Most security incidents do not begin as major emergencies.
A disagreement between two customers may start with a few angry words. An employee may have a problem with a visitor who refuses to follow a building rule. A customer may become frustrated with staff. At an event, two people may argue over seating or access to a restricted area.
The situation can change quickly.
That is why businesses, property managers, event organizers, and security companies need clear security escalation procedures. Employees should know when they can handle a problem themselves, when they should call security, and when police, fire, or emergency medical services may be needed.
A good set of security escalation procedures is not about making every incident a major security response. It is about recognizing changes in behavior and responding at the appropriate level.
What Are Security Escalation Procedures?
Security escalation procedures are a set of steps that explain how an organization responds when an incident becomes more serious.
The procedure should answer several basic questions: who should be notified, when security should be contacted, when a supervisor should become involved, when employees should stop dealing with the situation, when emergency services should be contacted, who is responsible for communicating with responding personnel, and how the incident should be documented afterward.
The exact procedure will vary depending on the property. A retail store may have different procedures from an apartment complex. A construction site may have different concerns from a corporate office. A large event may require an entirely different response structure — which is one reason a written event security plan looks different from a standing property security plan.
The important part is that employees and security personnel understand the procedure before an incident occurs. The fifteen steps below outline what effective security escalation procedures look like in practice, from the first warning sign to the after-action review.
Step 1: Recognize the Early Warning Signs
Escalation procedures begin with recognizing that a situation is changing.
An argument does not automatically mean violence is going to occur. People can disagree without becoming physically aggressive.
However, certain changes in behavior may indicate that employees should involve a supervisor or security officer.
- Raised voices
- Repeated threats
- Refusal to follow reasonable instructions
- Aggressive body language
- Attempts to enter restricted areas
- Intimidating behavior
- Property damage
- Blocking doors or passageways
- Attempts to provoke employees or other customers
- A growing crowd around an argument
Employees should not attempt to diagnose someone’s intentions. Recognizing these signs is the first stage of effective security escalation procedures, and the purpose is simply to determine whether additional assistance may be appropriate.
Step 2: Use Calm Communication
When a situation is still relatively minor, calm communication can sometimes prevent it from becoming more serious.
Employees should speak clearly and avoid arguing with an upset individual. Instead of matching someone’s anger, employees can use short, professional statements.
For example: “I understand that you’re frustrated. Let me get my manager.”
Or: “I’m going to get someone who can help with this.”
The employee’s goal should not be to win an argument. The goal is to create enough space for the situation to be handled safely. This is also where de-escalation training earns its keep — a calm, practiced response in the first thirty seconds of a confrontation often determines whether it stays verbal.
Employees should also avoid unnecessary physical contact unless their job responsibilities and training specifically require it.
Step 3: Notify Security Early
One of the most common mistakes organizations make is waiting too long to contact security.
Calling security does not necessarily mean that an incident has become an emergency. Security personnel can be notified when an employee believes a situation may develop further.
For example: “Security to the front lobby. We have a customer who is becoming increasingly upset with staff.”
That gives security an opportunity to assess the situation before it becomes more difficult to manage. Early notification can also allow security personnel to position themselves nearby without unnecessarily drawing attention to the situation.
Step 4: Provide the Basic Information
Providing clear information is a foundational part of security escalation procedures. When contacting security, employees should provide the basic facts. A useful communication format is:
Location: Where is the incident? People: Who is involved? Problem: What is happening? Condition: Is anyone injured? Weapons: Is there a known or reported weapon? Movement: Has anyone left the area?
For example: “Security to the second-floor lobby. Two visitors are arguing near the elevators. Neither person has been reported injured. No weapon has been seen. The building manager is nearby.”
This gives the security officer a starting point. Additional information can be provided once security arrives.
Step 5: Security Assesses the Situation
Once security personnel arrive, they should assess the situation before deciding what level of response is appropriate. The officer may consider the number of people involved, the behavior of the individuals, whether anyone is injured, whether property has been damaged, whether the incident is still active, whether other people are being placed at risk, whether the individuals are willing to leave, and whether police or medical assistance may be needed.
Good security escalation procedures make sure the response is based on the circumstances rather than a predetermined reaction to every disagreement. A verbal disagreement may require a very different response from an assault, weapon report, or serious medical emergency.
Step 6: Establish a Supervisor Response
Establishing a clear supervisor response is a core part of well-designed security escalation procedures. Some incidents require more than one security officer or the involvement of a supervisor. A supervisor may become involved when multiple people are involved, the incident continues to escalate, employees are unable to resolve the problem, a person refuses to follow property rules, security personnel need additional assistance, management needs to make a decision, or the incident requires a formal report.
The supervisor can help coordinate personnel, communicate with management, and determine whether additional resources are necessary. Having a clear chain of command prevents several people from giving conflicting instructions.
Step 7: Separate People When Appropriate
Separating the people involved is often part of security escalation procedures at this stage. When a dispute involves multiple people, creating distance can help prevent the situation from becoming worse.
For example, an employee involved in an argument with a customer may be moved to a secure office while security speaks with the customer. At an event, two individuals involved in a disagreement may be directed to different areas.
The objective is to reduce contact between the people involved while maintaining safety. Security personnel should follow their training, company policies, and applicable laws when determining how to handle these situations. Physical intervention should never be treated as the automatic answer to a verbal disagreement.
Step 8: Protect Employees and Other People Nearby
Protecting bystanders is another responsibility built into well-designed security escalation procedures. An escalating incident can affect people who had nothing to do with the original disagreement, and employees should know where to move when directed by security or management.
Depending on the property, this could mean moving employees behind a secure door, keeping customers away from the incident, closing access to a particular area, moving event attendees away from a developing disturbance, maintaining access to emergency exits, or keeping hallways and emergency routes clear.
The exact response depends on the location and circumstances. The basic principle is simple: do not allow an escalating incident to unnecessarily pull more people into it.
Step 9: Determine When Police Should Be Contacted
Private security personnel can provide an important layer of protection, but security officers do not replace law enforcement.
An organization’s security escalation procedures should clearly identify circumstances in which police should be contacted, including immediate threats to life, serious physical assaults, reported weapons, significant property damage, criminal activity, threats that require law-enforcement intervention, individuals refusing to leave when police involvement is necessary, and other circumstances identified in the property’s emergency procedures.
Organizations should establish these procedures before an incident occurs. Security staff should also know who has authority to contact emergency services and how that information should be communicated. For general guidance on recognizing and responding to workplace violence, OSHA’s Workplace Violence Prevention resources are a useful outside reference when building an internal policy.
Step 10: Know When a Medical Emergency Takes Priority
Not every escalation is primarily a security problem, which is why good security escalation procedures also address medical emergencies.
Someone may collapse during an argument. An employee may be injured. A person may suffer a medical emergency unrelated to the original incident. When that happens, medical assistance becomes a priority.
Security personnel and employees should follow the organization’s emergency medical procedures and contact emergency medical services when appropriate. Information given to responders should include the location, nature of the emergency, and any known injuries.
Step 11: Maintain Communication During the Incident
Maintaining clear communication is one of the most overlooked parts of security escalation procedures. This becomes particularly important when several people are involved, and security officers, supervisors, managers, and employees should know who is responsible for communicating information.
Radio communication should be brief and professional. For example: “Officer at the north entrance. Situation remains verbal. No injuries reported.” Later: “Supervisor responding to the north entrance. Manager is moving employees away from the area.”
This type of communication keeps other personnel informed without tying up the radio with unnecessary conversation. Sensitive information should be communicated according to the organization’s established procedures.
Step 12: Escalate Again When Conditions Change
Good security escalation procedures should not be treated as a one-time decision. A situation can move from one level to another:
Level 1 — Minor concern: An employee reports an upset customer.
Level 2 — Security response: The person becomes verbally aggressive or refuses to follow instructions.
Level 3 — Supervisor response: The situation continues and additional security personnel are needed.
Level 4 — Emergency response: A weapon is reported, someone is seriously injured, or an immediate threat develops.
Level 5 — Emergency services: Police, fire, or EMS respond according to the circumstances.
The names and levels will vary by organization. The important concept is that employees should know that escalation is a process.
Step 13: Do Not Make the Situation Worse
Security escalation procedures should also explain what employees should not do. Employees should generally avoid arguing with an aggressive individual, making threats, insulting someone, crowding around a confrontation, attempting to physically intervene without appropriate training, chasing someone unnecessarily, spreading unverified information, posting incident details on social media, and interfering with responding emergency personnel.
Employees should follow their organization’s specific policies and the directions of trained security personnel. Sometimes the safest contribution an employee can make is simply to provide accurate information and allow trained personnel to take over.
Step 14: Document the Incident
Documentation is the final stage of most security escalation procedures. Once the immediate situation is over, documentation becomes important, and an incident report should generally record facts rather than opinions.
Depending on the organization’s procedures, the report may include the date and time, location, names of involved individuals, names of witnesses, description of events, actions taken by employees, actions taken by security, whether police or EMS responded, property damage, injuries reported, surveillance footage available, and the final disposition of the incident.
Reports should be completed as soon as practical while the details remain fresh. If an employee did not personally witness something, that should be clear in the report. For example: “Employee stated that another person told them a threat had been made” is different from writing “The individual made a threat.” Accurate documentation matters.
Step 15: Review What Happened
Security escalation procedures should not end when everyone goes home. After a significant incident, management and security should review what happened.
Questions may include how the incident began, when security was notified, whether employees knew who to call, whether security received accurate information, whether the response happened quickly enough, whether emergency exits were accessible, whether additional security officers were needed, whether police or EMS notification was handled properly, whether surveillance footage was available, and whether the security plan needs to be changed.
The purpose of the review is not necessarily to assign blame. It is to determine whether the organization’s procedures worked and whether something should be changed.
Create an Escalation Plan Before You Need It
Written security escalation procedures should exist before an incident occurs, not get improvised in the middle of one.
Employees should know who to call, what information to provide, where to go, when to involve security, when to notify management, and when emergency services should be contacted.
Security officers should know who is in charge, what their responsibilities are, what property rules apply, where emergency equipment and exits are located, how management wants incidents documented, and how to communicate with responding agencies.
The more familiar everyone is with these procedures, the less likely people are to improvise when something goes wrong. A security consulting review is often the fastest way to turn an informal, word-of-mouth understanding of “what we’d do” into an actual written escalation procedure everyone has seen.
Security Escalation Procedures Are About Proportionate Response
An effective security program does not treat every disagreement as an emergency. The purpose of escalation procedures is to match the response to the situation.
A customer complaint may require a manager. An argument may require security. A continuing disturbance may require a supervisor and additional personnel. A serious threat or injury may require emergency services.
Each situation has to be assessed on its own facts. Security personnel should be given the information, training, authority, and communication tools necessary to make those assessments — which is also why ongoing camera coverage matters: a CCTV and surveillance assessment can confirm that the cameras covering high-traffic areas actually capture the entrances, lobbies, and common spaces where these situations tend to start.
What This Looks Like for a Massachusetts Business
Hub Security and Investigative Group helps Massachusetts businesses, property managers, and event organizers build written security escalation procedures and provides the trained security guard services and mobile patrol coverage that put those procedures into practice, for properties across Boston, Cambridge, and Worcester, among many other Massachusetts communities. A written plan is only useful if the people who might need it have actually seen it, which is why walking a client’s staff through their own escalation levels is part of every engagement.
Final Takeaway
Good security escalation procedures give employees and security officers a roadmap for difficult situations.
The process begins with recognizing warning signs and communicating calmly. Security is notified before a situation becomes unnecessarily difficult to manage. Officers assess the circumstances, supervisors become involved when needed, and emergency services are contacted when the situation requires a public safety response.
Afterward, the incident is documented and reviewed.
The goal is not to create an unnecessarily complicated security system. The goal is to make sure that when a situation starts to escalate, everyone knows what to do next.
Clear procedures. Clear communication. Appropriate response.
Those three principles can make a significant difference when an ordinary workplace, property, retail, or event problem suddenly becomes a security incident.
By Derek Kreymer, Operations Manager