For more than 35 years, organizations have trusted SRMC to provide independent, objective assessments of their security and public safety programs. From hospitals and educational campuses to corporate headquarters, museums, government facilities, and retail portfolios, we help clients understand where they are vulnerable and what actions will make the greatest difference. We do not sell products, install systems, or provide contract security guard services. Our only priority is helping you determine what puts your people, property, and assets at risk and what should be done about it, in the right order.
Most assessments start with one of five situations.
A health system with 25 facilities and a retailer with stores in malls, open-air centers, and storefronts want the same thing: one method applied everywhere and a view of where practice varies.
Leadership wants an independent assessment of the current security program before committing to renovations, a new building, or a technology upgrade.
Access control, video surveillance, and alarm systems have been acquired independently by different departments over time, resulting in fragmented ownership and unclear responsibility for their management and oversight.
Whether driven by state hospital security laws, The Joint Commission's workplace violence standards, or the Clery Act, compliance begins with an assessment.
Your environment changes. New visitor access models, changing neighborhood conditions, and emerging threats can create risks your security program was never designed to address.
We assess the security program as a whole, examining how people, processes, and technology work together at each site. While the areas below are commonly addressed in our engagements, the scope is defined with you before work begins.
We identify what you need to protect, the threats most relevant to your organization, and where existing security measures may leave gaps. We also evaluate crime trends and relevant intelligence surrounding each facility, recognizing that risk is influenced by both the property and its surrounding environment.
A strong security program has to work in practice, not just on paper. We examine how policies are carried out day to day, from visitor management and key control to cash handling, incident reporting, and employee training. We also identify gaps between current practices and applicable accreditation requirements, regulations, and standards.
Having security personnel is only effective if they are properly staffed, positioned, and supported. We evaluate staffing and deployment, officer posts and patrols, security office and substation locations, control room operations, and coordination with local law enforcement.
We assess access control, video surveillance, intrusion detection, and alarm systems to determine whether they provide the right coverage, work effectively together, and support day-to-day security operations. We identify gaps, redundancies, underperforming systems, and unnecessary complexity. Because SRMC does not sell or install security technology, our recommendations are based solely on your risks, operational needs, and priorities.
We evaluate the physical environment to identify conditions that may contribute to or reduce security risk. This includes the perimeter, entrances, interior layout and circulation, emergency egress, lighting, landscaping, and a Crime Prevention Through Environmental Design (CPTED) assessment of the property and grounds. We observe conditions during both business and after-hours periods because security risks and vulnerabilities can look very different when operations, staffing, and activity levels change.
We evaluate emergency response plans, communication protocols, and organizational readiness for the high-risk events most relevant to your operations. This includes incidents such as robbery, active aggressor events, large or disruptive groups, and emergencies that may affect multiple locations. Our focus is on whether your plans, people, and communication processes are prepared to work together when they are needed most.
We interview executive leadership, department heads, front-line staff, and security personnel to understand how security works in practice, not just how it is designed to work. Employees often provide valuable insight into conditions during different shifts, special events, and day-to-day operations. Their perspective helps us identify practical issues and develop recommendations that work in the real-world operating environment.
When requested, we compare key elements of your security program with peer organizations of similar size, environment, and population. Using available survey data and research from academic institutions, professional associations, and public sources, benchmarking provides an additional reference point for understanding how your program compares with similar organizations and where opportunities for improvement may exist.
A clear, actionable written report that:
Effective security practices are important to recognize because they provide the foundation for strengthening the overall program.
Recommendations reflect the risk profile, operations, and circumstances of each facility while also identifying opportunities where consistent standards across multiple locations would strengthen the overall security program.
We distinguish between issues requiring immediate attention, improvements that can be phased over time, and the recommended sequence for addressing them.
When a recommendation cannot be fully implemented immediately, we identify practical interim measures to reduce risk and provide a path toward the complete solution.
The report is written to clearly document the basis for our findings and recommendations and to support review by executive leadership, boards, accreditation surveyors, regulators, and other appropriate stakeholders.
A written report provides the detail. An in-person presentation brings the priorities into focus. SRMC can brief executive leadership and the board on the assessment’s most significant findings, risks, and recommendations, answer questions, and help decision-makers understand what needs attention, why it matters, and what should happen first.
For many clients, the assessment is the beginning rather than the end. SRMC can continue working with your organization to translate the recommendations into a security master plan, develop the requirements and design for recommended security technology, support procurement and bidding, oversee implementation through our Security Delivery Services, assist with recruiting security leadership, or develop security training programs.
These engagements allow SRMC to provide continuity from assessment and strategy through implementation, helping ensure that recommendations do not simply remain in a report but are carried forward into meaningful improvements.
SRMC does not sell or install security technology, provide contract security guard services, or accept commissions, finder’s fees, or other financial incentives tied to security products or providers. Our only interest is helping you make the right security decisions for your organization. We evaluate your people, processes, facilities, and technology objectively, with recommendations driven by your risks, operational needs, and priorities. That independence is fundamental to how we work and what distinguishes an independent security consultant from firms that sell, install, or design the systems they recommend.
Learn more about what makes an independent security consultant different
Consultant
Vice President, Operations
Vice President, Technology
Consultant
Consultant
Consultant
A vulnerability assessment looks for weaknesses in your existing security measures: a door that does not secure properly, a camera that misses an important area, or a visitor procedure that is not followed consistently. A risk assessment puts those weaknesses in context by evaluating what you are protecting, the threats you face, the likelihood and potential consequences of an incident, and which improvements should take priority. SRMC does both because a list of vulnerabilities without priorities is not an action plan.
Yes. Documents can tell us how security is supposed to work, but an on-site assessment shows us how it actually works. A policy may state that a reception desk is staffed during business hours, for example, but being on site helps us understand what happens after hours, how visitors gain access, and who assumes responsibility when the desk is unattended. We observe operations during both business and after-hours periods and interview the people closest to the work to understand how security functions in practice.
The timeline depends on the size, complexity, and scope of the engagement. A single facility typically requires one to five days on site, while assessments involving multiple facilities or campuses may require several days to several weeks of on-site work. Following the final site visit, the written report is typically completed within 30 to 45 business days.
We need access to the people who understand your organization and its day-to-day operations, the documents and information relevant to the assessment, and timely responses to follow-up questions. We also want to understand what happens when normal procedures do not go as planned, because those situations often reveal important security considerations. Before the report is finalized, your team reviews factual information for accuracy and provides any missing context. That review does not influence our findings or recommendations. Our assessment remains independent, and our conclusions are our own.
Yes. SRMC has conducted assessments involving more than 50 facilities within a single health system, as well as more than 20 representative locations across a national retail portfolio. We apply a consistent assessment methodology at each location while accounting for the risks, operations, and conditions unique to each site. This allows us to identify both site-specific vulnerabilities and systemwide trends, opportunities, and standards.
The report provides a prioritized roadmap for improving your security program, but you decide what happens next. Some organizations implement the recommendations with their own resources, while others continue working with SRMC to move from recommendations to implementation.
Through our Security Delivery Services, we can assist with security technology improvements, security operations center planning, policy and procedure development, staff training, program management, and other implementation needs. As your security program evolves, SRMC can remain your independent advisor, helping you turn recommendations into meaningful, sustainable improvements.
Security programs should be reassessed periodically and whenever there is a significant change in the organization, its operations, facilities, or risk environment. Changes such as expansion or renovation, new security technology, leadership or operational changes, significant incidents, or emerging threats may warrant a new assessment. The goal is not simply to reassess on a schedule, but to make sure your security program continues to reflect your current risks, operations, and priorities. As a general guide, SRMC suggests a full reassessment about every three years, and sooner when conditions change.
No. SRMC is an independent security consulting firm. We do not sell or install security equipment, provide contract security guard services, or accept commissions, referral fees, or other financial incentives tied to the products or services we recommend. Our recommendations are based solely on your organization’s risks, operational needs, and long-term objectives.
A discovery call is a brief conversation with an SRMC consultant about your organization, current security concerns, and objectives. It helps us understand your priorities, answer your initial questions, and determine the most appropriate next step.
