How to Select a Private Security Firm: Vetting Criteria for Governmental Buyers

The private security market contains a wide range of providers — from Tier 1 operational firms with genuine military and intelligence pedigree, to companies with no verifiable operational background that have built a credible marketing presence. For a governmental or diplomatic buyer, the consequences of the wrong choice extend beyond poor service: an unvetted operator is a security liability. A firm with non-transparent ownership is a compliance risk. Equipment from unscreened supply chains is an operational exposure.

This guide covers the five criteria that matter in a formal evaluation.

1. Vetting Documentation

The first and most fundamental question: how does the firm vet its operators, and can that process be documented? Vetting documentation should include a written vetting policy specifying screening tiers, disqualification criteria, and renewal cycles; evidence of background checks, prior-employment verification, and criminal and civil records review; and a continuous vetting cycle — not a single check at hire.

Ask for the vetting policy as a written artifact. Ask for confirmation that the specific operators who will be deployed have been vetted under that policy. Firms that cannot produce documentation are not in the conversation.

2. Ownership Transparency

Ultimate beneficial ownership must be declared and sanctions-screened. For governmental and defence engagements, the ownership chain must be documented to a level a compliance officer can defend. This is not a bureaucratic formality — it is a security requirement. Adversary-aligned beneficial owners can use a European-branded operating company to access sensitive environments and information. Suppliers who decline to provide the ownership chain are not acceptable.

3. Supply-Chain Discipline

Equipment, software, and subcontracted personnel inherit the engagement's compliance posture. A vetted firm with unvetted subcontractors or equipment from an adversary-origin supply chain creates an unvetted engagement. Evaluate the firm's subcontractor policy, equipment provenance documentation, and supply-chain screening process. For communications equipment and technical detection systems in particular, country of origin and firmware provenance matter.

4. Operational Pedigree of Named Personnel

Pedigree claims require verification. "Former military" is not a credential — former military from what branch, in what role, with what clearance, with what post-service career? A close protection contract for a diplomatic mission requires operators with demonstrable CPO experience in similar environments, not generic security industry CVs. Ask for named operators, their service histories in outline (consistent with any NDA obligations), and the basis for any claimed clearance status.

Mission Support provides operator pedigree information at the level permitted under the engagement's confidentiality framework. Buyers who cannot get this information in any form should treat that as a disqualifying indicator.

5. Continuous Threat-Assessment Posture

A firm that does not continuously assess the threat environment is providing a historical service, not a current one. The threat assessment should be updated before every deployment, integrated into the protection planning process, and reviewed whenever the principal's circumstances or the operational environment changes. Ask how the firm's threat assessment process works, who produces it, and on what basis.

Red Flags

• No verifiable operator pedigree — claims without evidence
• Ownership chain not disclosed or partially disclosed
• Equipment sourced from sanctioned-country supply chains without a clear provenance waiver
• No documented vetting policy or one that covers only criminal checks
• Pricing substantially below market — often an indicator of unvetted subcontracted labour
• Reluctance to provide references from comparable governmental or diplomatic engagements