Skip to content
S.G. Technologies
All insights
Assessment · 6 min read

How a baseline security assessment changes the decisions that follow

Most security spending goes wrong before a single camera is bought — at the point a decision is made without evidence. A baseline assessment is what turns guesswork into a defensible plan.

Ask most organisations why they bought the security systems they have, and the honest answer is rarely “because the evidence pointed there.” It’s more often a reaction — to an incident, to an auditor’s comment, to a competitor’s new gate, or to a persuasive vendor. The equipment may be good. The decision behind it usually isn’t.

A baseline security assessment exists to fix the decision, not the equipment. It establishes, in evidence, where you actually stand today — so that everything you spend afterwards is justified rather than guessed.

What a baseline actually is

A baseline is a structured snapshot of your current security and safety posture: your assets and what they’re worth to you, the threats that realistically apply, the vulnerabilities that connect the two, and the controls you already have in place. Done properly, it produces three things you didn’t have before:

  • A prioritised vulnerability register — not a list of everything wrong, but the gaps ranked by likelihood and impact.
  • A gap analysis against the standards that apply to you — for us, that usually means ISO 31000 for risk and relevant ASIS International guidance.
  • A compliance status — where you sit against regulatory and insurer expectations, and what closing each gap requires.

None of this is about buying anything yet. That’s the point.

Why the order matters

When you skip the baseline, three predictable things happen.

You over-invest in the visible and under-invest in the likely. Cameras are easy to point at. The real exposure is often a procedural one — keys that are never returned, access rights that are never revoked, an alarm no one is actually monitoring. A baseline surfaces the unglamorous risks that incidents are actually made of.

You can’t defend the spend. Boards, regulators and insurers increasingly ask “why this, and why now?” A recommendation tied to a specific, documented finding answers that question. A recommendation tied to a brochure does not.

You can’t measure improvement. Without a baseline, you have nothing to measure against. With one, every later re-assessment shows movement — which gaps closed, which remain, where new risk has appeared.

A worked example

Consider a branch network — a bank, an insurer, a retailer with sites across several regions. The instinct is to standardise: same cameras, same access control, everywhere. A baseline almost always complicates that instinct in a useful way. One site sits next to a high-risk neighbour and carries cash; another is low-footfall and low-value but stores sensitive records. Identical kit serves neither well. The assessment lets you spend where the risk is, not where the map is symmetrical.

That’s not a theoretical point. Across more than 200 assessments, the pattern repeats: the most expensive mistakes are uniform responses to non-uniform risk.

What good looks like

A baseline you can act on has a few hallmarks:

  1. It’s evidence-led. Every finding traces back to something observed, measured or verified — not asserted.
  2. It’s prioritised. It tells you what to do first, not just what’s wrong.
  3. It’s standards-anchored. It benchmarks you against a recognised framework, so the conclusions hold up to outside scrutiny.
  4. It’s independent of what’s being sold. If the people assessing you only ever recommend the systems they resell, the baseline isn’t really a baseline.

Where to start

You don’t need a consultant to begin thinking this way. A structured self-check will surface the obvious gaps in an afternoon — our self-assessment checklist is built for exactly that first pass. What a self-check can’t do is weigh the gaps against each other for your specific operations, or produce something a board or insurer will accept as evidence. That’s the line between a head start and a defensible plan.

If you’re at the point of making real decisions about your security and safety, start with the baseline. Everything downstream — the design, the budget, the systems, the training — gets better when it does.

Want a baseline for your sites? Request a risk assessment and we’ll scope it within one business day.

Share this article

Start with a risk assessment

Every SGT engagement starts with a structured, evidence-led assessment. Tell us about your sites and we'll scope it within one business day.

Request an assessment Free templates

FAQ

Questions on this topic

What is a baseline security assessment?
A baseline security assessment is a structured snapshot of an organisation's current security and safety posture: the assets and what they are worth, the threats that realistically apply, the vulnerabilities that connect the two, and the controls already in place. Its purpose is to fix the decision rather than the equipment, establishing in evidence where you stand today so that everything spent afterwards is justified rather than guessed. It is not about buying anything yet.
What does a baseline security assessment produce?
Done properly, a baseline produces three things: a prioritised vulnerability register, which is not a list of everything wrong but the gaps ranked by likelihood and impact; a gap analysis against the standards that apply, usually ISO 31000 for risk and relevant ASIS International guidance; and a compliance status showing where you sit against regulatory and insurer expectations and what closing each gap requires.
Why should you do a security assessment before buying cameras or access control?
Because without one, three predictable things happen. You over-invest in the visible and under-invest in the likely, since the real exposure is often procedural: keys never returned, access rights never revoked, an alarm no one monitors. You cannot defend the spend when a board, regulator or insurer asks why this and why now. And you cannot measure improvement, because there is nothing to measure a later re-assessment against.
Should every branch in a network get the same security systems?
Usually not. The instinct to standardise, with the same cameras and access control everywhere, is complicated by a baseline in a useful way. One branch may sit next to a high-risk neighbour and carry cash; another may be low-footfall and low-value but store sensitive records. Identical kit serves neither well. Across more than 200 assessments, the most expensive mistakes have been uniform responses to non-uniform risk, so spend where the risk is, not where the map is symmetrical.
Can a business in Ghana do a security self-assessment instead of hiring a consultant?
A structured self-check is a sensible first pass and will surface the obvious gaps in an afternoon. What it cannot do is weigh those gaps against each other for your specific operations, or produce something a board or insurer will accept as evidence. That is the line between a head start and a defensible plan. If you are at the point of making real decisions about security spending, the baseline is where to start.