To choose a physical security consultant, test five things: genuine independence, verifiable credentials, experience in your specific sector, a clear risk methodology, and a willingness to start with a small, defined engagement rather than a large commitment.
The single most important of these is independence, because it determines whether the advice you receive is objective or is really a pitch for what the consultant also sells.
Ask any candidate three direct questions:
The answers you want are no, no, and yes. If they are anything else, the advice has a second customer, and it is not you. This is not about anyone being dishonest. It is arithmetic: when a recommendation pays the person writing it, the recommendation drifts. We wrote about why this matters so much separately.
In California, pure advisory security consulting requires no license, so many consultants hold none. That makes any credential a consultant does hold worth checking rather than taking on faith:
Be wary of alphabet soup that cannot be checked. The point of a credential is that it means something verifiable.
A hospital emergency department, an unstaffed water pump station, and a detention control room are three completely different problems. A consultant whose experience matches your environment will start from how your world actually operates. One without it will hand you generic findings dressed up as analysis. Ask what they have done in your sector, and listen for specifics rather than reassurance.
Two final tests separate professionals from salespeople:
Independence. Ask whether they sell, install, or monitor what they might recommend, whether they take commissions or referral fees, and whether you will own the specification and be free to bid it anywhere. If those answers are not no, no, and yes, the advice is shaped by what the consultant also profits from.
Look for credentials you can actually verify. In California, advisory consulting requires no license, so any verifiable licensing a consultant holds, checkable against the issuing state agency, is a strong and unusually concrete signal. Combine that with recognized professional standing and real references in your sector. Treat unverifiable claims with caution.
Start small. A consultant confident in their value will happily begin with a single, well-defined assessment. That lets you judge the quality of the work, the clarity of the report, and whether you want to keep working together, before committing to anything larger.
Tell Paul what you are protecting and what prompted the reading. He will tell you honestly what the work involves and whether he is the right person for it.