A security contract can look complete yet leave the important parts vague: who attends at 2am, who can view CCTV footage, what happens after a missed patrol, and who carries the cost when things go wrong. Security service contracts UK businesses sign should answer those questions in writing, while making supplier liability, insurance and termination rights clear.
This applies to single-site guarding arrangements and multi-site facilities management contracts. In both cases, security contracts should match the buyer’s operational and security requirements, risks and responsibilities.
Key Takeaways
- Define the security service clearly, including staffing, patrols, access rights, connected systems and each party’s responsibilities.
- Check SIA licences, vetting, insurance and subcontracting arrangements before appointment, and keep evidence requirements in the contract.
- Use measurable KPIs, clear pricing and variation provisions, proportionate liability caps and practical termination and exit rights.
- Set out incident escalation, evidence preservation, CCTV access, UK GDPR responsibilities and personal data breach notifications.
- For public sector work, follow the stated security management schedule, cyber requirements and procurement documents rather than relying on a generic tender response.
Security service contracts UK businesses need to classify properly
Security is not one service category. Different security contracts support different security requirements. A contract for a concierge operating access control systems differs from one covering remote CCTV monitoring or network protection. Start by describing the actual work, not the supplier’s broad marketing label.
Manned guarding and front-of-house duties
Manned guarding can include patrols, gatehouse cover, keyholding services, visitor management, alarm response and event security. The contract should state locations, operating hours, minimum staffing, relief cover and the authority each officer has on site.
Be careful with blended roles. A receptionist who controls entry, challenges unauthorised visitors or monitors surveillance may be carrying out security work. The SIA’s licensing guidance is clear that the activity matters, not the job title.
CCTV monitoring and access control
Surveillance contracts should identify every camera, monitored entrance, alarm integration and retention period. This should include the surveillance equipment used for cameras, alarms and connected monitoring. If the supplier has remote access, the agreement should say where footage is hosted, who can download it and how access is logged.
A CCTV system is not simply a physical security measure. It can hold identifiable personal data, which creates UK GDPR and wider data protection obligations.
Cyber security and connected systems
Access control, CCTV and intruder alarms increasingly sit on the same network as business systems. The security requirements for guarding, CCTV and connected systems may therefore differ.
A physical security provider may need access to routers, cloud platforms, administrator accounts or building-management software. Ask for a clear boundary of responsibility. The supplier shouldn’t assume it controls cyber risk merely because it installs the cameras. Equally, your IT team shouldn’t assume the guarding company owns every security incident involving connected equipment.
Check credentials, people and insurance before appointment
A compliant tender response is useful. It is not a substitute for checking the business that will actually provide the service.
SIA licences and supplier assurance
Where licensable activity applies, require each relevant officer to hold a valid SIA licence throughout the contract. Build in the right to audit evidence and require prompt notice if a licence is suspended, revoked or due to expire.
You can check security staff have a licence through the public register. That is a sensible control for named officers and supervisors, particularly where they will work unsupervised or have keys, access cards or sensitive site knowledge. Check the SIA licensing category matches the activity being delivered.
SIA Approved Contractor Scheme membership can also be relevant, but it is voluntary and approval applies to named activities. Do not write “ACS approved” into a contract as a vague badge. State the activity you expect the approval to cover, then verify it. A public sector tender may also require evidence against a named security management schedule.
Insurance, vetting and subcontracting
Employers’ liability insurance is required where the supplier employs staff, subject to limited exceptions. Public liability cover, professional indemnity cover and cyber insurance are contractual matters that should reflect the work’s security requirements and credible loss.
Set minimum cover levels only after a documented risk assessment of the site, duties and credible losses. The right levels depend on the security requirements of the work being procured. A supplier guarding a warehouse with low-value stock is not in the same position as one handling access at an NHS facility.
These controls should be written into security contracts, rather than left to policy documents. The agreement should also cover:
- screening and vetting standards for security personnel, matched to the contract’s security requirements;
- whether subcontracting is prohibited, permitted with consent, or freely allowed;
- the supplier’s responsibility for subcontractor conduct, licences, training and insurance;
- immediate disclosure of investigations, safeguarding concerns or material staff misconduct.
A supplier’s responsibility should continue through its subcontractors. Otherwise, the contract creates a gap at the point accountability matters most.
Get the commercial terms out of the small print
Price is visible. The cost of an unclear variation process often is not. Security contracts should make commercial responsibilities just as clear as operational ones.
Scope, staffing and performance measures
Security guard contract terms should define the service scope, staffing levels, payment provisions and security requirements. The monthly fee should state what is included and what is chargeable extra. This includes additional patrols, emergency attendance, body-worn video, replacement keys, bank holiday cover and reports requested by insurers or police.
Use measurable KPIs and service-level agreements rather than decorative promises. The security requirements should record agreed attendance times after an alarm, scheduled patrol completion rates and reporting deadlines. These obligations belong in the agreement, not in vague promises. Include a documented monthly review.
| Contract area | Review point | Useful evidence |
|---|---|---|
| Staffing | Minimum numbers, skills and relief cover | Rota, licence records and training matrix |
| Patrols | Routes, frequency and proof of completion | Time-stamped patrol reports |
| Alarm response | Call-out process and target attendance | Incident log and escalation record |
| Reporting | Content and deadline for reports | Monthly performance pack |
The useful test is simple: could both parties tell, without an argument, whether the service was delivered?
Liability caps, changes and exit rights
A liability cap shouldn’t be accepted as boilerplate. Standard contracts may not reflect the site’s staffing, liability or data-handling requirements. Use a risk assessment to test the cap against insurance levels and likely exposures. Check whether it applies separately to data breaches, security breach, death or personal injury, loss of keys, confidentiality failures and property damage. Some exclusions can’t be contracted away, while other limits depend on the wording and bargaining position.
Review the mechanism for annual price rises, wage-cost changes and additional work. If the supplier can increase charges, the client should receive proper notice and a clear calculation. Changes should also be tested against the site’s security requirements.
Contract termination provisions need equal attention. Include rights to end the contract for serious breach, repeated KPI failure, loss of SIA licensing, insolvency, data protection failure or unapproved subcontracting. Agree what happens to keys, passes, records, equipment and site knowledge on the final day.
Put incident response and data handling into the contract
Security is judged during ordinary routines, but the contract is tested when an alarm activates, footage is requested, or a guard reports a serious concern.
Reporting, escalation and the Security Management Plan
Set out what counts as an incident. Theft, unauthorised entry, aggressive behaviour, lost keys, alarm faults, suspicious packages, data loss and safeguarding concerns may each require different security requirements and actions.
A proper incident clause should state who receives the first call, the escalation order, reporting deadlines, preservation of evidence and which security requirements apply. It should also say when the client must be informed, rather than leaving that decision to the officer on duty.
For higher-risk public sector work, a Security Management Plan may be required. It should assign responsibilities, set reporting routes, identify security risks and record how security requirements and controls are tested. Its incident arrangements should align with the buyer’s security management schedule. It is a working document, not a document written for the tender and forgotten.
CCTV, access logs and UK GDPR responsibilities
The contract should identify whether the client, supplier or both determine why and how personal data from CCTV, access control systems and surveillance equipment is used. It should deal with data protection, processing instructions, confidentiality, security measures, sub-processors, deletion and support for data subject requests.
Footage and access logs must be available when needed, but not shared casually. Define who can request a copy, how identity and authority are checked, and how disclosure decisions are recorded.
If a security breach involves personal data, the supplier needs a contractual duty to notify the client without delay, provide the facts it holds and assist with containment. The client still needs its own process for deciding whether notification to the Information Commissioner’s Office or affected people is required.
Understand public sector schedules before bidding
Government requirements can be more detailed than a typical private agreement. Public sector buyers may use a security management schedule to define responsibilities and evidence. Small and medium-sized suppliers should read it before preparing bids for security tenders, not after award.
The five security management schedules
UK Government Security sets out five forms of security management schedule: Authority or Buyer-Led, Supplier-Led, Developer, Consultancy and Short Form. Each reflects the contract’s activity, information and security requirements.
An Authority or Buyer-Led security management schedule keeps more control with the contracting authority. A Supplier-Led security management schedule gives the supplier greater responsibility for managing controls.
A Developer security management schedule may cover building or changing a system. A Consultancy security management schedule suits a different type of access and responsibility.
A Short Form security management schedule is intended for simpler, lower-risk arrangements. These labels aren’t interchangeable, and the buyer’s wording takes precedence over standard contracts.
Read the stated schedule carefully, because it becomes part of the obligations in your security contracts. Follow the buyer’s document, even where another framework uses different names.
Data category and cyber requirements
Government guidance uses four security categories. The buyer selects the security management schedule by considering the information, systems, access and operational consequences. Lower-risk work may permit Consultancy or Short Form arrangements, while the highest category requires an Authority-Led approach.
For relevant public contracts involving OFFICIAL government data, PPN 014: Cyber Essentials may require Cyber Essentials or Cyber Essentials Plus. The tender wording and risk profile decide the requirement, particularly where connected systems and wider cyber security create specific security requirements. Don’t promise a certificate you don’t hold.
An Authority-Led or Supplier-Led security management schedule can also affect assurance and oversight. Read the stated model closely, then reflect its security requirements in your staffing, reporting and evidence plan.
Find security tenders with a contract-ready approach
A good bid begins before the opportunity is published. Your policies, insurance schedules, licence records and case studies should be current, consistent and easy to produce.
Use the right procurement routes
Contracts Finder publishes central government and agency opportunities worth over £12,000 including VAT. For larger procurement opportunities, Find a Tender is a core source, although buyers may also use frameworks and their own portals.
Start by comparing each opportunity with your security requirements and reviewing the documents carefully. Check any security management schedule for service boundaries, evaluation criteria and mobilisation expectations.
Search terms should include manned guarding, concierge, CCTV monitoring, access control, keyholding services, event security, facilities management and security guard services. Local authorities, NHS bodies and universities may package these services within broader estates or facilities contracts for public sector buyers.
Write to the stated requirement
Do not answer a security tender with a general company profile. Build the tender response around the procurement process, matching each question to evidence and the stated security requirements.
Name responsible roles and provide a mobilisation plan, licence checks, incident samples, training records and KPI reporting. Map each control to the security management schedule so the evaluator can verify compliance quickly.
TUPE may arise where staff are transferring on an outsourced, retendered or insourced service. It is not automatic. Ask for workforce information early, price cautiously and take advice where the facts are unclear.
Before signing, check whether the buyer’s standard contracts reflect the stated requirements and mobilisation obligations. Reconcile the final security management schedule with your evidence plan, then have a solicitor review complex, high-value or disputed agreements. The cost is modest beside an unmanaged liability or an unworkable service obligation.
Frequently asked questions
Is an SIA licence required for every security role?
No. It depends on the activity being carried out. Manned guarding, key holding, door supervision and public space surveillance can be licensable, but the contract should not make assumptions based on a person’s job title alone.
Does every security supplier need Cyber Essentials?
No. Cyber Essentials is not a universal requirement for every guarding or CCTV contract. It may be required by a public sector buyer, particularly where the supplier manages OFFICIAL government data or accesses connected systems.
Can a security company use subcontractors?
Only if the contract allows it. A sensible agreement requires prior written consent, clear due diligence and full responsibility by the main supplier for every subcontractor it appoints.
A contract should make responsibility visible
The strongest security contracts aren’t the longest agreements. They connect service scope, people, data, insurance and exit provisions, while making duties, evidence, escalation and liability plain before an incident exposes the gaps.
Clear obligations give your team a fair basis to manage the supplier, and give the supplier a proper basis to deliver. Standard contracts aren’t automatically suitable for every security provider or buyer, so check that termination rights and accountability reflect the service being provided.
0 Comments