Knowledge Base for Security Operations Centers

An intrusion signal arrives from a monitored site: door, motion detector or glass-break zone.

1. Acknowledge the signal and note the site, zone, signal type and time.
2. Open the site instructions and check whether the site should be closed, or if someone is arming/disarming or on a maintenance schedule.
3. Verify: check CCTV or audio if the site has it.
4. Call the site contact or keyholder and ask for the passcode; do not give details before it is verified.
5. If the alarm is confirmed, or cannot be cleared under your procedure, dispatch the patrol or contact the police as the contract states.
6. Log every action with its time until the event is closed.

Tip: Never share alarm details with anyone who has not passed verification.

A fire or smoke signal arrives from a detector, sprinkler or manual call point. Treat every one as real until cleared.

1. Acknowledge it immediately and note the site, zone or device type, and time.
2. Call the site contact right away to find out if there is smoke, fire or a known cause (for example a test or work in progress).
3. If there is any confirmation of fire, or nobody can rule it out under your procedure, contact the fire service without delay.
4. Advise anyone on the line to leave the building and not to re-enter.
5. Notify the keyholder and the customer contacts, and log all times.

Tip: Do not spend long investigating before calling the fire service. Follow your contract timings.

A panic button or duress code is triggered. Someone may be in danger, so this is the highest priority.

1. Act at once; this signal overrides anything else in the queue.
2. Check the site instructions. Do not call the site back unless your procedure says to, as the caller may be under threat.
3. Contact the police immediately with the site address, alarm type and any known details.
4. Keep listening on any open audio line, and note what you hear.
5. Notify the keyholder and your supervisor per procedure, and log all times.

Tip: Follow the site's duress procedure exactly. Never assume it is a false alarm.

You have an alarm and cameras at the site, and need to confirm whether it is real.

1. Open the cameras nearest to the alarm zone first, then the entrances and outer areas.
2. Look for people, vehicles, open doors, lights or damage, and note the time of what you see.
3. Save a snapshot or clip as evidence in line with your procedure.
4. If you see an intrusion, dispatch and inform the police straight away, and keep watching.
5. If you see nothing, check more cameras and still verify with the keyholder before closing.
6. Log exactly what you saw and when, including when you saw nothing.

Tip: Only view the cameras you need. Respect privacy and data protection rules.

The panel reports a fault, not an intrusion: power failure, low battery, communication failure or tamper.

1. Identify the exact signal type and the site.
2. Check whether maintenance, a power cut or a test is planned.
3. Treat a tamper signal as a possible intrusion until you can rule it out.
4. Contact the site or the technician to arrange a check, as set in the site instructions.
5. Keep the event open and follow it up until the fault is cleared and the signal restored.

Tip: A site that stops sending its regular test signal can be a hidden fault. Follow it up.

The alarm turns out to be harmless: user error, a pet, a faulty detector or a test.

1. Confirm the cause with the site contact if possible.
2. Record a cause code and describe it briefly.
3. Tell the customer what happened and how to avoid it (for example, correct arming or code use).
4. Flag repeat false alarms from the same site or zone for review or a technician visit.
5. Close the event only after the log is complete.

Tip: False alarms are data. Review them by site, zone and time, and the patterns will show what to fix.

Use at the end of every shift so nothing is lost between operators.

1. List all open events with status and the next action.
2. Note sites on test, maintenance or with special instructions today.
3. Flag pending callbacks and dispatches that are still in progress.
4. Mention equipment or system issues in the control room.

Tip: Keep it short enough for the next shift to read in two minutes.