Museum and heritage estates also need to properly look at and understand the security capability they already have before repairing, replacing or adding more, writes the consultant Jimi Dicker, pictured.
Museums and heritage organisations often operate security arrangements that have evolved over many years. Cameras are added, doors brought onto automated access control, alarms extended, control rooms changed and new technology introduced as buildings, exhibitions and operational needs develop. Eventually somebody asks a bigger question: does the existing security estate still meet the organisation’s needs, and what should we do next? The temptation can be to start with replacement technology. In my experience, that is not always the best place to start.
When I review an existing estate, I do not tend to begin by counting cameras, readers or alarm points. I start with the organisation: what it needs to protect and enable; which people, collections, information, activities and services are critical; what credible threats and vulnerabilities exist; what the consequences of compromise might be; and what risks need to be managed. Only then can the existing security capability be properly considered and tested against what the organisation actually needs.
A working system is not necessarily an effective control
An estate audit can tell you what is installed, but an inventory alone does not tell you whether security is effective. The more useful questions are why a measure was originally introduced, what security outcome it was intended to achieve, whether the threat or vulnerability has changed, and whether the measure still performs as required.
A camera may produce a good image but no longer cover the activity or approach that matters. An access-controlled door may operate correctly while circulation, permissions or the operating model have changed. An alarm may report successfully, but its value also depends on who receives it, what they understand and what response follows.
Technical condition, operational effectiveness and security relevance are related, but they are not necessarily the same thing. This reflects the logic of following a defined Operational Requirements process: identify and prioritise critical assets, understand threats and vulnerabilities, assess risk, then consider proportionate mitigation and define what the security requirement needs to achieve. The technology comes later.
Understand capability, not just assets
As part of a mature museum estate, security capability usually sits across several layers: people, procedures, physical measures, electronic systems, communications, information and response. A meaningful review will therefore look to go beyond just age and condition. It can look at and include configuration, coverage, resilience, integration, maintenance, operating procedures, training, ownership, network and server dependencies, control-room workflows and the quality of the records needed to manage the estate.
It also means understanding interfaces. Security, Estates and ICT may each own part of the same operational outcome. A technically capable system can still underperform if responsibility is unclear, information is fragmented or response arrangements have not kept pace. Museums can add particular complexity. Public access and free movement, collections, temporary exhibitions, events, contractors, deliveries, historic buildings and shared public realm can all affect how risk presents itself. What was proportionate when a measure was installed may not remain proportionate as the organisation, its use of the estate or the threat environment changes.
Define the gap before the solution
Once current risk and existing capability are better understood, the organisation can start look to identify any gaps between what it has and what it actually needs.
That is also where better investment decisions start to become possible. The answer may be replacement, but it may equally be repair, reconfiguration, rationalisation, improved maintenance, clearer procedures, training, better integration or more effective use of capability that already exists. It may also identify measures that no longer have a clear purpose or no longer contribute meaningfully to the required security outcome.
This of course matters where budgets are constrained. Value is not achieved simply by extending asset life, nor by replacing older technology because something newer is available. It comes from understanding whether a measure still contributes to a defined security outcome, whether identified gaps remain and whether the residual risk is acceptable.
Security also needs to remain a live process. Threats change, buildings change, collections move, operating models develop and technology ages. Requirements therefore need to be reviewed, particularly where the threat, vulnerability or operational environment changes.
Before investing, the question should not simply be: “What do we replace this with?”
It should be more like: “What are we trying to achieve now, what capability do we already have, where are the genuine gaps, and what is the most proportionate way of addressing them?” Understanding that first helps provide a much stronger basis for deciding what should be retained, repaired, improved, rationalised or replaced – and, just as importantly, where further investment may not be required.
Biography
Jimi is Director and Lead Security Consultant at TripleJ Solutions, with more than 30 years’ built-environment experience and a specialism in protective, electronic and integrated security since 2003. Independent of manufacturers, integrators and product suppliers, he has worked with a number of museums, cultural organisations and complex public-facing estates, providing independent security consultancy from early concept and risk and needs assessment through Operational Requirements, audit, funding support, design, procurement, construction, testing, commissioning and delivery assurance. Visit https://triplej.uk/.
Jimi holds the Certified Security Management Professional (CSMP) Level 6 Diploma and the SFJ Awards Level 4 Certificate for Protective Security Advisers (CertPSA4). He is also a Principal Member of the UK official NPSA-sponsored Register of Security Engineers and Specialists (RSES), registered in the General Security Advisor category following professional peer review, and a member of the Association of Security Consultants (ASC), the Security Institute (SI) and the Institution of Engineering and Technology (IET).
