Best practice is for everybody, your policy is for you
Best practice looks like the goal to hit, but it's really a guide to work from, the general answer that assumes your building looks like every other building in your sector. A guide is where you start, and your policy is where you finish, the one written for your own risks and the particular thing down the hall that changes the math on an ordinary call. Best practice is for everybody. Your policy is for you, and once in a while the two flat out contradict each other.
Most days the two line up and you never notice the difference. Then your circumstances run straight into the best practice, and the only way you knew which day you were in is that somebody sat down and reasoned it out for your operation ahead of time.
The clearest example I've got comes from a Fortune 50 GSOC. There was a room most of the building didn't know existed, no label on the door and no name on the floor plan, a special project a handful of people were cleared into. What made it stand out in the command center was the instrumentation. The cameras were specific, and the access system lit up the GSOC the instant anyone touched that door. We watched it more closely than we watched the lobby.
The post orders had a line in them that stayed with me. If someone went down in that room, a fall or a medical event, the kind of thing where you'd normally hold the person still and protect the spine until EMS could board them, the instruction was to get them out of the room first. Not because the room was on fire, not because there was a gas leak or any hazard to the patient. We moved them because of what the room was. The security need to keep that space closed came before the medical best practice of not moving someone who might have a c-spine injury. If you've worked EMS or dispatch, that sounds wrong the first time you read it, because everything you're trained on says you stabilize and you wait. In almost any other room in almost any other building, that training is exactly right. In that room it wasn't, and the policy that told us so was written by people who understood the room better than any best-practice guide ever could.
That's also why importing another industry's best practice quietly gets you in trouble. A hospital can't lock its doors, EMTALA won't let it turn anyone away, so a perimeter model built for a data center whose whole premise is exclusion makes no sense on a hospital floor. The c-spine rule that's gospel in an emergency department was the wrong call in that secure room. Every industry's best practice carries that industry's assumptions baked in, and when you copy the practice you copy the assumptions with it.
None of this matters much until the day it gets tested, and policies almost never get tested until they need to be. When that day comes and somebody asks what you did and why, best practice is not an answer you can hand across the table. It has no author. No one signed it, no one wrote it down for your building, so you can't produce it because there's nothing to produce. A policy that was actually written and owned holds up, because it exists and it can explain itself. Best practice evaporates the moment you're asked to show it.
The best practice and the right call are not always the same thing, and you don't get to work out the difference in the moment. You work it out ahead of time, in writing, or you find out the hard way that everybody's standard was never yours.
Touring
The exception is the vulnerability
The stranger at the desk gets his ID checked and his name confirmed against the appointment list. The vendor the officer sees every week gets a nod and a wave-through. Right there, in front of the whole lobby, the officer has shown everyone the way in. Look like you belong and keep walking. That gap is where pretext entry and tailgating live, and the officer's judgment is what opens it, because judgment is exactly what an intruder dresses to beat.
Consistency is the entire game. The bad guys only have to get it right once. We have to get it right every time, and the exception is the one time we don't.
The move is consistency in enforcement. You run the same screening on every person who comes through, no matter how well you know the face or how badly they say they are in a hurry. The same ID check and the same appointment confirmation, for the vendor you know as well as the stranger you don't, because the people who look fine are exactly the disguise worth wearing.
Consistent enforcement costs nothing to put in place. It is a standard, not a tool, and it pays you back two ways. The first time the familiar face turns out to be covering for someone who is not, the screening you ran on autopilot catches what your judgment would have waved through. And when someone accuses you of singling him out, running the same steps on everyone is the only honest answer you have, because you did the exact same thing to the person ahead of him and the person behind him.
Track your screening completion rate and count your logged exceptions, because the exceptions are the exposure.
Signals
The protocol that never reached the floor
On July 2 a police officer shot a patient in custody on the fourth floor of Los Robles Regional Medical Center in Thousand Oaks, and in the days since, the nurses union and the hospital have told very different stories about the security response. The union says security took more than five minutes to respond and that the right alarms were never activated. ER nurses, it says, knew a shooting was happening only when they saw officers moving through the building with guns drawn. The all-clear, one nurse said, didn't come for an hour and a half. The hospital says it initiated a patient safety alert at the time and issued an all-clear afterward, and it called the union's account inaccurate. The two are also in the middle of contract negotiations, which is context worth holding when you read either account.
The claim the union leaned on hardest is that the hospital dispatches its security from a call center in Las Vegas, and that an onsite dispatcher would have moved faster. That's the part to slow down on, because it's the wrong lesson. I've run command centers that dispatch from well outside the building they protect, and a GSOC three time zones away can alert a floor faster than a guard at a desk down the hall, as long as the alert path is built and drilled for exactly that. Where your dispatcher sits isn't the variable. Whether your notification reaches the people in the room in seconds, and whether they've been trained to act on it, is the whole game.
What the account describes isn't really a response-time failure, it's a notification failure, and those are different problems. The hospital had a protocol. It had panic buttons, added after a controversial July 2025 incident in which a Ventura County sheriff's deputy used a stun gun on an agitated patient who was holding scissors and a needle, and who died several days later, a death the autopsy attributed to that incident along with other health conditions. Nurses say they were never properly trained on the buttons. It had an alert that apparently never got upgraded to say the one thing that mattered, that there was an active shooting. A protocol that exists on paper and a protocol that reaches the floor under fire are not the same protocol, and you learn which one you own on a day like July 2.
Time your own alert path this week. How long does a floor-level alarm take to reach every person who needs it, and does it change as the facts change? When the threat is over, how does the all-clear reach them. If you can't answer in seconds, the location of your dispatch center is the least of your worries.
Passdown
dictated by Ricky Portezzo, Senior Security Supervisor in Center City, Philadelphia
Tuesday night at the clinic downtown. Dead slow till it wasn't.
The walk-through scanner up front been on the fritz all week, keeps throwing a fault code, so till the vendor shows we're on the backup, which is me asking everybody who comes in if they got any weapons on them. Everybody. And here's the thing, when that machine's up it hits every single person the same, don't matter who you are. So Mikey says when it's down you do the same, ask every single person, no eyeballing it and deciding who looks worth asking. I says Mikey the grandma with the walker too? He says everybody Ricky. So there I am asking a lady with a little kid on her hip if she's carrying and I feel like a jerk doing it, tell you the truth.
Then this one guy comes in, I ask him same as everybody, you got any weapons on you tonight sir, and he don't like it one bit. Gets right up on it, why you asking me that, what's that supposed to mean. And I don't blame him honestly, nobody likes getting asked that.
So I didn't argue with the man. I told him hang on, watch. And I asked the next guy behind him, then the lady after that, then the fella by the door, then the two kids by the window, same question every one of them. And you could see it land on him. Oh. You ask everybody. Yeah man, everybody, you ain't special. He kinda laughed and went and sat down.
That's the thing about the machine being down. Easy to figure you'll just ask the ones worth asking and save everybody the trouble. But once you start picking and choosing, now somebody's got a reason to say you singled them out. You ask the whole room, don't nobody get to say that. Do not tell Mikey he was right.
A screening rule that lives in one supervisor's head gets run one way by him and another way by everybody else. Written down as a standard, it is the same for the whole room, every shift.
SCC Spectrum Security Almanacs. www.gsoc911.com/products