Operations, Monitoring, and Incident Response
This domain tests what happens after installation: alarm handling, operator procedures, video verification, access events, visitor management, reporting, training, and incident documentation. Expect questions on prioritization, escalation, evidence preservation, and after-action review.
Operations
A control room should have written procedures for forced doors, held doors, duress alarms, camera alarms, fire inputs, and equipment failure. Operators need clear escalation paths and authority limits. Alarm prioritization prevents flooding: life-safety alarms first, then intrusion or duress, then door-held and equipment faults. Video verification can confirm whether an alarm is real before dispatch. Visitor management must issue, track, and collect credentials. Badge audits and access recertification remove stale permissions.
Incident response
Follow a lifecycle: detect, verify, classify, respond, document, and review. Preserve video, access logs, and alarm records according to policy and legal hold. Maintain chain of custody for evidence. Notify per the escalation matrix. Conduct an after-action review and correct root causes.
Worked example
At 02:00 a door-forced alarm occurs at a loading dock. The operator checks the door position switch, nearby camera, and recent badge events. Video shows two people forcing the door. The operator dispatches patrol, notifies the supervisor, locks down adjacent doors, and preserves the video clip and access log. After the event, the team reviews response times and adds a camera with better coverage. The reasoning links detection to verification, response, evidence, and improvement.
Traps
Do not dispatch on every alarm without verification when video is available. Do not let nuisance alarms hide real events. Do not overwrite evidence through poor retention. Do not skip documentation because the event seemed minor.