The skills matrix for security teams

Content aligned to the Capability Guide PDF for this topic. Q2 2026 refresh.

Why do security teams need a skills matrix?

For cyber security roles, DSIT labour-market analysis is the primary UK evidence base for skills pressure (Department for Science, Innovation and Technology, 2024). Security fails at its weakest function, not its average. A strong guarding operation with a thin incident-response bench—or sharp CCTV cover but no cyber awareness—is only as protected as the lowest dial on the board.

Managers often judge readiness by impression after walk rounds. That misses lapsing licences, overnight control-room gaps, and converged threats that need digital literacy on the front line. A matrix shows readiness function by function before an incident tests the chain.

What is a security skills matrix?

A security skills matrix maps officers, controllers, and specialists against each function the operation depends on: manned guarding, patrol, control room and CCTV, access systems, incident and emergency response, investigations, customer conflict, and cyber and information-security awareness. Each cell is 0–5 with Level 3 as unsupervised delivery on a live shift or incident.

Read columns as readiness dials. A team average can look adequate while incident response sits in the red—exactly where converged threats strike.

What is the required floor, and why is Level 3 the usual line?

Level 3 means the person can perform the function unsupervised to contract and regulatory standard—handle an alarm stack, complete a patrol route, run a first-response procedure, or recognise and escalate phishing without a supervisor shadowing. Licences and certifications must be current; a lapsed SIA card is not Level 3 regardless of past experience.

Is being below the floor a failure?

No. Trainees and new controllers should show supervised levels until sign-off. The matrix assigns buddies on shifts and targets licence exams with dates—especially when onboarding agency cover.

What does function-by-function readiness look like?

Guarding looks green; incident response and investigations do not. Overnight control room has two Level 3+ staff—one absence away from blind spots. Cyber awareness is rising but still thin for a virtualised estate—priority for cross-team training, not only IT.

How should a security manager use the matrix at shift handover?

Confirm each critical function has Level 3+ cover for the incoming shift band, not just day shift averages. Flag licence expiries in the next thirty days. Pair below-floor staff with named mentors on posts they may not run alone.

What does the matrix protect?

• Continuity — 24/7 cover on each critical function.
• Compliance — licences and refreshers visible beside skill.
• Converged defence — physical and cyber skills on one picture.
• Assurance — evidence for clients and regulators before tests become incidents.

How do you run the first calibration session?

Use drill reports and real incidents (sanitised) to agree Level 2 versus Level 3 on response and control-room tasks. Include a cyber lead even if small—define front-line escalation behaviours at Level 3.

How do you evidence a level?

• Drills and exercises — observed performance with dates.
• Licence and certificate registers — linked to rows.
• Supervisor sign-off — after shadow shifts on posts.
• Post-incident review — confirming sustained competence.

What mistakes break security matrices?

Team-average scoring. Read each function; weak dials hide in totals.

Ignoring licence expiry. Skill without currency is not deployable.

Cyber as “IT only”. Front-line awareness columns matter.

Day-shift-only cover counts. Score each shift band.

Agency assumed competent. Score against your site standard on day one.

Static matrix after incidents. Re-score when drills fail or tools change.

What should your first 30 days look like?

Week 1: List functions and floors. Week 2: Score team; attach licence dates. Week 3: Calibrate response and control room. Week 4: Fix overnight gaps and recruitment for red dials.

How do agency and float pools fit?

Agency rows show today’s deployable cells only. Edge case: an officer Level 3 on guarding at your site may be Level 1 on your access system—do not assign integrated alarm tasks without sign-off.

Which functions belong on a layered security matrix?

Map what you operate, not every skill in a generic security CV. Guarding and patrol: access control at door, search procedures, conflict management, and customer-facing de-escalation. Control room: CCTV monitoring, alarm handling, radio discipline, log quality, and handover to response. Access and systems: visitor management, biometrics, integrated alarms, and basic troubleshooting. Response and investigation: first aid, incident command, evidence preservation, and liaison with police or regulators. Cyber and compliance: phishing recognition, data handling, security culture reporting, and policy attestations.

Integrated estates blur lines: a front-line officer may be the first person to spot a tailgating or social-engineering attempt. A baseline cyber column at Level 3 for “recognise and escalate” is cheaper than assuming IT will always be on site.

Licence tracking sits beside score: SIA and similar credentials with expiry dates trigger automatic review tasks. A Level 4 skill with an expired licence deploys as zero until renewed—hard rule, no exceptions on client sites.

How do you brief the board or client without alarm theatre?

Show the dial cluster: green, amber, red per function with trend arrows quarter on quarter. Pair each red dial with one remediation—hire, train, relicense, or change shift pattern—and a date. Avoid team-average percentages; they reassure while response sits exposed.

After incidents, update descriptors before scores. If a drill failed on radio discipline, Level 3 language for control room should reference the failed behaviour explicitly so retraining targets the gap.

How do you integrate the matrix with client reporting and KPIs?

Client reports should reference function readiness, not guard hours alone. If incident response is amber, SLA language on “response within X minutes” is at risk even when guarding is green. Tie remediation plans to contract review dates so commercial teams do not promise cover the matrix cannot support.

Major event cover (stadium, festival) needs a temporary matrix tab: columns for crowd management, search, and comms with daily coverage counts during the event. Archive after close-down for lessons learned.

How should clients and regulators see readiness evidence?

Export quarterly PDF snapshots of function coverage with trend arrows and remediation owners. When clients audit, sample individuals from green functions first, then request evidence bundles matching descriptor text. Regulators care that lapsing licences were visible before deployment—dated matrix rows prove diligence.

Insurance renewals for liability cover sometimes ask how supervision is assigned when response columns are amber—attach roster rules linked to the matrix.

How do control rooms and guarding supervisors share one evidence standard?

Descriptors must reference the same incident taxonomy: what “good” radio discipline sounds like, what a complete log contains, how escalation times are measured. Joint calibration quarterly prevents control room and site supervisors scoring the same person inconsistently on customer conflict.

Relief and float pools need snapshot rows each Monday: which functions they may cover this week after licence check. Permanent staff keep continuous rows; float staff may be archived between contracts.

Client audits increasingly ask for competence evidence, not headcount. Export coverage rows with dates for quarterly business reviews; pair with drill schedules showing planned versus completed exercises per function.

Which site tools help security teams run a matrix?

• Upleashed 0–5 methodology
• Descriptor generator
• Minimum standards of capability
• IT and technical support matrix guide
• Skills audit checklist
• Capability gap ROI calculator

How should you score skills on the 0–5 scale?

Define each level in observable behaviours before anyone scores. Weighting and full definitions live on the 0–5 scale guide; industry matrices use this summary table.

Capability percentages use Upleashed weightings (Level 1 = 25%, Level 2 = 50%, Level 3 = 75%, Levels 4–5 = 100%; Level 0 excluded). See competency scale 0–5 explained for the full framework.

See the methodology pillar and descriptor generator for role-ready wording.

Where should you go next on this site?

Download security.pdf for workshops and calibration. This page adds worked examples and implementation notes the printable guide does not include.

The methodology pillar documents the Upleashed 0–5 framework used across 106.5M+ assessments. Pair it with the descriptor generator so raters share one definition per level.

For a pre-wired grid (required levels, coverage row, capability averages), open the Excel Skills Matrix Template (£199). Scale beyond Excel when you need continuous evidence — PulseAI automates the same 0–5 method.

Tag minimum standards separately from development skills so roster managers and auditors read the same grid.

How do you exercise the matrix during exercises and audits?

Tabletop exercises assign roles from coverage rows; thin command columns should produce documented remediation, not heroic improvisation. Spot checks on licence currency must match the grid on the day sampled.

Technology migrations need descriptor updates before cutover; dual-score periods with dated cell notes are acceptable until stable. Client QBRs should show function trends, not guard hours alone.

Major events need temporary tabs with daily coverage counts during the event, archived for lessons learned. Float pools get Monday snapshot rows after licence check.

How do you avoid turning the matrix into a disciplinary list?

Publish that scores drive allocation and training, not automatic discipline. Supervisors may not reduce scores without new evidence. Appeals go through calibration committee with descriptor citation.

Tabletop exercises should assign roles from matrix coverage: if incident command column is thin, the exercise expects failure and documents remediation. Do not staff exercises only with strongest guards while claiming representative readiness.

Regulators and clients may sample individuals—scores must match observed performance on the day. Spot checks on licence currency should match the grid; discrepancies trigger immediate row correction and root cause on who let currency lapse.

Technology changes (new VMS, access platform) require descriptor updates before migration weekend; temporary dual-score periods are acceptable with dated notes in cells until cutover completes.

What governance keeps scores trusted?

Shift handover should reference control-room and response coverage for the incoming band; outgoing supervisors sign that counts were accurate, creating a paper trail for regulators.

Mobile patrol routes can include competence checks—random spot assessment against descriptor—so scores reflect current practice, not last year’s course.

Integrated estates should score visitor search and reception together when the same team performs both; splitting prevents false green on one column while the other stays exposed.

Annual leave planning should check coverage rows for the leave week before approval, especially for incident response and control room. Treat leave approval without cover as a operational risk decision, not an HR formality.

Operations owns the matrix; HR supports discipline policy alignment. Monthly ops review adjusts scores from drills; HR joins only when conduct issues overlap. Clients receive function coverage trends, not individual names, unless contract requires named supervisors.

Union consultation may require clarity on allocation use. Publish appeals and recalibration paths before go-live.

Post-incident reviews that find human performance factors must update descriptors or scores within five working days, or the matrix becomes disconnected from reality. Controllers and site managers should not debate readiness without opening the same grid.

Cyber exercises count toward cyber-awareness columns when they test recognisable behaviours—phishing reporting, USB policy, tailgating response—not only annual e-learning completion.

Review contractor rows at every contract renewal; expired scope must zero deployable cells until re-assessed on site by a named supervisor.

Frequently asked questions

Should cyber skills sit on the same matrix as guarding?

Yes for converged operations. Baseline awareness and escalation at Level 3 should be visible so managers see the weak dial.

How do we score control-room cover overnight?

Count Level 3+ operators per critical function per shift band. Day strength does not excuse overnight exposure.

What evidence supports Level 3 on incident response?

Observed drills, post-incident reviews, supervisor sign-off, and refreshers within policy—with dates beside scores.

How many functions should we map?

Six to ten covering what your contract delivers—do not map theoretical tasks you never staff.

Can subcontractors appear on the matrix?

Yes, with employer labels and today’s deployable cells—not generic agency grades.

How often should security managers refresh scores?

Monthly for licence-driven roles; quarterly for stable teams; immediate re-score after failed drills involving performance.