How an Executive Protection Team Is Structured

The question of how a close protection team should be structured is answered by three variables: the assessed threat level, the principal’s lifestyle and operational tempo, and the operating geography. Get the structure right and the programme works. Get it wrong and you pay for capability you either do not need or critically lack at the moment it matters.

The most common mistake – on both sides of the cost argument – is treating team size as a budget decision rather than an operational one. A solo CPO assigned to a principal with a high-tempo lifestyle in a P1 city is underresourced regardless of the individual’s skill level. A full residential team deployed for a low-risk principal making occasional domestic trips is unnecessary. Both failures represent bad security planning.

The Role Breakdown

Before discussing team configurations, the distinct roles need to be clear. In smaller teams, one person fills multiple roles. In full protective details, the roles are separated.

Team Leader

The Team Leader manages the programme rather than providing direct principal escort. Their responsibilities: client liaison and programme management, intelligence management (maintaining situational awareness, reviewing threat information, briefing the team), advance planning and coordination, team briefing before every move, and command during incidents.

In a 2-man team, the Team Leader role is typically absorbed by the more senior officer, who also acts as the principal officer for moves. In a 4-man or larger team, the Team Leader is a distinct position that allows someone to maintain programme oversight while the PO focuses on the principal.

Advance Officer

The advance function is what separates proactive protection from reactive escort. The advance officer moves ahead of the principal to:

Survey the route from origin to destination: identify road closures, diversions, high-crime areas, and any environmental factors that affect movement planning.

Check the venue: confirm entry and parking arrangements, identify the locations of entrances and exits, assess the space for threat indicators, confirm the principal’s planned route through the building, identify safe areas.

Confirm security arrangements: if the venue has its own security, the advance officer liaises with them, confirms the principal’s arrangements, and establishes communication.

Identify and report any pre-arrival indicators of concern: surveillance of the venue, unusual activity, changes from expected arrangements.

The advance officer’s report back to the Team Leader before the principal moves is a critical decision point. If the advance raises concerns that cannot be resolved, the move may be rescheduled, re-routed, or the principal advised not to attend.

In a 2-man team, a genuine advance is not possible – while one officer is at the venue, the other must stay with the principal, which means the principal is without close escort during the advance. For mandates where the advance function is operationally important, this is the primary argument for a 4-man minimum configuration.

Principal Officer

The principal officer (PO) is the officer who moves with the principal at all times. They are the last line of physical protection. Their primary function is maintaining immediate proximity to the principal, monitoring the immediate environment, controlling access, and executing any immediate action response required.

The PO does not conduct route advances, manage communications, or run programme logistics while they are with the principal. In a well-structured team, these functions are handled by other team members, leaving the PO free to concentrate on the principal.

Protective Driver

The protective driver’s role extends well beyond vehicle operation. A trained protective driver conducts:

Route planning: primary route, alternative routes, emergency diversion options, and a working knowledge of the operating area.

Vehicle security checks: pre-move inspection for tampering, devices, or damage.

Vehicle configuration: correct positioning for access and fast departure.

Protective and evasive driving: the skill set to respond to ambush, vehicle interception, or hostile contact while the vehicle is moving.

Evacuation driving: the ability to move the principal under stress, including in congested urban environments where speed is not the primary tool.

A CPO who drives and provides close cover simultaneously is doing neither function at full capability. In a 2-man team, one officer drives and one provides close cover; at a minimum, these functions should be separated.

Team Configurations

Solo CPO

A single close protection officer is appropriate for defined, limited tasks at low threat levels: corporate travel in moderate-risk environments where the officer accompanies the principal for specific high-exposure periods, or short assignments where the threat assessment is low and the principal’s lifestyle does not require continuous cover.

The limitations are significant and should be explicitly stated in the security plan:

No advance capability: the officer cannot be at the venue and with the principal at the same time.

No continuous coverage: a single officer cannot work around the clock. Coverage is limited to defined working hours.

No contingency: if the principal officer is incapacitated – injury, illness, or a situation that requires their direct attention – there is no backup.

For a principal who has received credible threats or operates in a genuinely elevated-risk environment, a solo CPO is not an adequate configuration regardless of cost constraints.

2-Man Team: PO and Protective Driver

The 2-man team is the most common configuration for corporate executive protection mandates at moderate threat levels. The principal officer is with the principal; the protective driver manages the vehicle and environment. This configuration provides:

Consistent close cover during moves and at events.

Separation of driving and escort functions.

A limited advance capability: the driver can conduct a basic venue check in advance while the PO stays with the principal, but this is not a true advance.

Limited coverage: the 2-man team cannot provide overnight residential protection without additional resources. Coverage is typically defined by working hours or specific high-risk periods.

For a travelling executive at moderate threat, a 2-man team for airport transfers, high-risk venue appearances, and defined events provides a meaningful and proportionate level of protection.

4-Man Team

The 4-man team (Team Leader/advance, advance/PO, PO, protective driver) allows the programme to function properly. The advance officer can survey routes and venues before the principal moves. The PO maintains close cover throughout. The protective driver manages the vehicle function. The Team Leader manages the programme and maintains intelligence oversight.

This is the minimum configuration for a principal with an elevated threat profile, a high-tempo schedule with multiple venue changes per day, or one who requires residential protection at night.

The 4-man team can provide continuous coverage across a working day and provide advance capability for all significant moves. It cannot provide around-the-clock residential coverage without a third shift.

Full Residential Detail (6 or more officers)

Twenty-four-hour residential protection requires a minimum of three officers on an 8-hour rotation, or four officers on a 12-hour rotation with overlap for handover briefing and contingency. In practice, most continuous residential protection programmes operate with five to six officers to account for leave, sickness, and operational flexibility.

A full residential detail adds:

Night cover at the residential location: one officer on duty at the property through the night.

Continuous handover briefing: the incoming officer is fully briefed on any changes, concerns, or outstanding matters before the outgoing officer stands down.

Advance capability running concurrently with close cover: with sufficient officers, advance work for the following day can be conducted while current close cover is maintained.

For HNW principals with families, the residential detail may need to provide parallel coverage for family members (spouse, children) in addition to the principal. This extends the staffing requirement significantly.

Briefing and Communication Standards

Team structure only functions if communication within the team is disciplined. Before every significant move, the Team Leader delivers a briefing covering: the route (primary and alternative), the venue and advance findings, the timing, communication arrangements (who is on which channel, check-in frequency), and action-on for defined scenarios.

Communication equipment should be encrypted radio for teams operating in public environments where radio monitoring is a risk. Motorola TETRA radios are standard for professional close protection in the UK. Encrypted messaging (Signal or equivalent) supplements radio for pre-move planning and intelligence sharing.

The action-on protocol is defined in the briefing: what does each team member do if the principal is approached by an aggressive individual, if a vehicle incident occurs, if the principal becomes ill, if communications are lost? These are not improvised in the moment; they are rehearsed and briefed.

Scaling the Programme

The team configuration should be set by the threat assessment at the start of the mandate, with defined triggers for scaling up or down. A trigger for scaling up might be: receipt of a new or specific threat, travel to a higher-risk operating environment, a high-profile public event, or a significant change in the principal’s public profile. A trigger for scaling down might be: resolved threat, return to lower-risk environment, or sustained absence of threat indicators over a defined review period.

Scaling up after a threat has materialised is harder, slower, and more expensive than building the right capacity from the start.

For a full explanation of the executive protection service and what it encompasses, see our executive protection guide. For the distinction between covert and overt protection configurations – which directly affects team visibility and operational approach – see our covert vs. overt close protection guide. For the airport and transit hub security considerations that the team’s advance and transport components must cover, see our airport and transit hub security guide. For the medical capability requirements across different team configurations – FPOS-I Level 3 (SIA minimum), TCCC qualification for hostile environments, Hartford Consensus haemorrhage control protocols, team trauma kit contents, and when a dedicated team medic is warranted – see our medical support in close protection guide.

Source: ASIS International Protection of Assets (POA) Manual: Close Protection chapter (2024). SIA (Security Industry Authority) Close Protection Unit Specification for Learning and Assessment 2019. NPSA (National Protective Security Authority, formerly CPNI): Protective Security for Individuals guidance 2024. ISIO (International Security Industry Organisations) Close Protection Standards. Security Institute (SyI): Close Protection programme management guidance 2024.