The guide
Why the PPO license is the first thing to ask for
The Bureau of Security and Investigative Services (BSIS) issues a single agency license that lawfully staffs a guard on private property in California: the Private Patrol Operator (PPO) license, with its companion registration for each individual guard. Anyone can incorporate an LLC and advertise “security services” without a PPO — but an unlicensed shop exposing its client to trespass-liability on first incident. The PPO license is the single public-verifiable credential that scopes criminal and civil liability correctly, and the BSIS lookup (on its public license search) confirms the license is current and the agency has no open disciplinary actions. Ask for the PPO number and run the lookup before the first scope conversation.
Verify the guard-side credentials, not just the agency
The agency-level PPO license is necessary but not sufficient — every individual guard on the post carries current BSIS guard registration, has cleared Live Scan (the DOJ and FBI fingerprint-based background check), and holds current Power to Arrest training. Each guard’s registration card carries an expiration date, and an agency that doesn’t track expirations on its own roster will quietly field a guard whose registration has lapsed. Ask for proof of registration, Live Scan, and PTA training for every officer assigned to the post — not for “a sample of our roster,” which is the answer the wrong vendor gives.
Firearms permit on file for every armed officer
Armed posts require an officer carrying a current BSIS firearms permit on the agency roster — and the permit has to be paired with a current qualification range cadence that the bureau tracks. The agency’s verbal reassurance that “our armed officers are all permitted” is not the same as a permit number, an issue date, and an expiration date on file for every armed officer assigned to the post. If the vendor can’t produce that record on request, the vendor can’t lawfully field an armed post for your engagement. Ask for proof before signing.
Insurance, worker’s comp, and the contracts posture
Three insurance items belong on the cert. General liability for the agency at limits appropriate to the post (commonly $1M per occurrence / $2M aggregate for standing posts, more for high-value inventory). Worker’s compensation for the on-roster officers, since an officer injured on your site without coverage shifts onto the client. The additional-insuredposture on the client’s certificate — the client named on the agency’s GL certificate as additional insured for the engagement, which scopes the agency’s coverage onto the client’s losses within the engagement. A vendor who won’t share insurance on request is the wrong vendor — the request is standard, baseline, and the response is part of how the vendor proves it can run your post.
The post-order doc pack — what should be in writing
Written post orders are the document the officer is briefed from at start of shift. The pack should cover patrol cadence, incident thresholds (what counts as an incident, what counts as a notification, what escalates to police), the escalation chain (officer → supervisor → dispatch → client contact → police when applicable), and the supervisor rotation (who owns the post across multiple shifts). The same document should also cover site-specific items: hours of operation, access points, the receiving and outbound cadence, the cash window if any, and any camera or alarm-system details dispatch needs to coordinate a key handoff. A one-page summary emailed after the contract is signed is not a post-orders doc pack — and a vendor that hasn’t written your engagement’s specific orders before the first shift hasn’t scoped the post correctly.
Response-window transparency and what to ask dispatch
The single most diagnostic question to ask a prospective vendor is the response window: the vendor’s quoted drive-time per metro, in plain English, before you sign. A vendor that publishes response-window bands per metro — something like “within 15 minutes for sites inside our primary metro radius, within 25 minutes for sites in our secondary radius” — is a vendor that has actually measured coverage and is being honest about it. A vendor that answers with “we’ll be there as soon as we can” is a vendor that hasn’t measured, and the gap between the verbal reassurance and the actual response is the gap that surfaces as a loss on first incident. The coverage page documents the per-metro response-window bands in our seven metros — it’s the same number we’ll quote you on the first call.
A note on this guide
Six items, asked in order, will eliminate the wrong vendors on the first call. The coverage page documents the BSIS PPO #126825 license, the seven-metro matrix, the per-metro response-window table, and the full six-service mix in one pass — it pairs naturally with this buyer guide as the public landing page for the vetting items in the article body.