SOC operator workflow · Triage → Verify video → Dispatch/Log · Response-time scoring
8 alarm events will arrive in random order. For each: assign a priority, verify the video feed, then dispatch a response or dismiss as a nuisance. You are scored on accuracy and response time.
This interactive drill trains security operations center (SOC) operators in the alarm triage, video verification, and dispatch decision workflow required by ANSI/SIA CP-01 and central station operating procedures. Operators are scored on response accuracy and speed across a randomized queue of realistic alarm scenarios.
Professional alarm response follows a three-step workflow: triage (assign priority from alarm type and location data), verify (review available video, audio, or sensor data to distinguish a real security event from a nuisance/false alarm), and act (dispatch law enforcement or log as nuisance/no dispatch). The triage step classifies alarms from critical (forced entry, duress) through high (motion in restricted area, camera tamper) to medium and low priority based on the alarm type and time of day.
Video verification before dispatch is a central station industry standard that significantly reduces false dispatch rates. Most jurisdictions with verified response policies require video, audio, or cross-zone verification before law enforcement is contacted. The ANSI/SIA CP-01 standard and UL 827 (Central Station Alarm Services) both address operator workflow and response time targets.
Scoring in this drill reflects the CP-01 approach: correct dispatch decisions (60 points), correct triage priority (20 points), and response time bonus (up to 20 points). Fast, accurate operators who avoid false dispatches score highest.
ANSI/SIA CP-01 specifies the false alarm reduction features that control panels must support and indirectly governs alarm verification procedures by reducing the number of nuisance activations reaching the SOC. UL 827 (Central Station Alarm Services) governs central monitoring station operations including response time standards, operator training, and dispatch procedures. NFPA 72 Chapter 26 covers supervising station alarm systems and their operational requirements. Local police verified response ordinances require video or cross-zone confirmation before law enforcement dispatch.
Effective SOC alarm response depends on clear alarm prioritization rules, integration of video with alarm events, and operator training that is regularly refreshed. Cross-referencing access control events with intrusion alarms — a door forced open with no badge-in event is higher priority than a door forced open immediately after a valid access event — reduces false dispatch rates.
Camera placement should ensure that all alarm zones have associated video views for verification. PTZ cameras with alarm-triggered presets can automatically position to cover the activated zone. The alarm response workflow must also include escalation procedures for simultaneous multiple alarms, which this drill practices through the queued scenario format.
Click "Start Drill" to begin receiving alarm events in random order. For each event: first, assign a priority (Critical, High, Medium, or Low) based on the alarm type and location information displayed. Second, click "Verify Video" to review the available video evidence. Third, choose to Dispatch a response (for real security events) or Log as Nuisance (for false alarms). Your score is calculated from decision accuracy, triage priority accuracy, and response time. Complete all 8 scenarios to see your final score and performance breakdown.
Verified response is a policy — adopted by many law enforcement agencies — that requires alarm monitoring stations to confirm a genuine security event through video verification, audio verification, or cross-zone sensor confirmation before requesting police dispatch. This reduces false alarm dispatches, preserves law enforcement resources, and improves response to real events.
UL 827 and most central station standards require alarm signals to be acted upon within 90 seconds of receipt. Critical priority alarms (duress, panic, confirmed intrusion) should be dispatched within 30–45 seconds. Video verification should be completed within 30 seconds before dispatch or dismissal. Response time targets vary by monitoring company SLA and alarm type.
A swinger is an alarm zone that repeatedly trips due to a fault — a loose sensor, intermittent wiring, or an environmental cause like HVAC air movement. ANSI/SIA CP-01 requires panels to automatically disable a zone after 2 trips per arming cycle (auto-shutdown or swinger feature). Operators should flag repeated trips from the same zone for maintenance and document each event separately.
A perimeter zone trip (door contact, window contact, glass break) is typically an Instant alarm — no delay before annunciation, because an outside entry is in progress. An interior zone trip (PIR motion) may be a Delayed alarm waiting for the entry delay to expire, or an Instant alarm if the entry delay has already expired. Perimeter trips generally rank higher urgency than interior trips when they occur simultaneously.
Prioritize by alarm type first (duress/panic above all others), then by location sensitivity (server room over general office), then by time since receipt (oldest pending alarm first). Many VMS and alarm management platforms support alarm queuing with automatic priority sorting. Never abandon a verified real alarm to process a lower-priority nuisance alarm.
Try our Physical Security Studio
More calculators, simulators, and guides for this discipline.