MCB Security Vendor Directory — Design Document

Date: 8 March 2026 Stream: 1 — Property Security Status: Design approved, pending implementation planning Platform: mcbx.app/org-finder (new category on existing MCB organisation directory)

1. Purpose

The Property Security stream has produced strong guidance materials (Physical Security Guide, risk assessments, emergency plan, self-assessment, Martyn's Law webinar). These tell mosques what to do. The vendor directory answers who can help them do it.

The directory also serves as:

• A shield against predatory vendors exploiting Martyn's Law anxiety
• An evidence engine for the PSMS lobbying campaign (Action 3)
• A sustainable revenue stream to fund MCB's security programme

2. Scope

2.1 Vendor Subcategories (9)

2.2 Vendor Listing Fields

• Company name, logo, description
• Subcategories served (multiple allowed)
• Geographic coverage (national / regions)
• Accreditations (NSI, SSAIB, SIA, ISO 27001, etc.)
• Experience with places of worship (yes/no + details)
• Typical project cost range (by mosque size)
• PSMS Approved Contractor status (yes/no)
• Contact details, website
• Listing tier (Basic / Premium / MCB Recommended)
• Community ratings and reviews

3. Listing Tiers & Revenue Model

3.1 Three Tiers

3.2 Rating System

• Mosques rate vendors (1–5 stars + short review) — verified mosque accounts only
• Vendors can respond to reviews
• MCB moderates for abusive/fake reviews
• Cultural sensitivity included as a rating dimension

3.3 Revenue Streams

1. Premium listing fees
2. MCB Recommended application/vetting fee (one-off)
3. Commission on group-rate deals brokered in Phase B (percentage TBD)

4. Vetting Framework

4.1 Basic (MCB Admin, 5 working days)

• Companies House registration check
• Valid public liability insurance
• Relevant accreditations verified (NSI/SSAIB, SIA, etc.)
• No adverse press / complaints history
• Self-declaration of no relevant criminal convictions by directors

4.2 MCB Recommended (Panel Review)

Panel composition:

• 1 MCB staff member (non-voting chair)
• 1 mosque trustee with security experience
• 1 independent security professional (e.g., retired Crime Prevention Design Adviser, Security Institute member)
• 1 independent lay member (governance/consumer protection)

Criteria:

• All Basic checks, verified
• Enhanced DBS on directors and mosque-facing staff
• Portfolio of place-of-worship experience
• 3 client references from mosques/community organisations
• Pilot engagement with 1–2 mosques + structured feedback
• Panel interview assessing technical competence, cultural competence, data handling
• Commitment to MCB Code of Conduct (confidentiality, cultural sensitivity, reporting)
• Professional indemnity insurance (minimum £2m)

Terms: 2-year badge, not auto-renewed. Annual review of ratings, complaints, insurance, accreditations. Badge revocable if standards drop.

Appeals: Written appeal within 30 days, reviewed by a panel member not involved in original decision.

4.3 Complaint/Dispute Process

• Mosques flag issues through org-finder
• MCB acknowledges within 5 working days, responds within 20
• Escalation to senior MCB staff if unresolved
• Repeated complaints trigger suspension and review
• MCB is not a party to contracts between mosques and vendors (liability disclaimer)

5. Integration with Existing Actions

5.1 Action 1 — Security Framework

• End-of-section callout boxes in the Physical Security Guide — consistent format linking to relevant vendor subcategory on org-finder. No vendor references in body text.
• Risk assessments produce a "Controls Required" summary table mapping gaps to vendor subcategories.
• Self-assessment RAG scores link to relevant vendor subcategories as an opt-in ("Would you like to see qualified providers?"). Mosque scores are never shared with vendors.
• Vendor-contributed content (case studies, technical appendices) hosted in a separate "Technical Resources" section, clearly labelled, MCB-reviewed.

5.2 Action 2 — Martyn's Law

• Compliance Roadmap visual maps 5 stages (Awareness → Assessment → Measures → Documentation → Ongoing) with vendor touchpoints clearly marked. Stage 1 (Awareness) is vendor-free.
• Martyn's Law Ready campaign (Dec 2026–Mar 2027): landing page at /martyns-law-ready with interactive checklist, resource hub, filtered vendor view, and compliance package.
• Compliance package: MCB negotiates bundled Standard Tier package (assessment + plan + training) with 2–3 Recommended vendors at group rate (~£500–700 vs £1,600–2,000 individually).
• Indicative price ranges published for all Martyn's Law services to protect mosques from overcharging.
• "Red Flags" guide for spotting predatory vendors, distributed before the anxiety window (Sep 2026+).
• SIA engagement now — understand regulatory direction, advocate for places of worship in guidance.

5.3 Action 3 — PSMS Lobbying

• Cost data from vendor profiles cross-referenced with evidence form responses to quantify the funding gap.
• Lobbying ally opt-in on vendor onboarding — build a segment of vendors willing to provide expert testimony, cost analyses, APPG appearances.
• PSMS Approved Contractor badge visible on vendor listings. Onboarding question captures contractor status distribution as lobbying evidence.
• "True Cost of Securing Places of Worship" report co-produced with Recommended vendors as briefing paper appendix.
• Directory referenced in all lobbying materials to establish MCB as the sector gateway.

6. Phased Roadmap

Phase 1: Launch Directory (Jun–Aug 2026)

Phase 2: Quality Layer (Sep–Nov 2026)

Phase 3: Group Rates & Martyn's Law Campaign (Dec 2026–Mar 2027)

Post-April 2027: Ongoing

• Annual "compliance health check" campaigns (pre-Ramadan timing)
• Expand directory beyond mosques to schools, community centres, commercial premises
• MCB Recommended badge annual renewals
• Ongoing PSMS lobbying with strengthened evidence base

7. Governance & Risk

7.1 Legal

• Commission bespoke T&Cs, vendor agreements, and liability disclaimers before launch (£10–15k)
• Consider operating directory through a separate legal entity (CIC) for liability firewall
• Vendor agreements must include: indemnity clause, insurance requirements, immediate notification of incidents, right to suspend

7.2 Conflict of Interest

• Editorial independence policy: People who write guides ≠ people who manage vendor relationships
• Vetting panel independence: External members, published criteria, minutes kept
• Revenue transparency: Fee structure published openly. Annual transparency report (applications, approvals, rejections, removals)
• "How We Work With Vendors" statement on directory page and in Physical Security Guide introduction

7.3 Data Protection

• DPIA required before launch (mosque vulnerability data is highly sensitive)
• Vulnerability/assessment data should flow directly between vendor and mosque — MCB should not hold it
• DBS data requires Appropriate Policy Document under DPA 2018 Schedule 1
• Two privacy notices needed (vendors, mosque users)
• Data breach response procedure documented (72-hour ICO notification for personal data breaches)

7.4 Safeguarding

• Vendors gain intimate knowledge of mosque layouts, camera positions, congregation patterns
• Enhanced DBS for Recommended tier; Basic tier self-declaration
• Vendor data breach protocol: 24-hour notification to MCB, 48-hour notification to affected mosques
• Consult NaCTSO on vetting framework — free and adds credibility

7.5 Competition Law

• Recommended cap (3–5 per subcategory) is defensible if: criteria are published, selection is objective, appeals exist, terms are fixed (not auto-renewed)
• Group rates are pro-competitive (collective buying power for small buyers)
• Deals must be non-exclusive — mosques always free to use any vendor

7.6 Insurance

• MCB to carry professional indemnity insurance (£1–2m cover, ~£3–8k/yr)
• Cyber insurance for platform and data
• Confirm existing public liability covers directory activities

7.7 Cultural Competence

Develop a 30–60 minute module for vendors covering:

• Prayer times, Jumu'ah, Ramadan/Eid patterns
• Gender-segregated spaces, wudu areas, shoe-off zones
• Behavioural expectations on site
• Community dynamics (volunteer trustees, consensus-driven decisions)
• Mosque-specific threat profile (hate crime patterns, cash handling)

Offered free to all listed vendors. Required completion for Premium and MCB Recommended.

8. Operational Resourcing

Minimum Viable Team

Year 1 Budget Estimate

9. Failure Modes

10. Key Dependencies

11. Success Metrics

Next Steps

1. Present this design to IAG Stewardship Group for endorsement
2. Confirm org-finder platform capability and development timeline
3. Commission legal and insurance workstreams
4. Recruit or assign Directory Manager
5. Begin vendor market research and outreach
6. Develop cultural competence module
7. Create implementation plan with detailed task breakdown