the Occupational Safety and Health Act 2007: safe workplace, risk assessment, training, PPE, and accident reporting.

Employee duties: follow safety procedures, use PPE as instructed, report hazards, and not wilfully endanger others.

Common guard hazards: lone working, night shifts, slips and trips, manual handling, and violence from the public.

PPE is the last line of defence; it supplements, never replaces, engineering and administrative controls.

Incident and injury reporting: record in the accident register and notify DOSHS where the law requires.

Fatigue management: adequate rest between shifts, planned breaks, and reporting inability to work safely.

Welfare basics: clean rest areas, drinking water, sanitation, and access to first aid are minimum standards.

Constitutional rights (Bill of Rights): life, dignity, freedom and security of the person, fair hearing, and freedom from torture and cruel treatment.

Use of force must be lawful, necessary, and proportionate; force is only used to prevent harm or effect a lawful purpose.

Force ladder: presence, verbal instruction, physical restraint, then intermediate means; lethal force is a last resort.

Arrest: inform the person of the reason, use minimum restraint, and deliver to police without unnecessary delay.

Detention by a private guard is limited; prolonged confinement without police involvement is unlawful.

Vulnerable persons include children, the elderly, persons with disabilities, pregnant women, and the injured or intoxicated.

Handling vulnerable persons: calm communication, no unnecessary restraint, same-sex search where practicable, and immediate medical attention.

CIA triad: confidentiality, integrity, availability; security controls protect all three.

Authentication factors: something you know (PIN), something you have (token/card), something you are (biometric).

Password hygiene: long unique passphrases, no sharing, no written notes at the post, change on suspected compromise.

Phishing indicators: unexpected urgency, mismatched sender address, suspicious links or attachments, requests for credentials.

CCTV and access control data are personal data under the Data Protection Act 2019; access is restricted and logged.

Physical security of IT: lock server rooms, control visitor access to comms cabinets, and report tampering immediately.

Incident response basics: contain, report to IT/supervisor, preserve logs, and do not attempt unauthorised fixes.