A terrorism indicator matters only if the site's detection-and-delay chain can act before impact.

A staff member reports a visitor returning to the same service gate. The visitor asks which camera covers the loading area and watches a delivery arrive. The report reaches the security inbox after the visitor has left. Everyone has done what the awareness briefing required, but nobody yet knows whether the site can act in time.

The failure sits between warning and interruption because a report can describe preparation while leaving no usable response time. A sensor can operate while its alarm waits for assessment. A barrier can be strong while the response starts too late to benefit from it. Reporting, detection and delay therefore need one clock.

Describe conduct before drawing an inference. Appearance, belief and lawful presence supply no operational link to preparation. They also divert assessment capacity into reports that cannot support a defensible decision.

Record what the person did, where, when and against which security function, including the object of interest, questions asked, duration, recurrence, staff response and plausible purpose. NPSA identifies three information sources for hostile reconnaissance: people, places and websites. A sequence may cross all three without producing an alarming act in any one channel.

Photography alone carries little weight, so treat observation as preparation evidence when it is purposeful, specific and difficult to explain innocently. Persistent focus on non-public detail, repeated questions about vulnerabilities or tests of staff response can meet that threshold. US suspicious-activity guidance uses the conduct and circumstances that would cause a reasonable person to suspect terrorism or criminality.

Keep disconfirming facts in the record because a repeated device or question can strengthen the connection. A documented delivery survey can weaken it. Neutral detail lets the assessor reverse a reporter’s inference instead of inheriting it.

Assign one of three lead-time classes. A generic priority label says how worried the receiver feels. It gives no answer about how much decision time the evidence may preserve.

Call early target research strategic, resource acquisition or detailed preparation operational, and rehearsal, security probing or confirmation of current conditions immediate. Record the observed facts, confidence, missing evidence and earliest defensible observation beside the class. Your response matrix should state what each class changes and who accepts uncertainty when the observation cannot be corroborated. The class should change when new evidence compresses the likely clock.

Historical figures show why the bands cannot become countdowns. One NIJ-sponsored study assembled 118 environmental and 55 international attacks, yet only 38 cases supported temporal analysis. International cases began planning four to six months before attack, while eighty-five per cent of environmental cases with timing data planned within six days.

A related small and unrepresentative sample found a general three-to-four-month planning pattern and a preparatory act on the incident day in 65.2% of measurable cases. Another 9% had the last known act one day before, so carry those sample limits whenever the percentages appear.

Start the clock at recognition. A later investigation will find acts that staff could not observe or reasonably interpret at the time. Crediting those acts gives the warning system lead time it never possessed.

Measure from the first defensible observation to the decision that observation enabled. START’s validation examined 48 terrorism cases and found 255 pre-operational indicators, of which only 121, or 47%, were observable. Of those, 72, or 59%, had actually been observed or reported. Report volume cannot repair that observability limit.

The decision must fit the band, because a strategic indicator may justify preserving records, reducing exposed detail, reviewing coverage and setting a reassessment condition. An operational indicator may justify faster corroboration, changed access arrangements and confirmed responder availability. An immediate indicator may require the site’s predetermined emergency action while assessment continues.

In the European Union, Article 9 of Regulation 2019/1148 requires suspicious precursor transactions and significant thefts or disappearances to be reported within 24 hours. National contact points must be available 24 hours a day, seven days a week. That statutory clock starts after suspicion forms and promises no remaining warning time.

Separate sensing from completed detection. Sites often start their response calculation when a contact changes state or a staff member submits a report. The signal still has to reach somebody who can assess it.

IAEA Nuclear Security Series No. 27-G describes a four-step alarm path in which a sensor activates, initiates a signal, reports the alarm and receives assessment. The first three steps constitute sensing, while assessment completes detection. A terrorism report follows the same practical boundary when routing, queueing and corroboration delay the decision.

Measure each interval by capturing observation to submission, submission to receipt, receipt to assessment and assessment to dispatch. Recorded video can support assessment, but an unwatched image has made no response decision. For covered US nuclear facilities, 10 CFR 73.55 requires concurrent alarm annunciation and video display in at least two continuously staffed on-site alarm stations. That sector rule shows how much design can sit between a camera and a response.

Test delay against the remaining clock. A barrier certificate describes the component under stated conditions. It does not show that a capable responder reaches the protected objective before impact.

Start at the earliest effective sensing opportunity, then subtract transmission, assessment, communication, mobilisation and movement. Credit doors, zoning and asset enclosures only for delay preserved after that point. IAEA Nuclear Security Series No. 40-T calls the last sensing opportunity that still permits interruption the critical detection point.

Delay succeeds when it preserves more time than assessment and response require. Measures beyond the critical detection point may still protect an asset, but their delay cannot rescue a response initiated too late. A fast sensor linked to slow annunciation creates the same failure at an earlier layer.

Use the actual response provider in the calculation, which IAEA guidance says may be the operator, private guards, local or national police, or military units. Those options have different notification, mobilisation and travel paths. You should be able to find both elapsed times in the same exercise record: usable warning and the complete interruption chain. A planning assumption belongs in the test record until a timed exercise replaces it with evidence.

Carry uncertainty into the action. A shrinking clock creates pressure to turn ambiguous conduct into certainty. That can misdirect responders and strip useful context from the hand-off.

State location, current behaviour, prior links, feasibility, corroboration and confidence while preserving contradictions and a plausible innocent purpose. Then select the least disruptive action that can still protect the objective within the remaining time. Immediate action can be proportionate without diagnosing the person who generated the signal.

Give the assessor a deadline tied to the site’s interruption requirement and give the responder the observed sequence rather than a label. Strategic, operational and immediate classifications should travel with the report, because a late confirmation signal and early target research cannot wait in the same queue. Your hand-off should also state when the evidence was last checked.

Restore the whole chain after resolution. A reset clears an alarm state, while repair and recovery create temporary gaps that can survive unnoticed after the incident closes.

Preserve the original observation, report versions, access decisions, alarm history, video and response messages under the site’s evidence and privacy rules. NIST SP 800-53 Rev. 5 control PE-6 links physical-access monitoring with incident response and leaves review frequency and video retention organisation-defined.

Place a compensating guard or alternate barrier around damaged protection, then disable implicated credentials and record temporary access changes. Repair the device, then test sensing, transmission, annunciation, assessment, communication and response routing end to end. For covered US nuclear facilities, an intrusion alarm used continuously must be tested at least once every seven days under 10 CFR 73.55.

The security owner should accept the repaired chain before temporary controls are removed. Reconcile retained evidence, work orders and incident records. Your warning system has worked when credible behaviour changes protection early enough for the site to interrupt the sequence, and the restored chain can prove it will do so again.