People are the biggest factor in a security programme's success, so a security plan should train, involve and work with everyone at a facility, considering at least visitors, tenants, employees, service providers (contractors, deliveries) and security professionals, who range from managers to officers (ASIS CSO.1-2008, the CSO guideline and the private security officer selection and training guideline give detail). Four staffing models should be weighed: proprietary security (in-house hiring, training, career and pay, strong control but costly with the liability of running a force); contract security (a provider supplies and administers officers, saving recruitment, training and monitoring effort, offering a backup pool and absorbing overtime); hybrid (in-house staff for key or sensitive functions with contract staff for the rest, giving flexibility and lower cost and liability); and total outsourcing of the security programme, hardware, software, management and force. The choice should be tailored while keeping the needed security level, taking account of differences in how jurisdictions regulate contract security, and the organization should make sure all contractors meet minimum standards it accepts and any local regulation, involving its legal and procurement teams before signing.
This control maps to 2 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.