Choosing a security service provider in South Africa should be treated as a risk decision, not a price-only purchase. The right provider must be legally eligible to deliver the required services, capable of operating at your specific site and accountable through evidence, reporting and a measurable service-level agreement.
The short answer is to shortlist providers only after you have defined your risks. Then verify PSIRA status, deployed personnel, supervision, response coverage, technology controls, privacy practices, references, insurance and the full cost of delivery. A persuasive presentation cannot replace this evidence.
Start with your site risk, not a generic security package
A warehouse with high-value stock, a residential estate, a retail centre and a mine do not need the same operating model. Before inviting proposals, describe the assets, people and operations that must be protected. Record recent incidents, vulnerable times, critical access points, business interruption risks and any insurer or client requirements.
Your brief should answer at least these questions:
- Which people, assets, information and processes are critical?
- Which threats are credible at this location?
- Where are the known gaps in perimeter, access, surveillance or response?
- What must happen when an alarm, suspicious event or confirmed incident occurs?
- Which outcomes will define acceptable performance?
If these answers are unclear, begin with a documented security risk assessment. It creates a common scope so that every bidder prices the same requirement.
1. Verify PSIRA registration at business and officer level
The Private Security Industry Regulation Act states that a person may not render a security service for remuneration unless registered as a security service provider. The Act also covers activities such as guarding, response, security advice, investigations, installing or servicing security equipment and monitoring electronic security signals.
Ask for the provider’s current PSIRA business registration details and verify them through PSIRA’s official channels. Do not stop at the company certificate. Request a deployment list and evidence that the security officers, supervisors and relevant management personnel assigned to your contract hold appropriate and current registrations for their functions.
A screenshot or photocopy can become outdated. Make verification a pre-award check and a recurring contract control.
2. Match the provider’s capability to the actual risk
“We do security” is not a capability statement. Ask each bidder to explain how its people, systems and response procedures address the risks in your brief. A high-risk industrial site may require a combination of access control, trained guards, patrol verification, CCTV, alarm monitoring, armed response and incident investigation. A smaller office may need a simpler arrangement.
Look for relevant operating experience, not only a long client list. Useful evidence includes:
- Examples from comparable sites or industries;
- A proposed post structure and duty schedule;
- Site-specific standard operating procedures;
- An escalation matrix with named roles;
- Equipment, communications and backup arrangements;
- Sample incident, patrol and management reports.
Azomakhanye’s published security services include guarding, armed response, drone surveillance, investigations, fleet tracking, cybersecurity, risk management and CCTV systems. The correct mix should follow the assessment rather than being added simply because it is available.
3. Test the response model before accepting a response-time promise
A quoted response time is meaningful only when its assumptions are clear. Ask where response resources are based, how many are available during each shift, how dispatch is prioritised and what happens when the primary team is already attending another incident.
Trace one realistic scenario from detection to closure:
- An alarm, guard or camera identifies a possible intrusion.
- The event reaches a control room or authorised decision maker.
- The event is verified and classified.
- A response resource is dispatched.
- The client and, where appropriate, emergency services are notified.
- The scene is managed and the incident is documented.
- Corrective actions are assigned and followed up.
Ask the provider to define which stages it controls and how each timestamp is recorded. Response performance should be measured from actual event logs, not marketing language.
4. Examine recruitment, training and supervision
The day-to-day service is delivered by officers and supervisors, so their readiness matters more than the polish of the sales team. Ask how candidates are screened, how qualifications are checked, what site induction covers and how competence is assessed before deployment.
Supervision should also be visible. Establish the frequency of unannounced inspections, the method used to verify patrols, who replaces an absent officer and how poor performance is corrected. Request an example of the monthly management report you will receive.
5. Review technology, information security and POPIA controls
CCTV footage, access logs, visitor records, number-plate data and biometrics can contain personal information. The Protection of Personal Information Act requires a responsible party to use appropriate, reasonable technical and organisational measures to protect personal information and to identify, maintain and review safeguards against foreseeable risks.
When a provider will process this information on your behalf, define responsibilities in writing. Ask who can view footage, where data is stored, how access is logged, when records are deleted, how remote access is secured and how a suspected compromise is escalated. Your organisation remains responsible for understanding its own POPIA obligations.
For a technical system, use a design-led process such as the one in our guide to CCTV and security cameras for business.
6. Compare total cost, not only the monthly quotation
An unusually low monthly price can hide gaps in supervision, relief staffing, equipment, maintenance or escalation. Ask bidders to separate once-off, recurring and usage-based costs.
| Cost area | Questions to ask |
|---|---|
| People | Are relief officers, supervision, overtime, leave cover and annual increases included? |
| Technology | Who owns the equipment, software licences and data? What is excluded from maintenance? |
| Response | Are call-outs, patrols or after-hours escalation charged separately? |
| Mobilisation | Are site surveys, inductions, uniforms, radios and documentation included? |
| Exit | Can data be exported? What happens to leased equipment and configuration records? |
When several suppliers are involved, also account for internal coordination and duplicated call-outs. Our comparison of integrated security and multiple vendors explains when consolidation can reduce these hidden costs.
7. Verify references with operational questions
Contact at least two relevant references. Ask what happened after mobilisation, how the provider performed during a real incident, whether reports arrived on time and how quickly recurring problems were corrected. A reference from a site similar to yours is more useful than a prestigious logo from an unrelated industry.
If practical, visit a live site with the client’s permission. Observe officer presentation, access control discipline, equipment condition and whether the documented procedure matches what happens on the ground.
8. Put measurable outcomes into the contract
A strong service-level agreement should state the scope, staffing, hours, equipment, reporting, escalation and review process. It should also define how performance is measured. Suitable measures may include post coverage, patrol completion, alarm acknowledgement, dispatch time, incident-report turnaround, equipment availability, training completion and corrective-action closure.
Do not use one average to hide poor performance. Review high-severity incidents individually and agree on remedies for repeated failure. Include change control, subcontractor disclosure, data handling, confidentiality, termination assistance and ownership of records.
A practical security provider scorecard
| Criterion | Suggested weight | Evidence |
|---|---|---|
| Regulatory and workforce compliance | 20% | Verified registrations and current compliance documents |
| Fit to site risk | 20% | Site-specific solution and operating procedures |
| Response and escalation capacity | 15% | Resource map, process and logged performance |
| People, training and supervision | 15% | Screening, induction, supervision and relief plan |
| Technology and information governance | 10% | Architecture, security, maintenance and POPIA controls |
| Relevant references | 10% | Comparable sites and verified client feedback |
| Total cost and contract clarity | 10% | Transparent assumptions, inclusions and exit terms |
Adjust the weights to match your risk. Score only what the bidder can evidence and record the reason for each result. This makes the final decision easier to defend internally.
Red flags to investigate
- Pressure to sign before a proper site assessment;
- An expired, unverifiable or mismatched registration;
- A price that cannot support the proposed staffing and equipment;
- No named contract manager or relief plan;
- Response-time guarantees without location and workload assumptions;
- No written rules for footage, access logs or incident data;
- References that cannot discuss actual service delivery;
- A generic contract with no measurable outputs.
Frequently asked questions
Must a security company be registered with PSIRA?
South Africa’s Private Security Industry Regulation Act requires persons rendering security services for remuneration to be registered, subject to any applicable exemptions. Verify the business and the personnel relevant to your contract.
Should I choose the cheapest security quotation?
No. Compare the full operating model and total cost. A low price may exclude relief staff, supervision, maintenance, licences, call-outs or adequate technology.
What documents should I request from a provider?
Start with current PSIRA details, company registration, relevant officer records, insurance, COIDA good-standing evidence where applicable, training and firearm documentation for the proposed service, references, an operating plan and data-handling controls. See the complete security compliance checklist.
How many providers should I shortlist?
Three to five qualified bidders is usually enough for a meaningful comparison without creating unnecessary evaluation work. Pre-qualify them before asking for detailed site proposals.
How often should provider performance be reviewed?
Review operational performance monthly, high-severity incidents immediately and the full risk and contract model at least annually or after a material site change.
Choose from evidence, then manage the evidence
A good appointment process does not end at contract signature. Verify the provider, test the operating model, agree on measurable outcomes and keep the evidence current throughout the contract.
Need a site-specific proposal? Contact Azomakhanye Security Services to arrange a consultation and security assessment for your business.