Security Intelligence

Designing an Annual Security Programme for Private Clients | CloseProtectionHire

Q: "What is a private client security programme?"

"A private client security programme is a structured, documented set of security arrangements that covers all aspects of a private individual's security posture: their residence or residences, travel security, family security, digital security, and the protocols for responding to incidents. Unlike corporate security programmes (which are designed around an organisation), a private client programme is designed around the specific individual, their lifestyle, their threat profile, and their family's needs. It is reviewed and updated at least annually and at any point when the client's circumstances or threat profile change materially. The programme typically sits alongside an ongoing relationship with a trusted security adviser or a managed security service provider."

Q: "How is the threat assessment for a private client conducted?"

"A private client threat assessment covers: the individual's public profile and visibility (how easily identifiable and locatable are they), their occupation and sector (which threat actors are likely to be interested in them and why), their travel footprint (which destinations and what risk profile), their residential exposure (how accessible are their addresses, how visible their routines), their family composition and any family-specific vulnerabilities (children in school, elderly parents, public-profile family members), and their digital footprint. The assessment produces a threat level rating and a list of specific vulnerabilities that the programme design addresses. It should be conducted by a specialist (ASIS CPP-qualified or equivalent) rather than completed as a self-assessment -- the blind spots in self-assessment are precisely the areas an adversary would exploit."

Q: "How frequently should a private client security programme be reviewed?"

"The minimum is an annual full review. Outside the annual cycle, the programme should be reviewed whenever a material change occurs: a significant increase in public profile (appointment to a major role, appearance in media coverage, award of significant wealth that becomes public), a change in residential address, a change in family composition (new family members, children starting a new school, elderly relatives becoming part of the household), a significant change in the travel footprint (a new business requiring frequent travel to a high-risk destination), a threat indicator (a concerning communication, an observed surveillance event, a social media escalation), or a significant change in the geopolitical environment affecting regularly visited destinations."

Q: "What does day-to-day management of a private client security programme involve?"

"Day-to-day management of a mature private client programme includes: travel pre-trip intelligence briefings for any destination outside routine low-risk markets, ground transport coordination for higher-risk trips (vetted drivers, advance work), residential security monitoring (alarm systems, CCTV review, access control), periodic counter-surveillance assessment of regular routes and locations, ongoing protective intelligence monitoring of relevant open sources, domestic staff vetting updates when staff change, and availability for the client's security team or direct enquiries. For most private clients at moderate threat levels, this is managed through a relationship with an independent security consultant who is on retainer, or through a managed service from a firm such as Control Risks, Kroll, or a boutique private client security provider. For higher threat levels, a permanent security team is appropriate."

Q: "What is the typical cost range for a private client security programme?"

"Cost varies substantially with the threat level and the components required. At the basic end -- an annual threat assessment and a retained security adviser who can be called on for travel pre-briefings and advice -- the cost in the UK market is GBP 15,000-30,000 per year. A programme that includes residential security (CCTV, alarm monitoring, periodic physical security assessment), a residential security manager, and active travel security support for an executive with a moderate international footprint typically costs GBP 60,000-150,000 per year. A comprehensive programme with a full close protection team, armoured vehicles, residential security staff, and real-time intelligence monitoring starts above GBP 300,000 per year and scales with the size of the operation. These are market rate estimates for UK-based provision -- international programmes scale with the number of locations and the risk profile of each."

High-net-worth individuals and their families need a structured, year-round security programme, not ad hoc arrangements. A senior consultant's guide to the components, review cycle, and management of private client security.

1 May 2026

Written by James Whitfield, Senior Security Consultant

Speak to the Team

The security needs of a high-net-worth individual are different from the security needs of a corporate executive. The corporate executive operates within an organisational security programme – a procurement function, an IT security team, a corporate security manager, and a duty of care framework imposed by the employer. The private client is managing their own security. The decisions are theirs, the budget is theirs, and the gaps in the programme are their personal exposure.

This guide covers the design and management of a private client security programme: the components of a credible programme, the threat assessment process, the management model, and the review cycle that keeps it current.

Programme components

A mature private client security programme integrates the following components, calibrated to the individual’s threat level:

Threat assessment. The documented analysis of who might wish to harm or exploit the client, what their capability is, and what specific vulnerabilities the client’s lifestyle presents. Updated annually and at any material change.

Residential security. Physical and electronic security for each residence: CCTV with appropriate coverage and retention, perimeter security (fencing, gates, lighting), access control, alarm systems with monitoring, and a physical security assessment to identify and remediate vulnerabilities. For higher threat levels, residential security staff (a security manager, guards, or a caretaker with security duties).

Travel security. Pre-trip intelligence briefings for higher-risk destinations, vetted ground transport, advance work for complex trips, CP coverage where warranted, K&R insurance for travel to KFR-risk destinations, and a documented personal emergency response plan.

Close protection. Where the threat level warrants it, a dedicated CPO or a CP team for regular assignments. The decision to deploy CP should be threat-assessment led, not prestige-led. A well-designed security programme achieves protection through multiple layers, of which personal CP is one – and often not the most cost-effective in lower-threat environments.

Digital security. Digital footprint management (electoral register, Companies House, data brokers), secure communications protocols, clean device discipline for high-risk travel, social media security for the client and family, and protective intelligence monitoring.

Family security. Briefings for spouse/partner and children (see our security briefing for family members guide), domestic staff vetting, the family emergency protocol, and where warranted, security arrangements for school runs and family travel.

Protective intelligence. Ongoing monitoring of relevant open sources for threat indicators: social media, press, dark web (for data breach monitoring), and threat-specific intelligence feeds. Periodic counter-surveillance assessment of regular routes and locations.

The annual review

The annual programme review is the mechanism by which the programme stays current rather than becoming a static document. The review covers:

Threat reassessment. Has the client’s public profile, sector, travel footprint, or residential situation changed? Has the geopolitical environment in any regularly visited destination changed? Is there any known threat indicator that should change the threat level?

Provider assessment. Are the current providers – CP company, residential security provider, ground transport operators – still meeting the required standard? Has the relationship been reviewed against the market? This is not an annual procurement process, but complacency in provider relationships is documented as a precursor to quality degradation.

Physical security audit. An independent physical security survey of the primary residence (see our physical security assessment guide). Residential security is not static – new vulnerabilities emerge from changes to neighbouring properties, route patterns, vegetation growth affecting camera coverage, and the accumulation of minor maintenance deferrals.

Digital footprint review. Confirmation that the data broker removals, electoral register opt-outs, and Companies House suppressions are current. Data broker entries can re-emerge after removal – active maintenance is required.

Protocol review. Review all documented protocols with the client and family members. Emergency contact numbers still current? Code words known? Family members briefed on any changes to the threat level or the programme?

The security adviser relationship

The most important single element of a private client security programme is the quality of the individual or provider managing it. A programme managed by an adviser who does not know the client, does not understand their lifestyle, and is primarily motivated by selling services will be overloaded with unnecessary measures and underequipped in areas that matter.

The characteristics of a credible private client security adviser:

Qualification and experience – ASIS Certified Protection Professional (CPP) qualification or UK Fit to Practice (Close Protection) qualification with demonstrated private client experience. Not just military background and an SIA licence.

Independence – an adviser who is not commercially tied to specific service providers can give objective recommendations. An adviser who earns commission from every provider they recommend has a conflict.

Discretion – private client security requires an adviser who understands the sensitivity of the relationship and does not use the client’s details to build their own profile or network.

Longevity – the best private client security relationships span years, during which the adviser builds detailed knowledge of the client’s patterns, vulnerabilities, and preferences. A fresh provider does not have this knowledge and cannot achieve the same quality of advice immediately.

Programme tiers by threat level

Private client programmes are not one-size-fits-all. A useful three-tier framework:

Basic programme (low-moderate threat). Annual threat assessment. Residential security audit and remediation. Digital footprint management. Travel briefings for non-routine destinations. K&R insurance. Security adviser on retainer for consultation. No dedicated CP. Cost range: GBP 15,000-40,000 per year.

Intermediate programme (moderate threat). All basic components plus: active protective intelligence monitoring. Residential security manager or monitored alarm with response. Vetted drivers for regular transport. Periodic CP deployment for elevated-risk appearances or travel. Cost range: GBP 50,000-150,000 per year.

Comprehensive programme (elevated threat). All intermediate components plus: dedicated CP team (one to four CPOs depending on lifestyle). Armoured vehicle or hardened vehicle with security driver. 24-hour residential security. Real-time intelligence monitoring. Family security staff (nanny with security background, school run protection where needed). Cost range: GBP 300,000-1,000,000+ per year depending on scale.

These ranges reflect UK market rates for provision of the described quality. International programmes, multi-residence clients, and clients with high-profile family members attract higher costs.

For the threat intelligence methodology that keeps the programme threat assessment current, see our threat intelligence for executives guide. For the family office security context in which many private client programmes sit, see our security for family offices guide.

Sources

ASIS International: Private Client Security Programme Design Standards, 2024. Control Risks: Private Client Security – Programme Design and Management, 2024. Kroll: High-Net-Worth Security Programme Benchmarking 2024. UK Finance: Fraud and Extortion Targeting High-Net-Worth Individuals 2024. CPNI: Protective Security for Private Individuals, Centre for the Protection of National Infrastructure, 2023. Hiscox: HNW Security Risk and Insurance Report 2024. Lloyd’s: High-Net-Worth Risk Advisory – Security Standards, 2024.

Summary

Key takeaways

A programme is not a collection of ad hoc arrangements

Many HNW individuals have security arrangements that have accumulated over time without a coherent structure: a driver who also acts as protection, a residential alarm system installed when they moved in, a CP team engaged for specific trips. These arrangements may provide some security but they are not a programme. A programme has a current threat assessment, a documented design, defined standards for each component, a review cycle, and a named individual responsible for it. The gap between ad hoc arrangements and a programme is where incidents occur.

The security adviser relationship is central to programme quality

A private client security programme is only as good as the adviser or provider managing it. The most important relationship in private client security is with a trusted, independent security consultant who knows the client's threat profile, understands their lifestyle, and can give dispassionate advice that is not influenced by commercial interests in a particular security product or service. Vetting the adviser is at least as important as vetting the security arrangements they recommend.

Digital security is consistently under-resourced in private client programmes

Physical security -- close protection, residential security, armoured vehicles -- tends to receive more investment and attention than digital security in private client programmes. But the digital attack surface for a high-net-worth individual (data brokers publishing their address, social media providing routine information, commercial databases linking their identity to their assets) is the primary source of targeting intelligence for most adversary types. A programme that spends significantly more on a gate intercom than on digital footprint management has misjudged the risk.

The programme must account for the client's lifestyle, not impose on it

Security arrangements that significantly interfere with the client's quality of life will be circumvented. A programme designed without reference to how the client actually lives, where they travel, and what they value will produce security measures that are theoretically correct but practically ignored. The best private client security programmes are built around the client's actual patterns, not an idealised version of their life, and achieve protection through intelligent design rather than constant restriction.

Provider transition management is a security risk in itself

The transition between security providers -- when a CP team, a residential security company, or a security manager changes -- is a period of elevated risk. Institutional knowledge of routes, access codes, alarm systems, and the client's specific protocols is in transition. Transition periods require a formal handover process, a documented knowledge transfer, and a period of parallel running where the outgoing provider can brief the incoming one in detail. This is not always commercially convenient but it is a security requirement.

FAQ

Frequently Asked Questions

A private client security programme is a structured, documented set of security arrangements that covers all aspects of a private individual’s security posture: their residence or residences, travel security, family security, digital security, and the protocols for responding to incidents. Unlike corporate security programmes (which are designed around an organisation), a private client programme is designed around the specific individual, their lifestyle, their threat profile, and their family’s needs. It is reviewed and updated at least annually and at any point when the client’s circumstances or threat profile change materially. The programme typically sits alongside an ongoing relationship with a trusted security adviser or a managed security service provider.

A private client threat assessment covers: the individual’s public profile and visibility (how easily identifiable and locatable are they), their occupation and sector (which threat actors are likely to be interested in them and why), their travel footprint (which destinations and what risk profile), their residential exposure (how accessible are their addresses, how visible their routines), their family composition and any family-specific vulnerabilities (children in school, elderly parents, public-profile family members), and their digital footprint. The assessment produces a threat level rating and a list of specific vulnerabilities that the programme design addresses. It should be conducted by a specialist (ASIS CPP-qualified or equivalent) rather than completed as a self-assessment – the blind spots in self-assessment are precisely the areas an adversary would exploit.

The minimum is an annual full review. Outside the annual cycle, the programme should be reviewed whenever a material change occurs: a significant increase in public profile (appointment to a major role, appearance in media coverage, award of significant wealth that becomes public), a change in residential address, a change in family composition (new family members, children starting a new school, elderly relatives becoming part of the household), a significant change in the travel footprint (a new business requiring frequent travel to a high-risk destination), a threat indicator (a concerning communication, an observed surveillance event, a social media escalation), or a significant change in the geopolitical environment affecting regularly visited destinations.

Day-to-day management of a mature private client programme includes: travel pre-trip intelligence briefings for any destination outside routine low-risk markets, ground transport coordination for higher-risk trips (vetted drivers, advance work), residential security monitoring (alarm systems, CCTV review, access control), periodic counter-surveillance assessment of regular routes and locations, ongoing protective intelligence monitoring of relevant open sources, domestic staff vetting updates when staff change, and availability for the client’s security team or direct enquiries. For most private clients at moderate threat levels, this is managed through a relationship with an independent security consultant who is on retainer, or through a managed service from a firm such as Control Risks, Kroll, or a boutique private client security provider. For higher threat levels, a permanent security team is appropriate.

Cost varies substantially with the threat level and the components required. At the basic end – an annual threat assessment and a retained security adviser who can be called on for travel pre-briefings and advice – the cost in the UK market is GBP 15,000-30,000 per year. A programme that includes residential security (CCTV, alarm monitoring, periodic physical security assessment), a residential security manager, and active travel security support for an executive with a moderate international footprint typically costs GBP 60,000-150,000 per year. A comprehensive programme with a full close protection team, armoured vehicles, residential security staff, and real-time intelligence monitoring starts above GBP 300,000 per year and scales with the size of the operation. These are market rate estimates for UK-based provision – international programmes scale with the number of locations and the risk profile of each.

Get in Touch

Request a Consultation

Describe your security requirements below. All enquiries are confidential and handled by licensed consultants.