Public order and safety

The challenge

The solution

The outcome

Requirements

• Define scope and outcomes: services needed, geographies, operating hours, response times, risk profile, legal/regulatory requirements.
• Set governance: accountable owner, procurement, legal, finance, security, operations, H&S, data/privacy, audit roles.
• Build selection criteria: experience in public order and safety, incident command capability, staffing depth, training, licensing, equipment, scalability, diversity of skills, track record.
• Assess compliance: permits, insurance, safeguarding, labor law, health and safety, data protection, human rights, anti-bribery, subcontractor controls.
• Evaluate operational capability: deployment speed, peak-demand surge capacity, communications, interoperability, reporting, escalation, continuity and resilience.
• Check quality and performance: KPIs, SLAs, references, incident history, complaint handling, lessons learned process, continuous improvement.
• Review people standards: vetting, background checks, certifications, competence assessment, supervision, welfare, fatigue management, retention.
• Verify technology and assets: radios, PPE, access control, monitoring tools, vehicles, maintenance, cybersecurity, inventory control.
• Confirm commercial model: pricing structure, total cost, transparency, penalties/incentives, payment terms, change control, indexation, exit costs.
• Run due diligence: financial stability, sanctions screening, litigation, reputation, conflicts of interest, insurance validity.
• Score suppliers objectively: weighted evaluation, mandatory pass/fail gates, scenario tests, site visits, tabletop exercises, references.
• Select best-fit partner: capability, compliance, value, resilience, cultural fit, ethical standards, innovation.
• Contract tightly: scope, deliverables, KPIs, SLAs, reporting, audit rights, data clauses, subcontracting rules, incident obligations, termination and exit.
• Onboard thoroughly: induction, site access, communications plan, emergency procedures, contact tree, escalation routes, training on local risks and protocols.
• Mobilize and test: pilot phase, readiness checklist, dry runs, joint exercises, business continuity and emergency simulations.
• Monitor and govern: weekly/monthly reviews, KPI dashboard, incident reviews, corrective actions, compliance audits, service improvement plan.
• Manage risk continuously: updated risk register, threat intelligence, seasonal/event planning, contingency staffing, alternative suppliers, exit/transition plan.

Best practices

• 1. Define clear operational requirements and risk scenarios before buying.
• 2. Verify compliance with all applicable laws, standards, and procurement rules.
• 3. Assess vendor reputation, certifications, and proven industry experience.
• 4. Match products and services to the organization’s specific threat environment.
• 5. Evaluate interoperability with existing systems, platforms, and workflows.
• 6. Require strong data security, privacy, and access control protections.
• 7. Test product performance, reliability, and usability before full deployment.
• 8. Confirm training, onboarding, and ongoing support are included.
• 9. Review maintenance, service-level agreements, and response-time commitments.
• 10. Plan for scalability, upgrades, and long-term lifecycle costs.
• 11. Conduct total cost of ownership analysis, not just upfront price comparison.
• 12. Ensure incident reporting, audit trails, and evidence handling are built in.
• 13. Require regular inspections, calibration, and preventive maintenance where relevant.
• 14. Establish clear vendor accountability, warranty terms, and escalation paths.
• 15. Continuously monitor outcomes and update purchases based on lessons learned.