Navigating Outcome Based Contracts in Physical Security

Your security contract says there must be two guards on site at all times. Both shifts are filled, every attendance sheet is signed, and the provider has met the staffing requirement.

Then an incident happens. Nobody notices it for 20 minutes.

On paper, the contract was fulfilled. In practice, the result you needed was missed.

That is why facility managers, Managing Agents (MAs) and MCST councils are taking a closer look at Outcome Based Contracts (OBCs). Instead of defining a security service mainly by the number of people and hours purchased, an OBC starts with what the service must achieve.

It is a useful shift, but writing “better security” into a contract is not enough. The outcomes need to be measurable, realistic and supported by a clear response plan. Here is what to consider before changing the way you procure security.

What Is an Outcome Based Contract?

A traditional security contract often specifies inputs: the number of officers, their working hours and the posts they must cover. These are straightforward to count, but they do not tell you how well an incident was handled.

An OBC focuses on agreed performance outcomes. Depending on the property, these could include how quickly alerts are assessed, whether restricted areas are monitored effectively, how incidents are escalated, and whether reports are delivered on time.

The provider has more room to decide how to meet those outcomes. It might combine on site officers with cloud CCTV, access control, sensors and a central monitoring team. The point is to select the right mix of people, processes and technology for the risk, then measure whether it works.

Why Does This Matter to MAs and MCSTs?

When you buy security by headcount alone, adding another guard can seem like the obvious answer to every gap. But first ask what caused the gap.

Was an area out of sight? Did an alert reach the wrong person? Was there no procedure for responding after hours? Another officer may help in some cases. In others, better detection or a clearer escalation process may make a greater difference.

Outcome Based Contracts make those questions part of procurement. They encourage the provider to explain how its proposed service will protect the site, instead of only supplying a roster.

The potential benefits include stronger accountability and more flexibility as a property’s needs change. Cost savings may also be possible if routine monitoring can be handled more efficiently. But savings should be assessed against the full cost of equipment, monitoring, maintenance and response. A cheaper contract is only good value if it delivers the protection you require.

Start With the Risk, Then Set the Target

Before setting performance targets, identify what you need to protect. An office lobby, residential car park and server room present different risks. Each may need a different combination of access rules, monitoring and physical response.

Once the risks are clear, define a small number of outcomes that matter. For example:

• How quickly must a critical alert be acknowledged?
• Who decides whether an alert is a genuine incident?
• When must an on site officer or response team attend?
• What information must be recorded and reported afterwards?
• How will the provider demonstrate that restricted areas are being monitored?

Be precise about where each measurement starts and ends. “Fast response” is open to interpretation. A defined time from alert receipt to operator assessment is something both parties can check.

Targets should also distinguish between events within the provider’s control and those that are not. Otherwise, you risk creating a contract that produces arguments over the numbers instead of better security.

Technology Helps, but It Is Not the Outcome

Cloud CCTV, access control, IoT sensors and AI analytics can give a provider better visibility across a property. A door system can log an entry, a sensor can detect movement, and a camera can help an operator assess what happened.

But installing those tools does not automatically fulfil an OBC.

Suppose a sensor detects movement in a restricted area at midnight. The useful questions are: Did the alert reach someone? Did they review it? Was the correct person contacted? How long did the response take? Was the incident documented?

The technology supports those steps. The outcome is how effectively the team detects, assesses and responds to the event.

This is why vendors should show you their operating process alongside their equipment list. Ask what happens when a device goes offline or an alert is unclear. A good system needs a plan for ordinary failures as well as serious incidents.

Make Reporting Part of the Contract

An OBC needs reliable evidence. Without it, performance reviews become a contest of recollections.

Agree on what the provider will record and how often you will review it. A useful report might show alert volumes, assessment times, escalations, response times and unresolved issues. It should help you spot patterns, not simply present a dashboard full of numbers.

For example, repeated alerts from one door could indicate attempted unauthorised access. They could also point to a faulty sensor or a poorly configured rule. Regular reviews give the MA or council and the provider a chance to investigate and improve the system.

Reporting also makes accountability more practical. When a target is missed, you can examine what happened, correct the process and check whether the change worked.

Plan the Transition Carefully

Moving from a headcount based contract to an OBC affects more than the wording of a tender. Council members, facility teams, security officers and providers need to understand how responsibilities will work.

Start by documenting the current service and its gaps. Then define the outcomes you want, check which technologies and response resources can support them, and agree on how performance will be measured. A transition period can help everyone test the reporting and refine targets before using them for formal performance assessment.

It is also worth asking prospective providers how they will coordinate technology and manpower under one plan. Who owns the incident from the first alert through to closure? If that answer is unclear during procurement, it will not become clearer during an emergency.

Buy a Security Result You Can Verify

The strongest security contract does more than specify who stands where. It describes what the property needs to detect, how the team should respond and what evidence will show that the service is working.

PATH’s approach brings people, processes and technology together under a managed security model. For MAs and MCST councils considering an OBC, that creates an opportunity to discuss security in terms of measurable performance and the needs of the property.

Want a clearer starting point for your next security tender? Navigating Outcome Based Contracts.pdf to explore the benefits, transition steps and role of managed security providers.