Security company or cyber security company? Which one you need

When you search for a “security company”, the search engine cannot tell whether you fear a break-in or ransomware. The two fields share a word, not the work:

• Physical security: guards on post, patrols, entrance control, alarms, cameras, alarm receiving centres. The risk is someone who enters, takes or damages something on site.
• Cyber security: networks, servers, email, accounts, backups, penetration tests. The risk is someone who gains access to your systems or your data.

A good first question for any provider: “What exactly will you do at my site, and with which people?” The answer tells you at once which field they belong to.

Law 2518/1997 defines a private security services company as one that provides third parties with one or more of these services (art. 1 §1):

• (α) surveillance or guarding of movable or immovable property and facilities;
• (β) protection of individuals;
• (γ) secure transport of cash, valuables, antiquities, works of art and precious items in armoured vehicles;
• (δ) protection of shows, exhibitions, conferences, competitions and sporting events;
• (ε) security screening and access control at airports and ports, with the approval of the competent authority;
• (στ) escorting vehicles that carry bulky or heavy loads; (ζ) escorting sports delegations;
• (η) studies and planning of measures for activities (α) to (ζ);
• (θ) installation, maintenance and monitoring of security and alarm equipment and systems, except those fitted in cars;
• (ι) operating centres that receive, check and transmit alarm signals;
• (ια) studies and design of security systems for activities (θ) and (ι).

For all of these, the business needs a special operating licence, issued by the Chief of Staff of Hellenic Police Headquarters (art. 2 §1). Staff need a work licence: category A for activities (α) to (η), category B for (θ), (ι) and (ια) (art. 3 §2–3). How to check a licence is covered in our guide to checking a security company’s licence; the wider framework in the guide to private security law in Greece.

Protecting networks, software and data is not among the art. 1 §1 activities. So a Law 2518/1997 licence says nothing about a company’s cyber security competence — and the reverse is also true.

An IP camera, a video recorder or a door controller has a network address, software and administrator passwords. If the passwords stay at factory defaults or the device is never updated, the system you bought to protect the site becomes a door into your network. That is why, for these systems, the two fields have to work together:

• The physical side: where cameras and readers go, who watches the picture, who responds to an alarm. See our guides to choosing a CCTV system and to access control.
• The cyber side: which network the devices sit on, who holds administrator accounts, how remote access works, who installs updates.
• Where they meet: one document saying who is responsible for what, so nothing falls between the two. How systems come together into one picture is covered in the guide to security systems integration.

The standard you will often meet here is ISO/IEC 27001, full title “Information security, cybersecurity and privacy protection — Information security management systems — Requirements”. It concerns an information security management system, not guarding. What a certificate means and how to check one is covered in the guide to ISO certifications.

• Physical security only: stock theft, strangers walking in, a construction site at night, an event with crowds. You need guards, patrols or systems from a business licensed under Law 2518/1997.
• Cyber security only: email fraud, encrypted files, leaked customer data, a review of your network. You need IT and information security specialists.
• Both: cameras, recorders, access control or alarms connected to the network or the internet, data rooms, server rooms. Here, ask both sides to agree in writing who does what.

OVIT is a physical security company: guarding and patrols, with the Guardly platform giving one live picture of patrols, incidents and reports. We are not a cyber security company: if your systems are on the network, that side needs its own owner.

• To the security company: what is your operating-licence number? The law requires it on the company’s documents (art. 4 §1α). Which work-licence category do the people you send hold — A for guarding, B for installing and monitoring systems?
• To the cyber security company: which systems will you review, by what method, and what written result will I get? If you cite a certification, what is its scope?
• To whoever installs cameras or access control: who keeps the administrator accounts, how are default passwords changed, who installs updates, how does remote access work, and who shuts it off when the contract ends?

A company that says it “does everything” is not a reason to choose or reject it. Ask it to show which part it does itself, under which licence and with which people.