Operational Planning

When Does the Clock Start and Stop in a Security Notification Target?

Distinguish notification, acknowledgement, attendance and resolution. Test the timing definition in a security service agreement against three illustrative records.

Titan SavunmaOriginal Article: Updated: Approximately 4 min read
A clock displayed on a laptop on a desk; illustrative stock photograph by Alexis Presa / Unsplash.
In This Article

“Prompt response to incidents” can sound clear during procurement. Yet the client and security provider may produce different monthly results if they measure different intervals. One starts at the first observation and the other when a record is created. One stops when a message is sent and the other when the recipient acknowledges it. An Ankara business should define the activity before agreeing a target number of minutes.

What the research identifies

Selviaridis and Norrman's study of three logistics providers identifies metric definition and monitoring the customer's contribution as challenges in designing performance-based contracts. [1] It does not establish an appropriate security notification time. Our application is to prevent parties from assessing different activities under one indicator name.

Separate four activities

Notifying an authorised client contact, receiving acknowledgement, attending the location and resolving the matter are separate stages. They may also have different owners. An officer might report an equipment fault while maintenance performs the repair. Combining everything as “response time” leaves the service being measured unclear.

Start with one activity: notifying a specified class of event to an authorised contact through the approved channel. Then identify which events qualify and which record establishes the start. A general information request and an emergency should not be casually placed in the same calculation.

Required emergency notifications and calls for assistance must not wait for an indicator calculation. Measurement should not introduce an extra approval stage into established duties or emergency arrangements.

Give the indicator a short operating definition

HSE's process safety indicator guidance stresses that information needed for measurement must be available or obtainable, with reporting arrangements established. [2] We use this UK guidance for record design, not as a mandatory Turkish rule.

The notification indicator can include:

  • Start: Which event, supported by which timestamp, begins the interval?
  • Finish: Message sent, delivery recorded or recipient acknowledgement?
  • Evidence: Which system or authorised record is the reference?
  • Time basis: How will timestamps from different devices be compared?
  • Missing information: How are records with unverified times reported separately?
  • Review: Which client and provider representatives resolve a disputed calculation, using what evidence?

Agree exclusions before measurement starts. Reclassifying an event after a target is missed, or moving the start time forward, does not improve the assessment. It only reduces comparability.

Test the definition with three records

The following times are illustrative, not recommended service targets.

In the first example, an event is observed at 09.00, a notification is sent at 09.04 and acknowledgement arrives at 09.06. The interval to sending is four minutes; the interval to acknowledgement is six. Both can be calculated under their respective definitions, but they are not interchangeable.

In the second example, a telephone notification took place but its time cannot be verified. Separate this as missing information rather than recording zero minutes or automatic success. If a later explanation is added, retain its source and date.

In the third example, the notification is sent but the first contact cannot be reached. The approved alternative contact sequence is followed, while the initial notification remains recorded. Stopping or resetting the clock must not be an improvised decision to make the report look better.

Calculate together before monthly reporting

Ask the client and provider to calculate the same three examples independently. Different answers indicate that a reliable comparison has not yet been established. Clarify the definition and evidence source, then repeat the exercise.

The eventual report should show the number of assessed records and missing information alongside the timing results. This prevents a single average from concealing a record-quality problem. The purpose is not to produce an impressive small number, but to identify which stage of communication needs attention.

Sources and Further Reading

← Back to Security BulletinBack to Top
For Your Organisation

Let’s Discuss Your Security Needs

Tell us about your operations and expectations so we can define the appropriate service scope together.

Contact

Request a Security Proposal for Your Organisation

Tell us your facility type, location and general requirements. Together, we can define a service scope that suits your organisation.

Tell Us What You Need

Fields marked * are required.

What Happens Next

  1. Initial DiscussionWe clarify your requirements and facility details together.
  2. Service ScopeWe assess staffing needs and the working arrangements.
  3. ProposalWe prepare our proposal for the agreed service scope.

Looking for a role? Visit our careers page