Compliance Is Not The Same As Suitability

We see the same pattern on projects across sectors, at every stage from concept to construction: a fence, gate or lock arrives on the drawings with a standard attached, and the standard is treated as the answer. The box is ticked and the design moves on.

The standard isn't wrong. It's answering a much narrower question than most people assume. A certified product can still be wrong for the site, the layout or the threat. Understanding the rating is only the start of the decision.

What a rating actually tells you

An LPS 1175 rating tells you that a defined product, in a defined configuration, has demonstrated a particular level of resistance under controlled attack testing. Under Issue 8, the rating identifies the tool category and the delay achieved. Genuinely useful. But also the limit of what it tells you.

It says nothing about whether that configuration is the one going in the ground, what happens where it meets a gate, a corner, a wall interface or a level change the test never covered, or whether the rating is even proportionate to the threat at that part of the site. Sometimesit's simply the rating someone specified three projects ago, for a completely different set of problems, that nobody has revisited since.

A rating is evidence about a product. Suitability is a judgement about a project.

Where the two quietly part company

The gap between a compliant product and a suitable one rarely shows up as an obvious error. It shows up as a run of small, defensible decisions that stop adding up once you look at the whole perimeter rather than each piece of it.

Take a site with one protection level applied across the board. Understandable, since one rating is easier to specify and procure than five, but a perimeter that treats a quiet boundary the same as a primary vehicle approach is either over protecting one, under protecting the other, or both.

Or the certificate that doesn't mean what people assume. An A1-rated mesh fence has demonstrated one minute of resistance against Tool Category A. Move substantially further up the LPS 1175 matrix and the product may be tested against far more capable tools, longer attack times and, at the higher tool categories, more than one operative. The cost difference can be several multiples. Neither is automatically the right answer. The question is what the site actually needs to resist, and for how long.

Vehicle impact testing makes the same point. A current ISO 22343-1 classification describes a particular test: vehicle type and mass, impact speed and angle, together with the resulting penetration and major debris distance. It doesn't tell you that the same product is automatically suitable for every approach at every site.

Or a B3-rated fence (the former SR2 classification) with no rated gate to match it, that can't turn a clean corner and was never detailed for the slope it's sitting on. Certificate in hand. Close to useless on the ground.

Then there's the rating chosen to satisfy a document rather than a threat. Client baselines, insurer requirements, precedent from the last project: all legitimate inputs, none of them a substitute for actually working out what this site is at risk from.

Standards express the security decision. They don't make it.

HVM can also be addressed by absence rather than conclusion. Sometimes leaving vehicle mitigation out of a spec is a deliberate call, vehicle borne risk assessed and judged sufficiently low. But we also see far too frequently that nobody has looked at the approach routes, service roads or gate positions closely enough to know either way.

None of this is a compliance failure. Every product involved might hold a perfectly good certificate. What's missing is the step that's supposed to come after: does this actually work, here, at this site, against this threat.

Why it matters more as the project gets bigger

On a smaller or simpler project, a design discrepancy may sometimes be easier to resolve. As the site becomes larger, more complex and more security-critical, the consequences multiply.

On a data center or a piece of critical infrastructure, it does. The perimeter package is expensive, the design freezes early, and a design that looks right on paper but doesn't hold up in the real world tends to surface at the worst possible moment: deep into procurement or on site, when fixing it costs the most.

It's also easy to miss, because nobody involved has actually done anything wrong. The architect is resolving the layout. The security consultant is handling the wider risk picture. The manufacturer is supplying a genuinely certified product. The contractor is building to the drawing. Suitability sits in the gap between all of these, and because it belongs to no single discipline, it's the thing that can end up with no clear owner.

This is one form of the Security Intent Gap: each individual component can be compliant, while the perimeter as a whole no longer delivers what the original security strategy intended.

Certified doesn't necessarily mean installed as certified

There is another gap worth watching: the product on the drawing may be certified, but the way it is actually installed may sit outside the tested configuration.

A certification can depend on things such as post centres, foundations, fixings, fence height, gate interfaces, gradients, corners and the way the system connects into other structures. Change one of those details and you may no longer be building what was tested.

That does not automatically mean the installation will fail. It does mean you should stop assuming the certificate answers the question.

This is where apparently small design changes matter. A fence running over a slope, terminating onto a wall, turning a tighter corner or using different foundations may still look like the same product on a drawing, while performing very differently in practice.

The important question is not simply, “Is it certified?” It is, “Are we installing the certified configuration?”

The question that comes before the compliance question

Before asking whether a product is compliant, ask something harder: what is this stretch of perimeter actually meant to achieve, and does the design in front of you achieve it, at this location, at this interface, against this approach?

Compliance tells you a product passed a test. Suitability tells you whether the design, built as drawn, delivers what the project needs. They're different questions. Too many projects get around to asking only one of them properly.

Relkron looks at the perimeter across the whole assurance chain:

THREAT → STRATEGY → STANDARDS → DESIGN → PRODUCT → PROCUREMENT → INSTALLATION → PERFORMANCE

Because suitability can be lost at any of the handovers between them.

A Perimeter Design Risk Review tests whether the design and specification still deliver the security outcome the project originally intended — before those gaps are priced into a tender, installed on site or inherited by the operator.

About Adam Savage

Adam Savage is the founder of Relkron, bringing over 26 years of dedicated, hands-on expertise in the physical perimeter security industry. Throughout his career, Adam has specialized in high-security fencing and gates, hostile vehicle mitigation (HVM), product manufacturing, specification, and navigating complex LPS 1175 standards across international markets.

Having delivered intricate perimeter security systems in over 40 countries, Adam has worked closely alongside clients, consultants, contractors, and manufacturers worldwide.