Control room operator duties: what the job involves, and what the law expects

01

What a control room operator is, and the law behind the role

In South African security work the control room is where a site's CCTV, alarms, access control, radio and phones are watched and the people on the ground are directed. It may sit on one site, such as a shopping centre, hospital, factory or residential estate, or serve many from a monitoring centre. The operator is the officer on duty in it. Industrial and utility control rooms that run plant use the same job title; this guide is about security.

The law treats the work as a security service in its own right. Section 1 of the Private Security Industry Regulation Act 56 of 2001 defines security equipment to include an alarm system, "closed circuit television or other electronic monitoring device or surveillance equipment", and devices for intrusion detection, access control and fire detection. Its definition of a security service includes paragraph (c), "providing a reactive or response service in connection with the safeguarding of a person or property in any manner", and paragraph (i), "monitoring signals or transmissions from electronic security equipment".

Section 20(1)(a) says no one, apart from the state's own security services, may render a security service for reward unless registered as a security service provider. An operator employed by a security company to monitor alarms or cameras therefore needs PSIRA registration. So does one employed in-house: regulation 23(a) of the Code of Conduct for Security Service Providers, 2003 lets an employer use its own employee to protect its property or people only if the employee is registered and has the training the law requires for the function.

Registration needs at least the Grade E course under regulation 3(2) of the Private Security Industry Regulations, 2002, and grade B for anyone registering to manage, control or supervise security services. The regulations name no separate grade for control room work. Regulation 11(3) of the Code does forbid a security business to use an officer for a service needing training, skill or qualification the officer lacks, so a contract that relies on a control room should say what the operator's post needs. Sectoral Determination 6: Private Security Sector, as amended in 2009, covers the sector "including monitoring and responding to alarms" and defines armed response duty, but not a control room operator; its wage tables are dated. See PSIRA grades A to E.

02

The duties of a control room operator, in practice

No regulation lists an operator's tasks. The site instructions or the control room's standard operating procedures should, and on most contracts they come down to this:

• Taking over: reading the log back to the last handover, checking every camera, recorder and radio works, and noting open alarms, incidents and faults.
• Monitoring: watching live CCTV with a purpose: the perimeter, gates, parking, loading bays and whatever the site instructions name as high risk.
• Alarms: acknowledging every intruder, panic, fire and fence signal, checking it against cameras and officers, and acting on it by the procedure.
• Radio and patrols: running the radio net, taking officers' check-in calls, following security officers' patrols against the schedule and chasing a missed call-in at once.
• Dispatch and escalation: sending an officer, supervisor or armed response, and calling the supervisor, the client's contacts, the police, fire service or ambulance in the order the procedure sets.
• Faults: reporting a dead camera, failed floodlight, broken boom or faulty alarm zone to whoever repairs it, and keeping it on the log until fixed.
• The log: writing every event, call, dispatch and fault in time order as it happens, in the control room's occurrence book or an electronic log.
• Handing over: briefing the incoming operator and signing the log at the change of shift.

The operator does not replace the officers or the supervisor. The control room sees and directs; the people on the ground go and look. A procedure that lets an operator close an alarm without anyone attending should say so plainly and be agreed with the client.

03

Handling an alarm or an incident, step by step

Response times are set by the contract, not by law, so the contract or site instructions should give them for each type of signal. Whatever the times, every alarm should be handled the same way, with each step on the log:

1. Receive. The time, the site, the zone or camera and the type of signal.
2. Verify. Look at the cameras on the zone and call the officer on that post. Decide in advance which signals, such as panic and fire, skip this step and go straight to dispatch and emergency services.
3. Dispatch. Who was sent, and when.
4. Stay in contact. Guide the responder with the cameras; record their arrival and what they found.
5. Escalate. The supervisor and client for anything beyond a false alarm, the police or fire service when needed.
6. Close with an outcome. The cause, what was done, and anything left for another shift or for maintenance. An alarm closed with no outcome is an open question for the client.

An incident spotted on camera gets the same discipline. The operator's log is often the first written account of what happened, so it should be factual, in the operator's own words and made at the time; see security report writing and incident reporting and investigation.

Reports from officers often reach the control room first. Section 14(d) of the Occupational Health and Safety Act 85 of 1993 requires an employee who notices something unsafe to report it "as soon as practicable", and section 14(e) requires one injured in an incident to report it "not later than the end of the particular shift" unless that was not possible. The operator should log such a report and pass it to the supervisor the same shift.

04

CCTV footage, personal information and confidentiality

The Protection of Personal Information Act 4 of 2013 (POPIA) defines personal information as "information relating to an identifiable, living, natural person", including identifying numbers and location information. Footage in which someone can be identified, a visitor register and a vehicle registration captured at a gate can all fall within it. The rules that matter most in a control room:

• Keep it secure. Section 19 requires the responsible party, the organisation that decides why and how the information is processed, to take "appropriate, reasonable technical and organisational measures" against loss, damage and unlawful access. In a control room that means controlled entry, individual log-ins to the recording system and no phones filming the monitors.
• Know whose footage it is. A security company monitoring a client's cameras under a contract or mandate, without coming under the client's direct authority, is what POPIA calls an operator. Section 20 then requires it to process the information only with the client's knowledge or authorisation and to treat it as confidential, and section 21 requires a written contract obliging it to keep the section 19 measures.
• Keep it no longer than needed. Section 14(1) forbids keeping records of personal information longer than their purpose needs, unless a law, a contract, the responsible party's lawful purposes or the person's consent allow it. Set a retention period for recordings.
• Tell people. Section 18 requires reasonably practicable steps to make people aware their information is being collected and why; a clear notice at the entrances is one.
• Report a compromise. Under section 22, where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, the responsible party must notify the Information Regulator and the person concerned as soon as reasonably possible, and under section 21(2) an operator must tell the responsible party immediately. The Information Regulator's POPIA page links to its eServices portal for these notifications.

The PSIRA Code adds a duty to the client. Regulation 9(12) of the Code of Conduct for Security Service Providers, 2003 forbids disclosing confidential information about a client, "including information relevant to the security, safety or protection of a client", without the client's prior consent unless the law requires it, and regulation 9(14) requires all reasonably necessary steps to safeguard it. Camera positions, alarm codes, patrol times and the log are exactly that information. Write down who may authorise a copy of footage and how the release is logged, and send every request for footage to that person, not to whoever is on shift.

05

The records, the supervision and the operator's own health

Regulation 10 of the Private Security Industry Regulations, 2002 requires every security business to keep "all the records and documents concerning the management, administration and other matters relating to the rendering of security service by it", available for PSIRA inspection for at least 4 years and updated within 7 days of a change, including a daily posting sheet naming each officer, their training level and registration number, the client, the service and its hours. Records may be electronic if a dated back-up is made each day they change. Good evidence from a control room is specific and made at the time:

• every alarm with the time received, what was checked, who was sent, when they arrived and the outcome;
• every radio check-in, and every missed one with what was done;
• each fault with when it was reported, to whom, and when it was fixed;
• a signed handover at each change of shift, with open items listed;
• every copy of footage made, who authorised it and who received it.

A control room needs supervising like any post. Regulation 13(1) of the Code requires a security business to ensure its services are "properly managed, controlled, supervised and administered by appropriately trained, experienced or skilled persons", and regulation 11(5) requires reasonable steps to ensure each officer knows the scope of their duties and legal powers. For an operator that means written procedures for each type of signal and a supervisor who reads the log each shift; see security supervisor duties.

A long night at the monitors is itself a hazard. Section 8(2)(d) of the Occupational Health and Safety Act 85 of 1993 requires the employer to establish the hazards of the work and the precautions needed, and regulation 6 of the Ergonomics Regulations, 2019 (Government Notice R. 1589) requires an ergonomic risk assessment by a competent person before work that may expose employees to ergonomic risks, after consulting the health and safety committee or representatives, repeated at intervals not exceeding two years. In a control room that covers the chairs, desks, the height and glare of the monitors, how many screens one person watches, and breaks.

06

Where control room records fail, and where SiteClara fits

A control room's record usually fails where the screen stops and the site begins. An alarm is logged at 02:14 with "officer sent" and nothing after it. The perimeter is meant to be walked every two hours, and the only record is the operator's note that the officer "called in". A camera that has shown grey since Tuesday is mentioned at every handover and never reaches whoever repairs it. Asked whether the night patrols happened, the client gets the operator's word for the officer's word.

SiteClara records routine checks at the place they happen. A printed QR poster, with an optional NFC tag behind it, sits at each point where a check is scheduled: a gate, a perimeter corner, a plant room, a loading bay. An officer or supervisor scans or taps with their own phone, with no app to install, sees the checks due there and marks each one done or says what stopped them. The time and the named person are recorded as it happens, with a photo when one is asked for. A fault found at a point, such as a dead floodlight, goes onto a list of open jobs until someone closes it. A supervisor sees what is due, done and missed at each site, gives the reason when a check was missed, and each day approves a short report that goes to the client's nominated contacts the next morning.

07

Questions people ask

What are the functions and responsibilities of a control room?

In security work a control room watches a site's cameras, alarms and radio and directs the response on the ground. Section 1 of the Private Security Industry Regulation Act 56 of 2001 counts both as security services: "monitoring signals or transmissions from electronic security equipment" and "providing a reactive or response service in connection with the safeguarding of a person or property in any manner". Under section 20(1)(a), anyone apart from the state's own security services who does either for reward must be registered with PSIRA.

What are the qualifications needed to become a control room operator?

PSIRA registration, which under regulation 3(2) of the Private Security Industry Regulations, 2002 needs at least the Grade E training course from an accredited training establishment. The regulations name no separate grade for control room work, and regulation 11(3) of the Code of Conduct forbids using an officer on a service needing training the officer lacks, so the post's requirement belongs in the contract or site instructions.

08

Where to read the official text, and a list to take away

The primary sources, all national:

• The Private Security Industry Regulation Act 56 of 2001, sections 1 and 20.
• PSIRA's compilation of the Private Security Industry Regulations, 2002 and the Code of Conduct for Security Service Providers, 2003: regulations 3 and 10, and Code regulations 9, 11, 13 and 23.
• The Protection of Personal Information Act 4 of 2013, sections 14 and 18 to 22, and the Information Regulator's POPIA page.
• The Occupational Health and Safety Act 85 of 1993, sections 8 and 14, and the Ergonomics Regulations, 2019, regulation 6.

A short list for a security business or a client reviewing a control room:

1. Check each operator's PSIRA registration and training against what the post needs.
2. Write a procedure for each type of signal: verify or not, who is sent, who is called, and the agreed response times.
3. Make every alarm end with an outcome on the log, and every missed check-in with an action.
4. Keep each fault on the log until it is fixed, and pass it to whoever repairs it the same shift.
5. Set who may release footage, how long recordings are kept, and how a compromise is reported.
6. Have a supervisor read the log and sign the handovers each shift.
7. Assess the control room's ergonomics, and repeat it at least every two years.