Good question — choosing the right security provider in Malaysia affects legal compliance and the safety of your people, assets and reputation. Below is a practical, step-by-step checklist plus the key things to verify and questions to ask. I’ve included Malaysian regulatory sources so you can verify licences and legal requirements.

Essential legal checks (do these first)

• Confirm the company is licensed under the Private Agency Act 1971 (Ministry of Home Affairs / KDN). You can check licences and current status via the eSIMS / “Semakan Lesen Agensi Persendirian” portal. (eSIMS.moha.gov.my)
• Confirm the company complies with KDN requirements (annual licence renewal, security vetting of guards, board/shareholding rules where applicable). KDN lists duties and application requirements. (moha.gov.my)
• For cyber-security services (if you need them) check NACSA / relevant regulator licensing and requirements (different licensing path). (NACSA.gov.my)

Practical selection checklist (use as an evaluation form)

1. Legality & compliance

   • Valid KDN licence (check eSIMS) and up-to-date vetting for guards. (eSIMS.moha.gov.my)
   • No history of enforcement actions or unlicensed operation (news/industry association warnings). (thestar.com.my)

2. Reputation & references

   • Ask for 3 references (same industry or similar site type) and visit at least one live site if possible.
   • Check customer reviews, complaints with authorities, and industry association membership (e.g., PIKM).

3. People & vetting

   • How are guards recruited, background-checked, and security-vetted? (KDN vetting should be in place.)
   • Retention and turnover rates; supervisors per shift; language capability; any ex-forces / ex-police on staff.

4. Training & standards

   • Ask for training curriculum, refresher frequency, and evidence of competency (first aid, crowd control, incident reporting, firearms where relevant).
   • On-site induction for your premises and scenario-based drills.

5. Services & technology

   • What services are included: manned guarding, patrols, CCTV monitoring, mobile response, access control, investigations?
   • Technology stack: CCTV quality, alarm integration, remote monitoring, guard tour systems, incident reporting app, patrol logs.

6. Contracts, SLA & KPIs

   • Defined SLAs (response times, guard arrival, incident reporting timeline).
   • Key performance indicators (patrol completion %, shift coverage, false alarm handling).
   • Clear termination, notice periods and remedies for poor performance.

7. Insurance & liability

   • Public liability, employer’s liability/workmen’s compensation and fidelity/crime cover. Ask for certificate of insurance and policy limits.

8. Pricing & transparency

   • Detailed quote: hourly rates, overtime, relief staff, uniform/equipment costs, admin charges, GST/SST treatment.
   • Compare several providers on the same scope (don’t pick only on price).

9. Management & escalation

   • Single point of contact, escalation matrix (site supervisor, regional manager, operations centre).
   • Reporting cadence: daily logs, weekly/monthly KPI reports, post-incident reports.

10. Audits & continuous improvement

    • Do they do regular audits, mystery shopper checks, client satisfaction surveys and corrective action plans?

Red flags (walk away or probe deeply)

• Operating without KDN licence or using unvetted/illegal workers. (Unlicensed firms are a common problem and risk.) (thestar.com.my)
• Vague answers about training, vetting, or insurance.
• Very low price with no breakdown or guarantees.

Sample questions to ask a shortlisted provider

• “Can you provide your KDN licence number and the eSIMS confirmation for our checks?” (eSIMS.moha.gov.my)
• “Please give three client references in the same sector and contact details.”
• “How do you vet and screen guards? Do you have KDN security vetting records?” (moha.gov.my)
• “What are your KPIs and what penalties apply if SLAs are missed?”
• “Show me training records for guards who would be assigned to our site.”
• “Provide your insurance certificates and limits.”
• “How do you handle incidents, escalation and after-action reporting?”
• (If cyber services) “Are you licensed/registered with NACSA or other authorities?” (NACSA.gov.my)

Onboarding and first 90 days (to reduce risk)

• Start with a 30–90 day probation scope and clearly defined KPIs.
• Joint site risk assessment and SOP creation before service starts.
• Run drills and a handover checklist; require daily incident logs and weekly performance reviews.
• Require a corrective action plan for any KPI misses.

If you want, I can:

• Provide a printable checklist/template contract clauses and SLA wording tailored to your business type (office, retail, manufacturing, gated estate, construction site, logistics).
• Run a short search and shortlist licensed security firms in your city (I’ll verify KDN licence status).

Which would you prefer next?