In this instance, you might be able to get away with a delay(). Unless you want the user to be able to disarm the alarm during the ten seconds, in which case, you'll need to use millis(). Store the millis() when the user arms the alarm, then keep checking until millis() - stored > 10000.