Everybody wants to be a PSIM

Date: 07.11.2011

Two years ago almost no-one in the UK had heard of PSIM far less knew what it was. I was introduced to the concept around this time by a strategic security consultant whilst bidding for a regional assembly building. Now it's the new buzz technology and every access control and video management system wants to be tarred with the PSIM brush.

Part of the problem is the phrase behind PSIM. After all what does Physical Security Information Management actually mean, and what self respecting piece of security software couldn't claim to help you manage your physical security information?

PSIM is also slightly limiting because the scope of the software need not be limited to Physical Security. If you invested in this software, wouldn't you want to use it to report on attempts to defeat your logical security, or issues that affect your 'security' in the wider sense, such as health and safety breaches that could lead to big fines, repetitional damage or lost contracts?

The concept as it was originally explained to me was far more than just a security management system. The key distinguishing feature of PSIM is that the system itself could be used to develop and document an organisation's security procedures. When an incident occurs the system guides the operator through an interactive workflow, asking questions and responding to the answers, and this workflow is actually developed using the software.

The principle aims of PSIM as I see them are:

• To provide a common platform into which information is automatically fed and processed in accordance with pre-defined rules
• To collate that information and present to users in a way that makes sense. In other words if two or more alarms are related then the system should present them as a single situation so that they can be managed accordingly
• To ensure that decision making is aligned with corporate policies, procedures and values (difficult when the decision-maker is under pressure and the procedure is at the back of a 200 page book.)
• To facilitate effective communication. Your PSIM system should ensure that the right people have the right information at the right time, from operators to managers to the board
• To log all actions and decisions in an auditable format

What would this look like in operation?

ALARM 1 - An external intruder alarm is received on a relatively low risk section of the perimeter. The system identifies that this is in a low security area of the site, and that this specific alarm has been raised a number of times recently due to wildlife. The system is programmed to raise a low priority incident (POSSIBLE INTRUDER) which the operator notices but does not action.

ALARM 2 - The guard tour system identifies that a guard failed to check in on time, in the same area. Normally this might raise a medium priority incident but because of the perimeter alarm this is immediately more suspicious.

The system logs this as an update to the POSSIBLE INTRUDER incident, and raises the priority of the incident to HIGH. The operator opens the incident and is asked whether there is anything suspicious on the CCTV footage from the intruder alarm. He checks and answers yes.

At this point the threat level for the site is raised to SEVERE, and notifications are sent to the head of security and the Plant Manager. Note that the SEVERE threat level impacts how other sensor inputs are treated.

The operator is asked if he wants to notify the response team. He answers yes. A contact list is displayed. The operator selects 'notify all'. Messages are sent to each responder requiring a response.

The incident continues to play out with the operator free to take decisions within predefines parameters. Everything the operator sees and does is recorded for later review.

If all of the product offerings currently being touted as PSIM can accomplish that level of management then they have earned the right to use the acronym "PSIM". Whether PSIM is the right label to apply to this class of software remains open to debate.

Go Back