Most organisations in WA have some form of physical security in place. Cameras. Access control. A guarding contract. Perhaps a policy document that was written during a previous review and hasn’t been updated since.
What most don’t have is a strategy — a coherent, documented approach that connects those individual measures to a clear understanding of risk, sets out priorities across a defined timeframe, and gives decision-makers a basis for allocating resources with confidence.
The difference between having security and having a security strategy is significant. Individual measures can be well-specified and still fail to deliver meaningful risk reduction if they’re not connected to each other, to the threat environment, or to the operational context they’re supposed to serve.
This article explains what a protective security strategy involves for WA organisations, how it differs from a security framework or a risk assessment, and what organisations typically gain from having one in place.
What a Protective Security Strategy Is — and What It Isn’t
A protective security strategy is a documented, organisation-wide approach to managing physical security risk over a defined period — typically two to five years. It translates the findings of a security risk assessment into a structured plan: what needs to be done, in what order, at what cost, and against what timeline.
It is not the same as a security policy, which sets out rules and obligations. It is not the same as a security framework, which describes the principles and structure of the security program. And it is not a security risk assessment, which identifies and rates the risks.
A protective security strategy sits above all of these — it uses the findings of the risk assessment, operates within the framework, and drives compliance with policy. It answers the question that risk assessments and frameworks leave open: what do we actually do next, and in what order?
For WA organisations, this distinction matters because many have invested in individual components of security — a risk assessment here, a framework policy there — without connecting them into a coherent plan. A strategy fills that gap.
Why WA Organisations Need a Strategy, Not Just Measures
Security without a strategy tends to drift in predictable ways.
Technology accumulates without design intent — a camera added here because of an incident, an access reader added there because a contractor requested it. Over time the site ends up with a security infrastructure that was never planned as a system and doesn’t perform as one.
Procurement decisions are made reactively — after an incident, under budget pressure, or because a supplier made a compelling pitch at renewal time. Without a strategic baseline, there’s no way to evaluate whether the proposed investment actually addresses a prioritised risk or simply replaces a system that was due for replacement.
Governance becomes difficult — when a board, audit committee, or insurer asks what the organisation’s security plan is, the honest answer is often “we have various things in place” rather than a documented strategy with measurable outcomes and a review cycle.
For WA councils and government agencies, this is particularly significant. The expectation from audit bodies, insurers, and elected members is increasingly that security decisions are evidence-based and documented — not reactive and improvised. A protective security strategy is the document that demonstrates this.
What a Protective Security Strategy Covers
Every strategy is scoped to the specific organisation, its risk profile, and its operational context. There is no universal template. However, a well-developed protective security strategy for a WA organisation will typically address the following components.
Risk-informed priorities. The strategy should be grounded in a current security risk assessment — not assumptions about what the risks are, but a structured, evidence-based analysis aligned with ISO 31000:2018. The risk assessment produces the priority order. The strategy translates that order into a plan.
Physical security measures. What infrastructure is in place, what gaps the risk assessment has identified, and what investments are planned to address those gaps over the strategy period. This includes CCTV, access control, lighting, perimeter treatments, duress systems, and alarm arrangements. Each investment should be linked explicitly to a risk finding — so that the decision to spend can be justified in governance terms.
Procedural and operational controls. Physical infrastructure is only as effective as the procedures that govern its use. The strategy addresses incident reporting, after-hours response, key and credential management, contractor access, and the integration of security procedures into day-to-day operations. Procedures that aren’t documented, trained, and tested don’t exist in any meaningful sense — the strategy sets out what needs to be in place and when.
Personnel and governance arrangements. Who is responsible for security, how decisions are made, how security performance is monitored, and how the strategy connects to the organisation’s broader risk management and governance framework. For councils and government bodies, this includes alignment with legislative obligations, insurance requirements, and audit expectations.
CPTED and environmental design. For organisations that manage public-facing environments — councils, developers, facility managers — the physical design of the environment itself is a security control. The strategy should address how the built environment is managed to support natural surveillance, access control, and territorial definition rather than enabling risk through poor design. This is particularly relevant for WA organisations that manage parks, laneways, carparks, and community facilities.
Technology review and forward planning. Security technology has a finite lifecycle. CCTV systems, access control platforms, and monitoring arrangements all require periodic review and replacement. The strategy maps out the technology lifecycle, identifies systems approaching end of life, and plans replacements against a prioritised timeline rather than leaving them to fail and trigger emergency expenditure.
Review and improvement cycle. A strategy that is written and filed is not a strategy — it is a historical document. A genuine protective security strategy includes a defined review cycle, typically annual or biennial, that updates the risk assessment, revisits priorities, and adjusts the plan in response to changes in the threat environment, the site, or the organisation.
The Connection Between Strategy and Investment Efficiency
One of the most tangible benefits of a protective security strategy is what it prevents — specifically, investment in security measures that don’t address the actual risk.
Without a strategy, security expenditure tends to be driven by incident response, supplier recommendations, or technology refresh cycles rather than by risk. The result is spending that can be significant in absolute terms but disproportionate to the risk reduction it achieves.
A security risk assessment conducted prior to a capital works decision consistently identifies investments that are being considered but that won’t materially reduce risk — and identifies alternative uses of the same budget that would. A strategy that incorporates these findings and tracks expenditure against risk priorities gives organisations a basis for demonstrating that security investment is proportionate, evidence-based, and defensible.
For WA councils in particular, where security expenditure is subject to community scrutiny and audit oversight, this matters considerably. The ability to point to a documented strategy, a risk assessment, and a prioritised investment plan is the difference between defensible governance and reactive spending that’s difficult to justify after the fact.
Protective Security Strategy for WA Local Government
Local government in WA has specific obligations and a specific operational context that shapes what a protective security strategy needs to address.
Councils manage an exceptionally diverse asset portfolio — civic buildings, libraries, recreation centres, parks, carparks, laneways, community halls, foreshore areas, and public open space — all with different threat profiles, different user groups, and different hours of operation. A strategy that treats all of these assets the same will systematically misallocate resources.
Effective council security strategies use risk-based prioritisation to distinguish between high-exposure assets (carparks, after-hours facilities, isolated open spaces) and lower-exposure ones, and allocate security investment accordingly. They also address the governance expectations of elected members and auditors — providing documented evidence that security decisions are systematic rather than ad hoc.
For WA councils engaging an independent security consultant through the WALGA Preferred Supplier Panel, the process is simplified — the procurement framework already exists, and the assessment and strategy can be delivered without a separate tender process.
What to Expect from the Strategy Development Process
Developing a protective security strategy is not a single-event exercise. It is a structured engagement that typically involves the following stages.
Scoping and context review. Understanding the organisation, its assets, its current security arrangements, and its governance context. This stage also identifies any existing risk assessments, audits, or policy documents that the strategy should build on rather than duplicate.
Security risk assessment. If a current assessment doesn’t exist, this is conducted first. The strategy is only as good as the risk information it’s built on — a strategy without a current risk assessment is a plan without a foundation.
Strategy development. Translating the risk findings into a structured plan: prioritised initiatives, indicative costs and timeframes, governance arrangements, and a review cycle. The strategy is developed with the organisation’s input, not imposed on it — the people who will implement it need to understand and own it.
Report and presentation. A written strategy document suitable for the governance purpose it serves — board presentation, council committee approval, audit evidence, or insurance submission. The document is structured clearly and written for its audience, not for security specialists.
Review and update. The strategy is a living document. An annual or biennial review — ideally incorporating a refreshed risk assessment — keeps it current and ensures it continues to reflect actual priorities rather than becoming outdated.
Engaging Smartsec for Protective Security Strategy Development in WA
Smartsec Security Solutions delivers independent protective security strategy development for councils, commercial operators, government agencies, and community organisations across Perth and regional WA.
Our strategies are grounded in ISO 31000:2018-aligned security risk assessments, vendor-neutral in their recommendations, and structured to meet the governance and documentation requirements of the organisations we work with. We do not supply or install security systems — every recommendation reflects what the organisation needs, not what a product catalogue offers.
We are a WALGA Preferred Supplier (PSP001-002 and PSP001-026), enabling WA councils to engage Smartsec directly under the panel arrangement without a separate procurement process.
Contact Smartsec Security Solutions to discuss your organisation’s security strategy needs.
