Why Corporate Security Has Outgrown the Old Model
For most of the last two decades, "corporate security" meant a guarded lobby, a badge system, and a contract for the annual shareholder meeting. That model is no longer adequate for any meaningful enterprise.
Boards now ask General Counsels and Chief Security Officers to demonstrate, in writing, how the company protects its executives, its travelers, its events, and its workforce — and to demonstrate it against recognized standards like ISO 31030 for travel risk management.
This is the framework AMERINE uses when we are asked to design or audit a modern corporate security program.
The Six-Layer Framework
1. Governance & Policy
Everything begins with a written security policy owned by the General Counsel or Chief Security Officer:
- A clear definition of the threats the company is protecting against.
- Roles and responsibilities for HR, GC, IT, Facilities, and external vendors.
- Approval authorities for executive protection, armed coverage, and international travel.
- Reporting cadence to the audit committee or the full board.
Without a written policy, every operational decision becomes a one-off — and the company carries the risk of inconsistency in audit, litigation, and incident response.
2. Executive Protection
The program for the CEO, key executives, and board members should be defined inside the policy and operated by qualified personnel. This includes:
- Threat assessments on a recurring cadence.
- Defined protective postures by threat level.
- Approved vendors and operators (no ad-hoc hires).
- Coordination with corporate communications during high-visibility windows.
3. Travel Risk & Duty of Care
ISO 31030 has reset the bar for what a corporate travel program must document. A defensible program includes:
- A travel risk policy that classifies destinations.
- Pre-travel intelligence briefings for elevated and high-risk destinations.
- Approved in-country vendors for executive protection and transportation.
- Real-time traveler tracking through a GSOC.
- A documented incident response plan with escalation paths.
4. Workplace Violence Prevention
A modern WVP program covers more than active-threat drills:
- Behavioral threat assessment teams that pull together HR, Legal, and Security.
- Structured intake for concerning behaviors from employees, ex-employees, and customers.
- Trained response for terminations involving elevated risk.
- Coordinated relationships with local law enforcement and external behavioral assessment specialists.
5. Event & Facility Security
Annual meetings, customer conferences, executive offsites, and product launches all carry distinct risk profiles. A mature program assigns a security lead to every meaningful event with:
- Advance work on the venue.
- Access control and credentialing.
- Coordination with venue and local security.
- A medical and emergency action plan.
6. Crisis Response
The framework is only useful if the company can execute under pressure. That means:
- A defined crisis management team.
- Tabletop exercises at least annually.
- Pre-arranged relationships with external counsel, communications, and security advisors.
- Post-incident review with documented lessons learned.
What an Auditable Program Looks Like
Boards increasingly want corporate security documented to the same standard as financial controls. The minimum artifacts in an auditable program:
- The written policy.
- Current threat assessments for the executives covered.
- The travel risk classification and current intelligence sources.
- The list of approved vendors and the basis for selection.
- The most recent tabletop exercise after-action.
- Insurance documentation aligned to the program.
A CSO or GC who can produce these on a one-week notice is in a defensible position. One who cannot is exposed.
How AMERINE Helps
AMERINE designs, builds, and audits corporate security programs for public companies and large private firms. Engagements range from one-week assessments to multi-year program management. Founder Scott Jones, a former U.S. Secret Service Special Agent, personally leads program design.
Contact AMERINE for a confidential conversation with your General Counsel, CSO, or audit committee chair.
