Workplace Security Playbook

The New Manager's Guide to Security Risk

Bob Hayes

• Publisher: Elsevier
• Year: 2013
• Print ISBN: 9780124172456
• eBook ISBN: 9780124172449
• Topic: Social Sciences
• Subtopic: Information Management
• Index: Social Sciences

Workplace Security Playbook: The New Manager's Guide to Security Risk is a set of comprehensive risk management guidelines for companies that have other business functions coordinating security. When an employee without a security background is charged with the protection of people, facilities, or assets, the Workplace Security Playbook can be his or her go-to resource for security procedures and recommendations.Business risks are not static: They change and grow as a company changes and grows. New technology, increasing business competition, and social and cultural developments all contribute to new security risks and trends. With this in mind, the Workplace Security Playbook focuses on performance guidelines, rather than prescriptive standards. Using performance guidelines helps assess the individual, changing business and security needs that a manager may face.The easily implementable recommendations included in this book are categorized by issues. In addition to security performance guidelines, topics include the elements of a facility security program, how to conduct security surveys and validation testing, steps for performing workplace investigations and inspections, and procedures for emergency and special security situations. An entire chapter is dedicated to describing the resources available to a new security manager, and another provides an outline for building a customized reference source of local security information.The Workplace Security Playbook is a part of Elsevier's Security Executive Council Risk Management Portfolio, a collection of real world solutions and "how-to" guidelines that equip executives, practitioners, and educators with proven information for successful security and risk management programs.- Chapters are categorized by issues for easy reference, and include the fundamentals of a security program up to high-level procedures- Guidelines are specifically designed for companies that have other business functions coordinating security- Emphasizes performance guidelines (rather than standards) that describe the basic levels of performance that will strengthen business operations while accommodating what resources are currently available

Chapter 1

Security Performance Guidelines

In Chapter 1: Security Performance Guidelines, the concept of implementing performance guidelines rather than specific security standards is discussed. Performance guidelines describe the basic levels of performance that your security program should seek to achieve, as opposed to specific security technologies or procedures. By using guidelines instead of standards, the security manager is better equipped to handle the ever-changing business and security challenges he or she will face. The first step toward implementing the eight performance guidelines discussed in this chapter is to work through the three-step decision-making process: 1. Assess your needs; 2. Identify your results and options; and 3. Choose the right solution. The eight performance guidelines included in this chapter deal with identifying risks, integrating security and business operations, physical security, preparation, response, and reporting.

Keywords

performance guidelines; security assessment; business risk; physical security; emergency preparation; emergency response; reporting

Security is the responsibility of every manager. Just as business operations are constantly assessed, managers too must continually assess the organization’s security risks. These risks are not static: they change and grow along with the business. New technology, increasing business competition, and social and cultural developments all contribute to new security risks and trends.

In this chapter, you’ll find eight guidelines that present a course of action based on levels of performance, not specifications. In this way, these guidelines help assess the individual, changing business and security needs that you may face.

If your company has a corporate security department, look to them as a resource to help you identify the measures that will allow you to achieve your security goals and apply the performance guidelines included in this playbook in a manner that fits your unique situation.

This chapter doesn’t describe all the security measures you can use to achieve the levels of security you need. For information about specific security tools and measures:

• Chapters 2 through 8 cover the basics for managers and coordinators, and recommend an ongoing program to handle security issues.

• Chapter 9 provides an outline for building your own reference source of local security information.

1.1 Performance Guidelines vs. Standards

The diversity of your company’s operations and locations may make it impractical to employ standardized security technologies or procedures for all sites. To remedy this, you should identify areas of security that apply to all sites, and describe the basic levels of performance that will strengthen business operations while accommodating what resources are currently available.

The mission of security is to protect and develop company assets. In effect, this makes corporate security your business consultant, whose objective is cost-effective, workable security measures that match your business risks. The only way to achieve this objective is by helping you assess your needs on a case-by-case basis.

To address this diversity of needs, rather than issuing security standards this document provides performance guidelines. A standard, for example, might require all sites to install CCTV (closed circuit television) cameras at entrances to site perimeters, and to monitor the cameras 24 hours per day. That standard might be a good measure in many cases, but it may not be appropriate for your site for a host of reasons. You may need to consider the following questions:

• Do your operations really require that level of security?

• Can the cost of equipment be justified?

• Do you have the staff to implement that solution?

• Will you be located at that particular site long enough to get a return on your investment?

• What do you do if your site perimeter is actually a wall in a leased or shared office building?

Focus instead on performance guidelines. For example, a performance guideline for controlling access to your site starts with the assumption that it is important to control and monitor access, doing so by using appropriate measures.

1.2 Three-Step Decision-Making Process

The concept of performance guidelines depends on a business approach. The performance guideline of controlling access, for example, does not tell you how to do it. The option you choose—how you design, engineer, and implement that end result—is up to you. You’ll find that the following three-step decision-making process is one you may already use for other facets of your business:

1. Assess Your Needs
Assess both your overall and specific security needs, and evaluate them in light of your business operations. What is the probability of a risk becoming reality? How critical would this be to you and the company as a whole? What is your degree of vulnerability—the extent to which you cannot prevent or respond to the situation?

2. Identify Your Results and Options
Once you have assessed your needs, go on to identify your end results and the measures you can use to achieve them. Do you want to reduce theft or vandalism, or limit your exposure to liability? These guidelines will help you identify your intended results, and then you can start to identify the specific options available to you.

3. Choose the Right Solution
Select and implement the right security measures. The options you’ve identified may have trade-offs. Which of them can you support, both financially and operationally? What will best complement your overall security efforts and your business strategy and philosophy?

Working through this decision-making process is a fundamental first step toward implementing the eight performance guidelines described in this chapter.

1.3 Performance Guidelines

The eight security performance guidelines discussed in this section will help you and your team:

• Identify the areas and levels of security needed;

• Integrate security into the environment and business operations;

• Control physical access to the site, buildings, and offices;

• Control access to proprietary information;

• Detect unauthorized access;

• Prepare for incidents and emergencies;

• Respond to incidents and emergencies; and

• Report incidents promptly and correctly.

1.3.1 Performance Guideline #1: Identify Areas and Levels of Security

This guideline focuses on four issues: the possible risks you face, the probability of specific incidents, how critical these incidents would be to you and the company, and your vulnerability in these areas. These points will help you identify the actual levels of security you need to establish.

The possibility of incidents depends on a number of factors, such as your location, type of business, and general security trends. Possible risks include natural disasters, theft, information loss, emergencies arising from accidents or intentional acts, and equipment failure.

The probability of incidents can be assessed by reviewing past incidents at your location, in your community, and at other locations. The nature of your operations can also indicate the probability of certain events.

Criticality is the impact that an incident would have. Would it pose a threat to personal safety? Would it affect a small amount of product, or would it stop or delay production for hours, weeks, or months? Would it affect the reputation of your business or location? Would it reflect negatively on the company?

Vulnerability is the measure of how easily an incident might occur. For example, how easy is it to bypass access controls, such as jumping a fence or falsifying an ID? How easy is it to throw a switch accidentally or to disregard security and safety precautions?

Assessing the level of security you need will help you identify and implement the measures that will remove or reduce your risks.

1.3.2 Performance Guideline #2: Design Security into Your Facility and Operations

Security should be designed into your facility and operations, not just added on. A simplistic breakdown of security might show three elements: physical barriers (gates and doors, for example), control systems (such as card access), and people (procedures and employee awareness). These elements support each other, and are the key components in designing and integrating security into your environment.

For example, you might choose a combination of typical security measures: procedures, access control systems, badges, keys, cameras, and alarms. But designing these components into your operation means you must consider several issues:

• Can these measures be implemented effectively?

• Will the systems and procedures complement the work environment and the efforts of your employees?

• Will the measures support each other, or are they merely redundant?

• Will the measures require increased security staffing?

• Will your investment in security technology offer a real improvement in the performance and cost-effectiveness of your security program?

Physical security measures should be integrated into a new facility at the planning and design stage, though appropriate security measures can also be retrofitted into an existing site. In other cases, engineering solutions may be secondary to your need to establish or reinforce procedural controls. Whatever your situation, designing and integrating security into your environment will deliver a more efficient, cost-effective, and workable system.

1.3.3 Performance Guideline #3: Control Physical Access to Your Site, Buildings, and Offices

In general, controlling employee and visitor access means that you question someone’s authorization and either grant or deny access. There are many ways to accomplish this. Signs, barriers, and gates may control access onto a site. Card access systems, badges, and escort policies can effectively control access to and within a building. In some cases, a simple sign-in/sign-out procedure with a receptionist or security officer may be sufficient.

You may need to rely on these techniques for a variety of situations involving on-site employees, visiting employees, family members, vendors, and temporary or contract workers. You may also need to consider implementing measures for both regular work schedules and after business hours.

Whatever combination of measures you use, employee awareness and cooperation are fundamental to the success of all access control systems.

1.3.4 Performance Guideline #4: Control Access to Proprietary Information

Information security depends on preventing random, uncontrolled access to company information. Physical controls play an import...

Table of contents

• Cover image
• Title page
• Table of Contents
• Copyright
• Executive Summary
• Introduction
• Chapter 1. Security Performance Guidelines
• Chapter 2. Elements of a Facility Security Program
• Chapter 3. Surveys and Validations
• Chapter 4. Investigation Guidelines
• Chapter 5. Inspection Guidelines
• Chapter 6. Emergency Procedures
• Chapter 7. Special Security Situations
• Chapter 8. Security Management Resources
• Chapter 9. Implementing Your Security Program
• About Contributing Editor
• About Elsevier’s Security Executive Council Risk Management Portfolio