The real test of SAIS compliance begins after the facility becomes operational.

The Operational Readiness Certificate confirms that a SAIS-regulated facility has reached the required readiness position at a specific point in time. It shows that the approved design, installed systems, testing and commissioning, manpower arrangements, procedures, and supporting documentation have come together to support operation.

But operational readiness does not freeze the facility in that condition.

Once the facility becomes live, the security environment begins to move. Systems age. Guards rotate. Visitors arrive. Contractors enter the site. Equipment requires maintenance. Procedures face daily pressure. Operational needs change. Small exceptions begin to appear.

This is where compliance must be managed, not assumed.

A facility may have passed testing and commissioning, but that does not mean its security condition will remain effective without active control. The approved security measures must continue to function, and the Security Organization must continue to operate them correctly.

Inspection makes the real condition visible.

Inspection is one of the most practical ways to sustain SAIS compliance after operational readiness.

It allows the facility to confirm that approved security measures remain present, functional, accessible, maintained, and used as intended. This includes perimeter protection, gates, barriers, access-control points, surveillance systems, intrusion detection, lighting, control-room equipment, guard posts, visitor control, vehicle screening arrangements, and other security elements required by the approved design.

The value of inspection is not only in finding major failures. Its real value is in detecting early weakness before it becomes a compliance problem.

A blocked camera view, a damaged barrier, a bypassed access-control point, an incomplete patrol route, a disabled alarm, or an undocumented exception may appear minor at first. Over time, these issues weaken the security basis on which the facility was approved.

A disciplined inspection process keeps management aware of the facility’s actual security condition, not only the condition shown in drawings, approvals, or handover records.

Maintenance protects the approved security function.

Physical security systems are operational assets. They must be maintained like any other critical asset in the facility.

Cameras, access-control devices, gates, barriers, intrusion detection systems, communication links, recording systems, control-room platforms, and field equipment all require preventive and corrective maintenance. Their performance cannot be left to chance after handover.

A camera that is installed but misaligned, dirty, disconnected, or not recording does not support the approved surveillance objective. A gate that is frequently overridden weakens access control. An alarm system that produces repeated false activations gradually loses operational credibility.

Maintenance is therefore part of compliance.

The objective is not only to repair equipment after it fails. The objective is to preserve the approved operating condition of the security measures. Preventive maintenance, fault reporting, response times, testing after repair, spare parts, and maintenance records all help demonstrate that the facility’s security systems remain reliable.

Records turn activity into evidence.

In a regulated facility, doing the work is not enough. The facility must also be able to demonstrate that the work has been done.

After operational readiness, records become essential evidence of compliance. They show how security is being operated, inspected, maintained, corrected, and reviewed.

Useful records may include inspection reports, maintenance logs, fault reports, corrective-action registers, patrol records, access records, visitor and vehicle logs, alarm records, incident reports, training records, drill records, control-room logs, equipment testing records, and periodic review records.

These are not documents for appearance.

They show whether the Security Organization is active, whether systems are being used properly, whether defects are closed, whether guards are performing assigned duties, and whether management has visibility over the security condition of the facility.

A facility without records may still be performing security activities, but it will struggle to prove compliance when reviewed, audited, inspected, or challenged.

Corrective actions prevent operational drift.

Inspection and maintenance only create value when findings are closed.

A defect that is identified but not corrected remains an open exposure. A repeated observation without ownership becomes part of the operating culture. A temporary workaround that is not tracked can quietly become permanent practice.

This is how compliance drifts.

Corrective action management prevents that drift. Each finding should be understood, prioritised, assigned, corrected, verified, and recorded. Some findings may be technical, such as a failed device or communication fault. Others may be operational, such as incomplete logs, weak visitor control, unclear guard duties, poor alarm response, or inconsistent reporting.

The important point is that the facility must have a controlled path from observation to closure.

For owners and project managers, this is where sustained compliance becomes measurable. The question is not whether issues will appear. They will. The real question is whether the facility can detect them, control them, correct them, and keep evidence of closure.

Periodic review keeps compliance aligned with reality.

No facility remains exactly the same after it becomes operational.

Site layouts may change. Access patterns may shift. Contractors may increase. Storage areas may move. Critical assets may change. Adjacent land use may develop. New operational risks may appear. Incidents or near misses may reveal exposures that were not visible before.

Periodic review helps ensure that the approved security measures remain aligned with the facility’s actual operation.

It also helps identify when changes may require reassessment, design adjustment, procedural update, manpower review, maintenance improvement, or coordination with the relevant approval path.

Without periodic review, a facility may continue operating based on an old security picture.

For SAIS-regulated facilities, this is a serious weakness. Compliance is not sustained by keeping approved documents in a file. It is sustained by keeping the live security operation aligned with the risks, requirements, and approved security basis of the facility.

Sustained compliance is a management discipline.

After operational readiness, SAIS compliance becomes part of facility management.

It depends on security, operations, maintenance, engineering, ICT, contractors, control-room personnel, guards, and management oversight working within one controlled compliance structure.

The practical risk is gradual erosion.

A missing log is accepted once. A gate procedure is bypassed for convenience. A camera fault remains open. A patrol route is shortened. A contractor entry exception becomes routine. A control-room alarm is ignored because previous alarms were false.

None of these issues may appear critical in isolation, but together they weaken the approved security condition.

Sustained compliance requires routine attention to inspection, maintenance, records, corrective actions, training, reporting, and review. These are not administrative details. They are the operating controls that keep approved security measures effective after the facility becomes live.

SASECON’s approach to sustained SAIS compliance.

At Saudi Ansary Security Consultancy LLC (SASECON), we treat sustained compliance as an operational responsibility that begins after readiness and continues throughout the life of the facility.

Our work helps owners, developers, and project teams understand how approved security measures should be maintained, inspected, recorded, corrected, and periodically reviewed after operation begins.

This includes linking the approved security design, Security Risk Assessment, Security Organization, manpower arrangements, operating procedures, maintenance requirements, records, and corrective actions into one practical compliance framework.

The purpose is to help the facility remain ready, not only to have been ready at one point in time.

A SAIS-regulated facility must be able to demonstrate that its security systems, people, procedures, and records continue to support the approved security basis. That is where long-term compliance is protected.

In Part 10 of this series, we will examine why selecting the right security contractor matters in SAIS-regulated projects.