Monitoring the observance of security rules and procedures

Direct monitoring:

Security rules and procedures can be incorporated in general work appraisals and “check-lists”; as well as in meetings before and after field missions, in work reports, on meeting agendas, etc.

Periodical reviews can also be carried out together with the teams in question, of issues such as the safe-keeping of sensitive information, copies and security manuals; of security protocols for visits to the organisation’s headquarters; preparing to go on field missions, and so on.

Indirect monitoring:

Asking people for their views about rules and procedures, whether they are appropriate and easy to follow, etc, can establish whether staff actually know about the rules, whether they have been fully accepted or if there is disagreement which should be dealt with. Staff use of the security manual and any existing protocols and rules can also be reviewed.

It is very worthwhile to compile and analyse along with the people or teams in question, people’s opinions and evaluations of security rules and procedures. This can also be done off the record/anonymously or via a third party.

Retrospective monitoring:

Security can be reviewed by analysing security incidents as they arise. This must be handled especially carefully. Someone who has experienced a security incident might worry that it was their fault and/or that analysis will lead to sanctions against them. S/he might therefore be tempted to conceal it, leaving the incident, or aspects of it, unreported.

Who does the monitoring?

Depending on the way the organisation operates, whoever is responsible for organising security, specific areas of work within security, and managing any security staff, will also be in charge of monitoring security.