Why it exists
Physical security findings are usually delivered as a list of things that are wrong. A list cannot be compared to last year's list, cannot be reported upward without translation, and gives a board no way to tell whether the money it spent changed anything. PRMS exists so that the same assessment produces a repeatable, auditable figure.
The five levels
- Level 1 — Ad-hoc
- Controls exist by accident. Nobody owns the proximity surface. Findings, when they occur, are discovered by incident rather than by inspection.
- Level 2 — Reactive
- Controls are put in place after events. There is some documentation, but no schedule, no scope definition, and no consistent method between assessments.
- Level 3 — Defined
- The surface is enumerated, an owner exists, and assessment is scheduled and scoped against a written method. Findings enter a risk register.
- Level 4 — Managed
- Remediation is tracked to closure and verified by re-inspection. Scores are trended over time and reported to a governance body on a fixed cadence.
- Level 5 — Optimised
- Proximity risk is integrated with the wider risk function, triggers are defined in advance, and the programme adapts to changes in the estate and the threat picture without needing an incident to prompt it.
How the score is derived
Each of the six PASM domains is scored individually against the five levels, then weighted according to the organisation's exposure profile and aggregated into a composite rating. Weighting matters: a trading floor and a pharmaceutical laboratory have genuinely different proximity risks, and a score that pretends otherwise is a vanity metric. The individual domain scores are always published alongside the composite, because the composite alone hides exactly the weakness you need to see.
What it is not
PRMS is not a certification and I do not issue one. It is a measurement instrument. Anyone can apply it, including to assess a provider I compete with. That is deliberate — a scoring system that only its author can operate is a sales tool wearing a lab coat.