An alarm provider should promise a defined chain of actions, not just a bold response-time phrase. Your agreement should say what starts the clock, who verifies the signal, when dispatch occurs, what counts as arrival, which address and hours are covered, what can interrupt the service, and what record or remedy follows a failure.
That detail matters because “alarm response” joins several systems and people. A detector may activate, but the signal still has to reach a receiving centre, often called a control room, be handled under an agreed procedure, lead to dispatch and bring a responder to the agreed point at your site. A single headline time can hide every handoff.
Map the complete response chain
Before discussing speed, ask the provider to map the service from your premises to the final response. Use four operational stages.
1. The event is detected and the signal is sent
Define which devices are covered and what event they are intended to detect. Ask who installs, tests and maintains the detector, panel and local warning devices. Then ask how the panel sends the signal, what depends on mains power, mobile or internet connectivity, and what fallback is included. Record any parts owned by you, supplied by another installer or excluded from the response contract.
A technical alarm-transmission framework such as IEC 60839-5-1 is useful for thinking about the path and its continuity. It is an international technical reference, not a Kenyan legal promise, and the full paid standard was not assessed for this article.
2. The receiving centre handles the signal
The contract should identify what the receiving centre receives, how it distinguishes a possible alarm from a fault or test, and which verification procedure follows. Ask what happens when an operator cannot reach a keyholder, when several signals arrive, or when the receiving platform is unavailable.
3. A response resource is dispatched
Define the event that authorises dispatch and the resource the provider plans to use for your address and operating hours. A list of vehicles or staff proves only that assets were described. It does not show that a suitable resource will be available for your incident.
4. The responder reaches and handles the site
State what “arrival” means. It might mean reaching a gate, a building entrance or another agreed point. Access can be affected by keys, access codes, locked compounds, building procedures, road conditions or unsafe circumstances. Put those assumptions in the agreement so that both sides know where the provider's promise ends.
Make every time measure unambiguous
For each promised interval, write down its start event and end event. Otherwise, one party may time from the receiving centre's acknowledgement while the other assumes the clock began when the detector activated.
On a narrow screen, focus this region and swipe horizontally to read every column.
| Measure | Possible start event to define | Possible end event to define | Record to request |
|---|---|---|---|
| Signal transmission | Device or panel generates a reportable event | Receiving platform records it | Panel and receiving-centre timestamps |
| Operator handling | Receiving centre records the event | Verification or escalation decision is logged | Operator event log |
| Dispatch | Dispatch decision is logged | Response resource accepts the assignment | Dispatch record |
| Travel | Resource accepts the assignment | Resource reaches the agreed arrival point | Time and location record |
| Incident close | Arrival or handover occurs | Agreed report is completed | Incident report and closure status |
These are comparison prompts, not universal definitions. The provider may use a different operational model. What matters is that the contract uses one clear model and that its records match it.
Kenyan procurement provides a useful example of a buyer demanding detailed alarm, response, record and remedy terms. The Kenya Power service-level agreement template is evidence of that buyer's requested conditions. It is not proof that a supplier achieved them, a national rule, or a suitable time target for your address.
Define the address, hours and resources
A promise that might be plausible near one response base may mean something different at another site. Ask the provider to write down:
- the exact premises and agreed arrival point;
- the days and hours covered;
- the response base or operating area relevant to the site;
- the type of resource ordinarily assigned;
- how simultaneous incidents are prioritised;
- access details and keyholder responsibilities;
- geographic or operating exclusions; and
- the fallback when the normal resource, route or communication path is unavailable.
Do not treat this list as evidence that the provider has the resources. Ask for proportionate support, such as an address-specific response plan, a demonstration of the reporting system, a sample incident record with personal details removed, and a clear escalation contact.
Ask what verification and escalation mean
A response contract should explain how signals are verified, how false alarms are handled and when keyholders are contacted. It should also define phrases such as “liaison with police” or “escalation to emergency services.” Those phrases do not promise police priority, public-service arrival or any particular responder power.
Questions to put in writing include:
- Which alarm types lead to an immediate operational decision, and which require verification?
- What happens if the first keyholder cannot be reached?
- How are repeated false alarms investigated and corrected?
- Who may enter the premises, and under what recorded authority?
- What information will be passed to a public service if liaison is needed?
- Who takes responsibility for repairing a detector, panel, communication link or receiving-centre fault?
- How will the customer know that a device or communication path is not working?
These are contract and service-management questions. They are not instructions for confronting an intruder or managing an emergency yourself.
Require evidence, maintenance and remedies
The agreement should tell you what evidence exists after an event. Ask for access to relevant event timestamps, dispatch and arrival records, a narrative incident report and the result of any maintenance investigation. Define how long records remain available and who can access them.
Maintenance duties should cover the whole chain. Identify who performs routine tests, who receives fault alerts, what the customer must report, and what happens when equipment from another supplier causes the failure. Avoid a contract in which the response provider blames the installer while the installer blames the network and nobody owns restoration.
Remedies also need plain language. Service credits, repeat work or another negotiated response can create accountability, but they do not guarantee compensation for a loss. Read any liability cap and exclusions alongside the service promise. A remedy that is completely removed by a broad exclusion may offer little practical value.
Verify regulated status without confusing it with performance
Alarm monitoring, equipment work and reactive or response services fall within the scope of the Private Security Regulation Act. Ask for the exact contracting entity and its registration details, including clarity on any subcontractor supplying a different part of the chain.
Registration does not certify the response time delivered at your premises. Site-specific performance still needs a written service design, accurate records and periodic review.
The research did not establish a nationwide benchmark
The High Court judgment in Okoiti v Private Security Regulatory Authority declared the 2019 private-security regulations invalid from 19 November 2019.
Separately, the research for this article did not establish a nationwide statutory arrival-time benchmark or an enacted replacement for those regulations. That is a limit of this research, not a finding by the court or proof that no other rule applies.
Instead of importing an unsupported number, ask competing providers to define their address-specific method and show how it will be measured. Then compare like with like.
Review the service after real events and tests
Agree how often you will review alarm activations, false alarms, faults, missed communications, dispatches, arrivals and overdue reports. A review should lead to a recorded action owner and follow-up date where something failed.
Before signing, you should have one schedule that maps the full chain, defines every clock, names the covered address and access assumptions, identifies evidence and maintenance owners, and states remedies and exclusions. Without that schedule, a response-time promise remains too vague to manage. If the same proposal includes cameras or guards, use the CCTV quote checklist and guarding-service cost guide to examine those components separately.
Sources and update note
This article uses Kenyan legislation and procurement material plus an international technical framework. Procurement terms show what one buyer required; they do not establish supplier performance or national law. Sources were reviewed as at 8 September 2026. Recheck registration, contract terms and current legal guidance before purchase.