Corporate Security Organizational Structure, Cost of Services and Staffing Benchmark

Research Report

Bob Hayes, Greg Kane, Kathleen Kotwica

• Publisher: Elsevier
• Year: 2013
• Topic: Business
• eBook ISBN:
  9780124169968
• Subtopic: Information Management
• Index: Business

This research report presents the findings of a broad survey of corporate security programs conducted by the Security Executive Council's Security Leadership Research Institute (SLRI). The researchers' objective was to benchmark the state of the security industry in terms of organizational structure, budget, staff resources, board-level risk concerns, program drivers, and services provided. The level of responsibility each respondent reported for a list of 30 security programs or services is also compared across several organizational categories. This report can be used by security professionals for introspective analysis of the security team within their organizations, external review of the ways in which other organizations approach risk management, internal justification of security budgets and initiatives, and for performance metrics. Corporate Security Organizational Structure, Cost of Services and Staffing Benchmark is a part of Elsevier's Security Executive Council Risk Management Portfolio, a collection of real world solutions and "how-to" guidelines that equip executives, practitioners, and educators with proven information for successful security and risk management programs. - Summarizes the key findings of a large survey on security programs conducted by the Security Executive Council's Security Leadership Research Institute (SLRI) - Breaks down survey responses by organization size, scope of responsibility, industry, and more in easy-to-read charts and tables - Provides invaluable insight into other organizations' existing security programs and services

Survey Results

Section I: Organizational Demographics

In this section, information about the participants in this survey is provided. These demographics are used later in the report to provide metrics that enable organizations to compare apples to apples. A key takeaway from this first section is the diversity of the respondents’ organizations.

Figure 1.01 The geographic scope of the organization’s business (note: the original survey question defined regional as regional within a nation).

Figure 1.02 The regions of the world the organizations operate in (respondents could choose multiple regions).

Although a large number of industries are represented (see Figure 1.03), there were too few participants in this survey to warrant categorizing all of the following results by industry. Instead of providing possibly misleading metrics, it was decided not to provide a breakdown by industry for most of the analysis that follows.

Figure 1.03 The industries represented by the respondents’ organizations.

Figure 1.04 The organizations’ annual revenue (revenue was converted to U.S. dollars when appropriate).

Figure 1.05 The total number of employees per organization.

Section II: Respondent Demographics

In this section, the typical characteristics of the practitioners participating in the survey are examined.

Due to the many different titles used in the security and risk management field, the survey asked the participant to select the title level he or she felt best matched his or her position in the organization (see Figure 2.01).

Figure 2.01 The title level of individuals participating in the survey.

Further analysis of the data collected about security areas managed (Figure 2.02) showed that 53 percent of respondents managed only corporate security/physical security, and 7 percent managed only information security. Sixteen percent of respondents had responsibility for both corporate security/physical security and information security.

Figure 2.02 The security areas managed by respondents (respondents could choose multiple areas).

To get a better idea of the level within the organization in which the typical security and risk management executive operated, two questions were asked: what is the title level that best represented who they reported in to (Figure 2.03), and how many reporting levels the respondent is removed from the organization’s senior-most operating executive (Figure 2.04). The data in these two figures show that 73 percent of respondents report to a vice-president level individual or above, and 61 percent are within two reporting levels of the senior-most operating executive.

Figure 2.03 The reporting level of respondents within their respective organizations.

Figure 2.04 The number of levels of reporting between the respondent and the organization’s senior-most operating executive.

Further analysis of the levels of reporting indicated that the size of the organization did not appear to be a determining factor in whether or not a security executive is likely to directly report to the senior-most operating executive.

There was little commonality regarding the business area in to which the security groups report (Figure 2.05), with no clear correlation between the business area and any attribute measured in this survey, including industry, organization size (measured by revenue and employee count), scope of organization, and scope of responsibility.

Figure 2.05 The business function to which each respondent’s security group reports.

Examples of functional areas that fell into the “other” category consisted of:

• Security/corporate security

• Asset protection

• Director of police and security/law enforcement

• Security, crisis management, bus...

Table of contents

• Cover image
• Title page
• Table of Contents
• Copyright
• Executive Summary
• Survey Results
• Appendix A. Board-Level Risk Categories
• Appendix B. Data Cleansing
• Reference
• About the Authors
• About Elsevier’s Security Executive Council Risk Management Portfolio