Civil-unrest indicators should change the site assessment before they change the guard force.

A protest call names the road used by your day shift. The monitoring team raises its colour. The site manager asks for more guards. That sequence feels decisive because the visible measure has produced a visible response. It leaves the changed route, late relief and blocked delivery outside the decision.

The indicator has altered an assumption in the last site assessment. That is where the response should begin. A guard increase may follow, but only when the revised sequence shows which actor, access point and protection requirement it addresses.

Give every indicator a decision and a clock. A colour without a decision becomes a request to worry harder. Record the observation, the operating assumption it may change and the last decision it can still inform. Add the corroboration rule and an expiry condition.

Use three working bands. Formal commitments support days-scale preparation. Converging participation and tactic changes support hours-scale revision, sometimes out to roughly one day. Scene violence supports minutes-scale action against the actor and place involved. Your alert should name its band because the assessment product must fit the time available.

Use formal notices to fix dates, then verify reach. A filed notice is useful because somebody has committed to an action and time. It still says little about suppliers, commuters or staff who cannot cross a picket. Treating the notice as a forecast of scale causes unnecessary closure or inadequate preparation.

In Australia, Fair Work Act 2009 section 414 requires 120 hours’ notice for protected action concerning a proposed multi-enterprise agreement and otherwise three working days. That jurisdiction-bound floor can anchor roster and delivery decisions in Australia. Confirm the notice through the official record. Then seek separate evidence of the site dependency through union instructions, transport participation, picket plans or supplier confirmation.

The reassessment question should be narrow: can the planned shift, delivery or emergency route still operate at the notified time? Set the deadline before rostering, dispatch or access decisions become irreversible. ISO 31030:2021 controls may also need revision when the same route carries travellers.

Use convergence for the hours band. Online volume fails because repeated copies can make one claim look independent. Crowd size also misses interaction changes. A 2022 study built city-day measures across 24 cities in five countries and found that violence and later protest size had non-linear relationships. The operational lesson is limited but useful: interaction adds information that a headcount cannot.

The shorter-window evidence is equally conditional. Research on the 2015 Baltimore protests trained a classifier on 4,800 hand-coded tweets, applied it to 18 million tweets and compared hourly rhetoric with later hourly arrests. The study also ran three experiments, while warning that arrests were an imperfect proxy and the factors were insufficient for violence.

Require language to converge with behaviour. Look for separate organising nodes adopting tactical instructions, counter-groups arriving, an agreed route being abandoned or material being prepared for obstruction. Record the earliest change. Your field-verification deadline is the last point when route, access or staffing can still be revised.

Keep the minutes band actor-specific. A generic escalation order encourages guards to treat proximity, helmets or isolated pushing as hostile intent. General Comment No. 37 paragraphs 19–20 require credible evidence of likely, planned or imminent violence tied to particular participants. Only manifestly widespread violence changes the character of the whole assembly.

Use observable acts: repeated targeted projectiles, ignition, forced entry, coordinated assault or a barricade that has closed the route. Pause the affected arrival. Move exposed staff behind the selected refuge line. Secure the hazardous process. The remaining minutes are for executing an existing control, not commissioning a new barrier plan.

Crowd-control equipment can create another sequence through panic, compressed egress or indiscriminate effect. UN guidance specifies impact-projectile accuracy within a 0.1 metre diameter at designated range. That exact performance condition shows why a general order to equip or reinforce guards cannot substitute for an actor-specific requirement and authorised operating limits.

Treat curfews and shutdowns as operating changes. A curfew has a start, scope and enforcement condition. A shutdown affects contact, payments, dispatch and visibility. Neither measure supplies a reliable direction for street violence, so using either as a severity multiplier hides the work your site actually needs.

OHCHR’s 2022 report recorded 225 shutdowns during public demonstrations over 2016–2021. That history supports communications planning, not a violence forecast. Test the published curfew against each shift and route. Treat network failure as a zero-lead communications condition and verify check-in, alarms, cashless payments and emergency contact fallbacks.

Recommission the changed assumptions only. A full walk-through sounds thorough, but it spends scarce time on doors and systems the indicator has not touched. The delay is worst in the hours band. Broad language also lets the assessor return observations without answering the live decision.

Write the question before fieldwork. Name the affected boundary, assets, operating mode, adverse event, intended decision, authority, recipient and deadline. ASIS SRA:2024 places context and planning before identification, analysis and evaluation. Preserve that gate even when the commission is short.

Match the product to the clock. CISA’s dated 2023 SAFE fact sheet describes a screening visit taking a few hours, built around a walk-through and discussion. It does not establish that a few hours support performance testing or quantified residual risk. State whether the deliverable is a verified exception note, revised path analysis or full reassessment.

Build fieldwork from the old evidence. Starting with a blank checklist loses the exact assumption that fired the review. Use the prior report, plans, access records, rosters, incidents and change history as the baseline. The US Department of Energy’s 2016 guide begins document review during planning and uses it to verify tours, interviews and briefings.

Give each collection task an expected source, method, assessor, timing and validation route. DOE 473.3A guidance treats tours, interviews, observations and performance tests as selectable activities. Choose what answers the written question. Performance testing needs separate authority and safety controls because DOE describes it as the most labour- and time-intensive collection activity.

Trace each observation through a credible sequence. A photograph labelled “blocked gate” cannot support a decision when nobody can establish its place, time or operating state. Give every new observation a location or asset reference, date and time, operating condition, source, assessor and confidence. Copies of one post remain one source.

Then state the sequence. The organiser changes the route; vehicles collect outside the loading gate; relief staff cannot enter; the hazardous process keeps the outgoing shift on site. Link each step to evidence and the required protection outcome. IAEA Nuclear Security Series No. 40-T shows how two outer alternatives and four inner alternatives create eight paths. Your site may need less modelling. IAEA TECDOC-1868 says a simple layout may need none.

Validate facts without transferring the conclusion. Site staff will dispute times, access conditions and normal practice. Ignoring them leaves avoidable errors. Negotiating every conclusion produces a report that records agreement instead of assessment.

DOE’s 2016 protocol uses three validation stages: on-the-spot, daily and summary. Record the disputed fact, site response, added evidence, assessor disposition and any change. A 2017 study of 20 security experts rating 45 scenarios found only 13.8%–20.1% agreement, with persistent bias in 14 experts. More opinion does not settle a weak evidence chain.

The assessor corrects the gate, time or procedure when evidence warrants it. The assessor also retains the supported conclusion and states remaining uncertainty. Your decision owner then accepts, treats or transfers the resulting exposure through the normal authority.

Close the alert against the decision. Stale indicators make every later action appear corroborated. Expire a notice when its action ends, an online call when it produces no commitment, and a route deviation when movement stabilises. Record negative evidence too, including working liaison, steward control and a reopened route.

The final note should show which assumption changed, what fieldwork established, which sequence and requirement followed, and who decided by the indicator’s useful deadline. If the finding supports more guards, the order now has an actor, task, access point, authority and review condition. If it supports a route change or delayed shift, you can act without buying a security measure that answers the wrong question.