Security Control Rooms and Remote Monitoring for Financial Institutions in Singapore under the ABS Guidelines

A financial institution can install CCTV, access control and intrusion alarms throughout its premises, but those systems have limited operational value if nobody receives, assesses and responds to the information they generate.

This is why the ABS Physical Security Guidelines for Financial Institutions 2.0 (Revised 2025) treats monitoring as an important part of the detection process.

ABS states that system detection should be supplemented by active monitoring so appropriate action can be taken when threats are detected. It recognises both an off-site Central Monitoring Station (CMS) and an on-site Security Control Room (SCR) or Security Command Centre (SCC) as monitoring models.

This is particularly important for financial institutions operating from commercial office buildings.

The ABS guideline does not assume that every financial institution must build and operate its own dedicated security control room.

Instead, the monitoring arrangement can vary depending on the criticality of the premises, whether the FI owns or leases the location and the security resources already provided by building management.

What is a Security Control Room?

ABS describes the security command and control room as the nerve centre of security operations.

It should receive and provide important information to and from security personnel and first responders during both routine operations and emergencies.

In the Monitoring section, ABS similarly describes the CMS and SCC as nerve centres where field detection devices are connected, alerts are generated and information is provided to support response.

A control room is therefore not simply:

“a room with CCTV monitors.”

Its purpose is to support the complete process of:

Detection → Assessment → Escalation → Response

Does every financial institution need its own Security Control Room?

No universal requirement in the ABS guideline says that every FI must operate its own dedicated SCR or SCC.

ABS specifically allows different monitoring strategies depending on the criticality and ownership of the premises.

For example, ABS says that where an FI is the sole tenant, owns the building or operates a standalone data centre, an on-site in-house control room could be established.

By contrast, an FI occupying a multi-tenant building may depend on:

the building-management security control room, off-site monitoring by its own security team at another location, or a third-party security vendor.

The question is therefore not:

“Does every bank need a control room?”

It is:

“What monitoring arrangement is appropriate for this premises and its security risks?”

Can a financial institution monitor security remotely?

Yes.

ABS explicitly recognises off-site monitoring as part of its detection strategy.

For a multi-tenant FI, the guideline says monitoring may be performed by an in-house security team located somewhere else or by a third-party security vendor.

This is important because it means that physical security monitoring does not necessarily have to occur inside the premises being protected.

Consultant’s perspective

A centralised security operations centre or GSOC can therefore conceptually support the kind of off-site monitoring model described by ABS.

However, ABS itself uses the terms CMS, SCR and SCC in this guideline rather than “GSOC”.

If discussing a GSOC publicly, I would phrase it carefully:

A centralised GSOC can perform functions similar to the off-site monitoring model contemplated by ABS, provided the monitoring, assessment, escalation and response arrangements are appropriate.

That separates the ABS wording from the consultant’s operational interpretation.

Can monitoring be outsourced to a third party?

Yes.

ABS specifically identifies an off-site third-party Central Monitoring Station as a typical monitoring arrangement and later states that an FI in a multi-tenant premises may use a third-party security vendor for off-site monitoring.

This does not mean that outsourcing the monitoring function transfers all security responsibility to the monitoring provider.

The FI still needs to establish what the provider is expected to:

receive, monitor, assess, escalate and communicate.

Most importantly, someone must be able to respond once a genuine incident has been identified.

What should be monitored?

ABS links system detection with several physical security technologies.

Its Detection section states that system detection includes the use of:

video surveillance, intrusion detection and access-control systems to identify physical threats, illicit activities or intrusions.

The monitoring function therefore does not necessarily need to be limited to CCTV.

Depending on the security design, a control room may receive information from several systems.

Consultant’s perspective

For example, an operator might receive an intrusion alarm from a critical room, review the associated CCTV camera, check an access-control event and then escalate the verified incident.

That end-to-end workflow is an operational example. ABS does not prescribe a specific integration platform or software architecture.

Does ABS require active CCTV monitoring?

ABS states that system detection should be supplemented with active monitoring so that appropriate action can be taken when a threat is detected.

Its Building Management Engagement Guide also directly asks whether building CCTV is monitored by security personnel.

That makes monitoring an important consideration when an FI relies on either its own cameras or building-management CCTV.

However, ABS does not say in this section that an operator must continuously watch every camera feed at every second of the day.

The focus is on effective detection and response.

Does every CCTV camera need to be continuously watched?

The guideline does not state that every camera must be continuously displayed and manually watched.

Instead, it says control-room personnel need the ability to:

process, assess and prioritise CCTV and alarm data and distinguish real incidents from false alarms.

That wording is important.

It recognises that the operator’s job involves prioritising information, not merely staring at screens.

Consultant’s perspective

Modern monitoring may therefore use events, alarms or analytics to draw the operator’s attention towards situations that require assessment.

For example:

Alarm occurs → Relevant camera displayed → Operator verifies event → Incident classified → Escalation initiated.

That workflow is an operational interpretation rather than an ABS requirement for any particular analytics technology.

What should a control-room operator actually do?

ABS says control-room personnel should maintain clear situational awareness and have the ability to process, assess and prioritise information received from CCTV and alarm systems.

They should also be capable of differentiating genuine security incidents from false alarms.

This means operators need more than basic familiarity with the software.

They need to understand:

what constitutes an incident, what information needs to be checked, which incidents require escalation and what action should follow.

Does ABS discuss false alarms?

Yes.

The guideline specifically says that control-room personnel should be able to assess CCTV and alarm data to differentiate real incidents from false alarms.

This is an important operational consideration.

A monitoring centre receiving large volumes of unnecessary alarms can suffer from alarm fatigue and reduced attention to genuine events.

Consultant’s perspective

Security-system design should therefore consider not only:

“Can the system generate an alarm?”

but also:

“Is the alarm meaningful enough for an operator to take action?”

Poorly configured alarms can reduce the effectiveness of an otherwise sophisticated monitoring system.

Does a Security Control Room need an escalation plan?

Yes.

ABS specifically says that the SCR should have an escalation plan guiding security personnel on the actions to take when a threat is detected, including who should be notified and escalated to.

This is one of the most important requirements in the monitoring section.

A detection system without an escalation procedure may identify an incident but fail to produce an effective response.

What should an escalation plan contain?

ABS establishes the need for the plan but does not provide a fixed template in the cited section.

A practical escalation plan could identify:

This table is a consultant’s implementation example, not an ABS-prescribed format.

Should every alarm have the same escalation procedure?

No.

ABS says financial institutions should consider different escalation plans for different premises, including data centres, retail branches and office buildings.

That makes sense because a particular alarm may have very different consequences depending on the site.

For example, a forced-door alarm at a general office entrance may require a different response from an alarm at:

a vault, data hall, telecommunications room or retail branch.

The escalation should reflect risk and context.

What is the difference between monitoring and response?

Monitoring identifies and assesses the event.

Response is what happens after the event has been assessed.

The ABS framework separates Detection and Response as major components of the physical security programme, but also makes clear that they must work together.

ABS says detailed escalation and response plans are important so appropriate action can be taken to mitigate threats once they are detected.

Consultant’s perspective

A strong design should therefore establish:

Detection time + Verification time + Escalation time + Response time

rather than simply measuring whether an alarm reaches the monitoring centre.

Who physically responds when monitoring is remote?

ABS does not prescribe one universal response model.

The answer depends on the premises.

A remote monitoring centre may potentially escalate to:

building security, on-site FI security personnel, facilities personnel, another designated responder or emergency services depending on the incident and procedure.

The exact roles should be defined in the FI’s escalation and response plans.

The key issue

Remote monitoring works only when there is a clear answer to:

“Once the remote operator determines that this is a genuine incident, who can actually do something about it?”

Can a multi-tenant office rely on the landlord’s Security Control Room?

Yes, potentially.

ABS explicitly states that an FI in a multi-tenant premises will likely depend on the on-site building-management security control room or on off-site monitoring.

The guideline also notes elsewhere that the security command and control room is typically operated by building management or the building security team, although it can sometimes form part of the FI’s own operation.

The FI should therefore understand and assess how that building-level control room operates.

What should an FI ask about the landlord’s control room?

If the FI relies on building management, the security review should establish who monitors building CCTV and alarms, whether operators can communicate with field security officers, how incidents are escalated, how quickly building security responds, what happens outside normal hours, what happens during utility failures and how the FI is contacted during an incident.

ABS’s own Building Management Engagement Guide asks whether CCTV is monitored and whether control-room security personnel can communicate with field security officers and building-management staff.

The aim is to understand the dependency rather than simply note that “the building has a control room.”

Can an FI use both building monitoring and remote monitoring?

The ABS guideline does not prohibit this and its layered approach readily accommodates different monitoring arrangements.

For a tenanted financial institution, a practical model might be:

Building Management SCR

Monitors common areas, building entrances, lifts, car parks and base-building systems.

Financial Institution Remote Monitoring Centre

Monitors FI-owned CCTV, access control, intrusion alarms or critical spaces.

FI Security / Facilities

Manages internal escalation and business response.

This is a consultant’s architecture example rather than an ABS-defined model.

The important issue is that responsibilities should not overlap ambiguously or leave gaps.

Who owns the incident if both the landlord and FI receive the alarm?

ABS does not provide a responsibility matrix for this scenario.

Therefore, the FI and building management should establish the answer before an incident occurs.

A clear operating procedure should determine:

who receives the initial alarm, who verifies it, who sends personnel, who contacts the FI, who contacts authorities if required and who records the incident.

Consultant’s perspective

One of the biggest risks in shared security environments is the assumption:

“I thought the other party was monitoring it.”

A responsibility matrix can prevent this.

Does ABS require the Security Control Room to be 24/7?

The Monitoring section retrieved from ABS does not state a universal requirement that every FI’s SCR or SCC must operate 24/7.

It describes active monitoring and different on-site/off-site models, but does not prescribe one universal operating schedule in this section.

The required monitoring hours should therefore be established according to:

the risk assessment, operating hours, protected assets, alarms requiring response and other applicable organisational or regulatory requirements.

This should not be confused with ABS’s retail-branch appendix, which separately recommends 24/7 alarm monitoring and/or response services for retail branches.

Can a third-party monitoring centre replace security guards?

ABS does not state this.

Remote monitoring and on-site security personnel perform different functions.

A monitoring centre can receive and assess information remotely, while an on-site security officer may be able to:

investigate physically, control an area, assist occupants and coordinate local response.

Whether manpower can be reduced or reconfigured is therefore a separate risk and operating-model decision.

Consultant’s perspective

Technology and remote monitoring may allow an organisation to use manpower differently, but the question should be based on required security outcomes rather than on the assumption that one automatically replaces the other.

What should the physical Security Control Room contain?

ABS states that a typical security control room should contain the main operating stations of the security systems installed throughout the facility.

It also says working surfaces should be arranged to give personnel a good view of CCTV monitors and refers readers to the SPF VSS Standard for more information.

The ABS guideline does not, in this section, prescribe detailed room dimensions, monitor sizes, workstation quantities or console specifications.

Those detailed design matters should therefore be established using the relevant technical standard and project requirements.

Does ABS require CCTV, access control and alarms to be integrated?

ABS treats these systems as complementary elements of detection and monitoring, but the retrieved sections do not say that every FI must technically integrate all systems onto one software platform.

The functional requirement is more important:

operators need access to sufficient information to assess security incidents effectively.

Consultant’s perspective

Integration can improve monitoring where, for example, an access-control or intrusion event automatically presents the relevant camera.

But it should be justified by operational benefit rather than implemented simply because integration is technologically possible.

Should access-control events be monitored?

ABS includes access-control systems within system detection, alongside CCTV and intrusion detection.

It also says sensitive or critical-area access logs should be reviewed elsewhere in the guideline.

Therefore, selected access events can legitimately form part of the monitoring strategy.

Not every valid card transaction necessarily needs operator intervention.

The FI should determine which events are important enough to generate alerts.

Consultant’s examples

Potential monitored events might include a forced door, door held open, repeated denied access at a critical room or activity outside permitted hours.

Those examples are practical possibilities, not an ABS-defined alarm list.

Should intrusion alarms be remotely monitored?

ABS treats intrusion detection as part of system detection and says active monitoring should complement detection so appropriate action can be taken.

Elsewhere, ABS specifically states that effective intrusion-detection deployment should be complemented by monitoring and response.

This makes remote monitoring particularly relevant where an intrusion alarm occurs when no security personnel are physically present at the site.

The detailed alarm architecture belongs in the intrusion-detection article.

What happens during heightened security conditions?

ABS says financial institutions should develop different detection approaches for peace-time and heightened or enhanced security conditions.

During normal operations, security technologies such as CCTV, intrusion alarms and access control may operate with active monitoring by the control room or third-party monitoring centre.

During heightened conditions, depending on the FI’s risk assessment and level of control over the premises, additional measures may be introduced.

ABS gives examples including:

limiting entry and exit points, lockdown procedures, additional security personnel, bag or vehicle screening and employee broadcasts.

Monitoring procedures should therefore be capable of shifting from routine operations into an enhanced security state.

What if the FI has little control over the building?

ABS specifically recognises this situation.

For an FI in a multi-tenant building, co-location data centre or other premises where it has limited control, the guideline says the FI should work with building management so its internal security plan complements the building’s security plan during heightened conditions.

This reinforces an important theme throughout the ABS guideline:

tenant security and building security cannot always operate independently.

Common mistakes when interpreting the ABS monitoring guidance

“Every bank needs its own on-site Security Control Room.”
No. ABS expressly allows different on-site, building-managed and off-site strategies based on premises and criticality.

“Remote monitoring is not suitable for financial institutions.”
ABS expressly recognises off-site monitoring by an internal team or third-party security vendor.

“A control room is basically somewhere to display CCTV.”
ABS describes it as a nerve centre supporting alerts, assessment, escalation and response.

“If the alarm reaches the CMS, the job is finished.”
No. ABS emphasises detailed escalation and response plans.

“Operators only need to acknowledge alarms.”
ABS expects them to process, assess and prioritise information and distinguish genuine incidents from false alarms.

“Building security handles everything for a tenant.”
The FI needs to understand and coordinate with building security rather than simply assuming the dependency is adequate.

A practical remote-monitoring operating model

For a financial institution using centralised monitoring, a practical incident workflow might operate as follows:

Security event generated

A CCTV analytic, access-control event or intrusion device produces an alert.

Alert received

The remote CMS, SCC or GSOC receives the information.

Verification

The operator reviews the alarm details and relevant video or system information.

Classification

The event is determined to be false, non-critical or genuine.

Escalation

The appropriate responder is contacted according to the event type and premises.

Physical response

Building security, FI personnel or another authorised responder investigates or takes action.

Further escalation

Emergency services or senior management are contacted where required.

Incident closure

Actions and findings are documented and follow-up is initiated.

This is a practical operating model based on the monitoring and escalation principles in ABS; it is not a prescribed ABS workflow.

Practical Security Control Room and Remote Monitoring Checklist

A financial institution assessing its monitoring arrangements should be able to answer:

• Is monitoring performed on-site, off-site, by building management or through a combination?
• Which CCTV, access-control and intrusion events are monitored?
• Who receives each type of alarm?
• Can operators distinguish real events from false alarms?
• Is there an escalation plan?
• Does each site type have an appropriate escalation procedure?
• Who physically responds to a verified incident?
• Can the monitoring centre communicate with on-site security or building management?
• Are responsibilities between landlord, FI and third-party monitoring provider clearly defined?
• What happens if the monitoring connection fails?
• What happens during power or communications failure?
• How does the operating model change during heightened security?
• Does the FI understand the landlord’s Security Control Room arrangements?
• Are operators trained to maintain situational awareness and prioritise events?
• Are incidents documented and reviewed?
• Does the monitoring model actually result in timely response?

Conclusion

The ABS Physical Security Guidelines clearly support both on-site and remote security monitoring.

An FI may operate its own SCR or SCC, rely partly on the building-management control room, use an off-site internal security team or engage a third-party monitoring provider depending on the premises and security risk.

What matters most is not where the operator physically sits.

It is whether the organisation has an effective chain of:

Detection → Assessment → Verification → Escalation → Response

ABS expects control-room personnel to maintain situational awareness, prioritise security information, distinguish real incidents from false alarms and follow a defined escalation plan.

For financial institutions considering centralised remote monitoring, this is particularly significant.

The ABS framework is compatible with an off-site monitoring model, but effective remote monitoring depends on having clearly defined local response and escalation arrangements.