Development of Security Program Standards: Part II

Last time, I talked about the need to define a consistent way to secure your existing facilities based on certain categories. This problem has two main components. First, what is the optimum way to reduce risk to an acceptable level? Second, how do you communicate and generate buy-in for the security standards? This is the conclusion to last month’s article.

Risk often follows the size of the facility: bigger facilities generally represent more critical corporate assets and therefore constitute greater risks. An access control system should be implemented at those facilities just above the subjectively defined small facility (lowest risk) level. The basic implementation would be to simply control the perimeter doors with all employees given access to the complete interior of the facility. Conversely, a basic implementation might involve controlling those two or three most interior critical areas such as the server room, the manager’s office and the Starbucks coffee stash. Normally, these systems do not require daytime monitoring. After hours monitoring is normally contracted out to a third party service unless corporate centralized monitoring capabilities are available.

The last major option is CCTV. Recent advances in CCTV technology have resulted in small packages with dramatically increased capabilities. Resist the temptation to deploy them everywhere. As with all other aspects of a security program, have a specific purpose for every component. For every CCTV camera, the purpose should be something like:

If you cannot precisely define what the camera will accomplish, delete it from the system.

No comes the hard question: How do you get the individual facility managers to agree to the imposition of corporate level requirements at the local level? Quite frankly, you have to point out the advantages to them such as:

Reduced Costs: As discussed previously, a well-organized program will operate more efficiently and therefore, more cost effectively, providing relief to the individual facility manager’s budget.

Reduced Burden: If the facility security system is largely defined by the corporate standards, the burden (i.e., time required) on the facility manager is greatly reduced. If the program also includes pre-approved integrators, the burden is even further reduced.

Efficient Risk Reduction: A well-designed and implemented set of standards will result in a more secure facility than would otherwise be achieved. Facility managers are a savvy bunch and often know bad security when they see it. If the program is designed well, they will recognize it as a benefit and support it.

Corporate standards can take many forms. Many times they appear as matrices defining the security system features that will be applied by facility category. A more definitive approach is to actually provide standard design details showing specific pre-approved equipment, cabling and installation methods. This approach leaves very little room for misunderstanding on the part of the integrator. Development of the more detailed system is more front-end loaded but the payoff is, in my opinion, irrefutable.

Randy Nason, PE, VP