Begin With the End in Mind: How to Plan Your Security Response

A map and compass only help once you have decided where you are trying to end up.

The first move in any security plan is not buying equipment. It is deciding what you want to have happened once an incident is over, then working backward to get there. Most organizations never do this. They buy gear and hope. What follows is how to plan from the outcome you want, using a concept the military calls end-state planning, so your people know how to react before a crisis, not during one.

Where this idea came from

A Scoutmaster, now a friend, gave me a nice professional planner for my high school graduation. I never really used it the way it was meant to be used, and I have never admitted that to him to this day. Mr. H, if you are reading this, I am sorry. I appreciated the gift, it just never clicked for me. Stick around though, because it mattered anyway.

The box held the planner and the paper pages, but it also held a CD. That silver disc, the kind you slid into a computer or, if you were fancy, a car stereo, was the audiobook of The 7 Habits of Highly Effective People.

I played it in my Sony Walkman knock off several times. That freebie has stuck with me ever since.

What does "Begin with the end in mind" mean for security?

One of those habits is begin with the end in mind. People sometimes launch into a project without knowing what success looks like. But if you do not know where you want to end up, how do you know you are even heading in the right direction? Odysseus was away from home for 20 years, but he knew the whole time that Ithaca was the goal.

What is end-state planning?

Military planners call this end-state planning. The end state is how the battlefield should look once the operation is over. They define it first, then work backward to assign the right assets and estimate the people and supplies it will take. Sometimes that math decides the direction of the operation, or whether to run it at all.

Your organization should start the same way. Decide what you want to happen if a security incident occurs, and keep that end state realistic for the threats you face and the resources, people, and time you have right now.

That planning has to rest on one uncomfortable assumption, which is that the incident actually happens. Rather than counting on your equipment to scare a criminal off, assume they have already breached your exterior, or that they are walking toward your building with intent, and plan from that reality. It is easier to see how this works with a specific example.

What does this look like for a small church?

Start there: a criminal is committing a crime on your property, or you have spotted them before they act. In an ideal but realistic world, how do you want your organization to react, with the goal of protecting life first and property second?

Say you are a small church with an unarmed volunteer security team, and they spot someone walking up with a gun. How do you want your people to react?

Maybe the end state you want looks like this: the front door gets locked before the assailant reaches it, parishioners near the back get out through rear doors and windows, and anyone who cannot escape is prepared, as a last resort, to defend themselves and others. So how do you get there?

How do you reach that outcome?

To reach that end state, you would probably need:

• A volunteer monitoring the parking lot.

• A volunteer manning the front door so it can be locked in time.

• A building with only one way in but multiple exits.

• Radios for the volunteers so they can communicate quickly.

• Parishioners who are aware of your intent for the most common security scenarios.

• Security team members who practice their response until they no longer have to think about it.

I could go on, but you get the picture. Knowing where you are now and where you want to end up is what actually improves your security.

The takeaway

Beginning with the end in mind does not just make you a more effective person. It makes you a more effective security team.

Daniel Holland is the co-founder of Crisis Prevention and Response (CPR), a security consulting and training firm that delivers practical security solutions to homes, businesses, schools, houses of worship, and other organizations. He is an active law enforcement officer with over 10 years of experience in investigations, crime prevention, and public safety. He holds Florida Crime Prevention Practitioner and Florida Crime Prevention Through Environmental Design (CPTED) Practitioner designations along with FBI-LEEDA Public Information Officer certification at both levels. He also specializes in emerging threat assessment, with a focus on the drone threat landscape and its implications for civilian organizations.