Security assignment instructions: what must be in them

Two security officers passing each other at the entrance of a British red brick commercial building on a wet morning
The instructions are what the incoming officer inherits, and the officer going off duty is rarely still there to explain them.

BS 7499 and BS 10800 came into effect in new editions on 31 August 2026, and BSI withdrew the 2020 editions the week before. If your assignment instructions carry a header line saying the company works to BS 7499:2020, that line now names a withdrawn document.

In brief: BS 7499 and BS 10800 were reissued on 31 August 2026, and BSI lists updated assignment instruction recommendations among the key changes. This article covers who actually requires these documents, what belongs in a set, and the public inquiry finding that drove the revision.

The static guarding code of practice was reissued on 31 August

BS 7499:2026 and BS 10800:2026 came into effect on 31 August 2026 and supersede the 2020 editions, which BSI withdrew on 24 August. Both were prepared by committee GW/3. BS 7984-3 for mobile services was left alone, so this was a targeted replacement of two documents rather than a rebuild of the family.

The new static guarding code supersedes BS 7499:2020, "which is withdrawn", is "a full revision of the document", and is aligned with BS 10800:2026 with the intention "that organizations follow the recommendations of both".

The revision ran as BSI project 2023-00988, with the draft open for comment as 25/30473818 DC from 2 December 2025 to 17 February 2026. Publication carries no announcement: the code enters the catalogue and the old edition changes status.

Two entries in the change list matter here. BSI names "Updated assignment instruction recommendations" and "Enhanced site record requirements" among the key changes, and the contents list carries Assignment instructions at 6.3, matched in BS 10800:2026 at 9.6.

BSI does not publish the text. Clause 6.3 sits behind a paywall, so the honest statement is that the recommendations changed, not what they now say. Anyone who tells you more than that has bought the standard or is guessing.

The SIA has already moved, without sending a notice

Its BSI order form was updated on 2 September 2026, two days after publication, and now carries an edition date of 2026 against both BS 7499 and BS 10800. It prices BS 7499:2026 at £166.00, or £116.20 with the 30% discount the regulator negotiates.

No notice went out, and none was needed, because the schemes cite these standards without a year. The SIA guidance page lists "BS 10800: Provision of Security Services" and "BS 7499: Provision of static guarding security services" with no edition date, and states that following the British standards is a condition of approval. The workbook behind it maps BS 7499 to security guarding, again without a year, and tells applicants they "must work to the code(s) of practice listed". SSAIB requires companies "to meet BS 10800, plus the relevant sector specific standards e.g. BS 7499, before certification can be granted".

No published transition period could be found at any of the three. That is a search result rather than proof that none exists, so ask your own certification body. What the undated citation does mean is that no scheme document has to change for the 2026 text to become the reference point.

Copy the schemes in your own documents and cite the standard without a year. A dated header line goes stale in silence, and it is among the first things an assessor reads.

Statutory duty, code of practice, certification requirement

Three separate obligations sit behind one document, and only the third one names it. No UK statute requires assignment instructions. The codes of practice recommend them in the language of should. The certification schemes require them in writing for every contract. Treating all three as one obligation is how suppliers end up documenting the wrong things.

The statutory duty is general. The words instruction and assignment appear nowhere in the Private Security Industry Act 2001. Section 2(2)(c) of the Health and Safety at Work etc. Act 1974 covers "information, instruction, training and supervision", and regulation 10 of the Management of Health and Safety at Work Regulations 1999 requires "comprehensible and relevant information" on risks, preventive measures and emergency procedures. Neither names this document; assignment instructions are how the industry discharges those duties on a site.

The code of practice recommends. BSI's foreword says the standard "takes the form of recommendations and guidance" and is "not to be quoted as if it were a specification", that users may substitute practices of equivalent or better outcome, and that a deviation should be justified.

The certification scheme requires. The guidance to indicator 2.1.1 calls assignment instructions "the minimum requirement for approval against the ACS standard", and continues: "there should be clear, accurate and up to date assignment instructions in place for all contracts. Verbal communication only is not acceptable for assignment instructions." Indicator 6.2.4 sets the required level for site induction as given verbally "and is supported by documented assignment instructions". Approval is voluntary; the requirement is not, once you hold it. Our guide to the SIA Approved Contractor Scheme covers the assessment itself.

Why the standards changed: the Manchester Arena Inquiry

BSI says so on the product page. The revision of BS 10800 "strengthens the standard in response to lessons identified from the Manchester Bombing Report recommendations and emerging Protect legislation", and BS 7499 was revised alongside it. The report never mentions assignment instructions, but it examined what they settle.

The explanatory notes to the Terrorism (Protection of Premises) Act 2025 cite the same report, but that Act binds venue operators, the subject of our articles on Martyn's Law and its cost. Assignment instructions bind the supplier on every site.

One line on a check sheet, read two ways

The source is Manchester Arena Inquiry, Volume 1: Security for the Arena, Sir John Saunders, HC 279, 2021. The venue operator, SMG, gave the guarding contractor, Showsec, a check sheet requiring a pre-egress check of the "entire City Room area". Its facilities director read that as "wall-to-wall in all directions"; the contractor read it as the stairs, and a joint review in 2015 never surfaced the difference (6.214 to 6.220).

Saunders concluded that "by agreeing to complete the pre-egress check sheet, Showsec was under an obligation to carry out a security patrol of the mezzanine", and placed the failure on the company rather than its officers (6.225). The document created the obligation; nobody checked that both sides read it alike.

The seam shows again in the patrols. A route recorded by "an electronic clocking system" covered that area, but not on event days, when the team responsible assumed the contractor covered it (6.211, 6.212). BS 10800:2026 now lists "Stronger consideration of other service providers during operations and emergencies" among its key changes.

One limit, stated plainly: the Inquiry made no recommendation about assignment instructions, and the passages above are findings, not monitored recommendations.

What belongs in a set of assignment instructions

Start with what the standard calls the document. BSI defines assignment instructions as "operational documented information detailing site-specific contractual duties", and notes that the document "can be either a hard copy or an electronic copy". For the sections themselves, the most usable public list is the SIA's, in the guidance to indicator 2.3.1 of its workbook.

The same preview defines a competent person as one "suitably trained and qualified by knowledge and practical experience, and provided with the necessary instructions": in the logic of the standard there is no competence without the instruction. The section list is introduced with may include rather than must, so it is a structure, not a compliance checklist. The names are the SIA's; the gloss is ours.

  • Review and amendment record, and an acknowledgement form. Which edition is in force here, and what changed.
  • Company details and procedures. Who to call, and the escalation route.
  • Operational duties. Posts, rounds, checkpoints, timings, access control, and what gets recorded where.
  • Standard instructions for security officers. Uniform, timekeeping, and the limits of the role.
  • Prime objectives of the officers. What this contract protects, so a decision at 03:00 has a reference point.
  • Health and safety and evaluation procedures. Site hazards, controls, and lone working.
  • Emergency procedures. Fire, medical, intruder, bomb threat and evacuation, with routes and names. Regulation 10 reaches this part most directly.
  • General items. Service defect reporting and customer care guidelines.
Security officer standing in a back-of-house corridor holding a closed black site file, facing a steel fire door
A set of instructions is usually read once at induction and then only when something has already gone wrong.

The guidance to indicator 2.4.2 adds what clients look for inside those sections: purpose, aim and objectives, appearance, timekeeping, attitude and cooperation, efficiency of duties, and supervisory visits. Under good practice at 2.3.1, one line outweighs the rest: assignment instructions "are developed in conjunction with the customer and signed off by the customer". Read that against a sheet written by one party and interpreted by the other.

No list tells you whether a section survives two readers. Five questions do, and each has a source outside our own opinion.

  1. Whether it is mandatory or discretionary. Indicator 2.1.1 requires processes that "are reliably followed" and have standards of performance that can be assessed. A task written as an expectation cannot be assessed.
  2. What area it covers, in words two readers cannot split. Name the levels, the stair heads and the boundaries. A phrase that reads as obvious to whoever wrote it may not to whoever walks it.
  3. What the officer is looking for on that round. Those checks "ignored almost entirely the terrorist threat" and looked at exit routes instead.
  4. Who performs it when the other provider does not. This is the gap BS 10800:2026 addresses with its stronger consideration of other service providers, and it is your paragraph to write, site by site.
  5. How current information reaches the officer. Indicator 6.2.4 puts site induction in writing; keeping it current is what turns a document into a briefing.

What a guard tour system does, and what it does not do

It proves a checkpoint was reached at a given time and place, and it makes a round that did not happen visible while the shift is still running. It does not settle what a task means. An ambiguous instruction stays ambiguous on a screen. It only gets acknowledged faster.

Small blank stainless steel checkpoint tag fixed to the brick pier of an open site gate at dusk
Checkpoints tend to end up where a tag is easy to fix, which is not always where the risk on that site sits.

That limit matters, because the site above had the technology. The recorded route covered the disputed area and stopped on the busiest nights, with nobody assigned to close the gap. The recording did not fail; the allocation did.

Law and standard both ask for an outcome rather than a form. The HSE requires employers to "ensure workers have received and understood" the instruction they need, and the report asks for procedures whose purpose "must be understood by those carrying them out". Neither prescribes a signature. The report puts the other half on the client, which "should have had a system in place to make sure that security patrols were taking place and being carried out properly" (8.18). That evidence is produced during the shift or not at all, and a checkpoint with the task attached puts the relevant paragraph where it applies. Indicator 5.1.1 adds version control and current versions at the point of use, which a gatehouse binder and a server file rarely both satisfy.

COREDINATE, a guard tour system, timestamps each checkpoint scan with its location, carries that site's tasks and forms to the officer's handset, flags a round that misses its window, and files the result into the Daily Occurrence Book. It does not replace the instructions: scope and ownership stay in a document both parties have agreed and read the same way.

Frequently asked questions

Are assignment instructions a legal requirement in the UK?

No statute requires them. The Private Security Industry Act 2001 does not use the words instruction or assignment anywhere in its text. The duties that apply are general: section 2(2)(c) of the Health and Safety at Work etc. Act 1974 covers information, instruction, training and supervision, and regulation 10 of the Management of Health and Safety at Work Regulations 1999 covers comprehensible and relevant information on risks, controls and emergency procedures. Neither names the document. Certification conditions are what make it compulsory in practice.

What is the difference between assignment instructions and post orders?

They are two names for the same document. Post orders is the American term and appears in US industry guidance and software; assignment instructions is the British term and the one used in the standards, in SIA documents and in UK contracts. If a client or a supplier uses post orders in a UK tender, the wording has usually been taken from an American source.

Does BS 7499:2020 still apply?

No. BSI withdrew BS 7499:2020 on 24 August 2026, and BS 7499:2026 came into effect on 31 August 2026 with a foreword stating that it supersedes the earlier edition. The same applies to BS 10800:2020 and BS 10800:2026. The SIA order form for approved contractor applicants was updated on 2 September 2026 and now carries an edition date of 2026 against both. Because the schemes cite the standards without an edition year, the current edition applies automatically, which is also why it is safer to cite them without a year in your own documents.

Do security officers have to sign for their assignment instructions?

No UK rule requires a signed receipt. The SIA lists an acknowledgement form among the things a set of instructions may include, which is a suggestion rather than a requirement, and testing staff on their knowledge of their instructions sits at improvement level 1, above the level needed for approval. The HSE sets an outcome rather than a form: employers must ensure workers have received and understood the information, instruction and training they need to work safely. How you evidence that is your choice.

How often should assignment instructions be reviewed?

The public documents set no interval. What they require is that instructions are clear, accurate and up to date for all contracts, which makes the triggers more useful than a date in a diary: a change of scope or hours, a new post or route, a new client contact, an incident, and any change in what another provider on the site is doing. Any review interval in the standards themselves is paywalled and is not quoted here.

Sources

Every status, quotation and paragraph reference above was checked at the primary source on 10 September 2026:

A set of instructions is only as good as the evidence that the right task reached the right officer on the right shift. Put one site on the 14 day test kit, attach the tasks from your instructions to the checkpoints, and look at what the records hold after a fortnight. To work through the sites where two providers share the ground, speak to our sales team.