1. UNDERTAKING AN OFFSHORE OIL AND GAS SECURITY ASSESSMENT A Guide

2. AIM To provide you with an understanding of the DOTARS Offshore Security Assessments Guidance material and how to use it to assist with the production of your Offshore Security Plans.

3. Note This presentation is provided to assist organisations who may not be familiar with the requirements for providing a security assessments. This presentation is provided to assist organisations who may not be familiar with the requirements for providing a security assessments. It is acknowledged that a number of attendees are leaders in the field of offshore security. This presentation is aimed at assisting other industry participants who may not be as conversant of security issues or aware of the requirements. It is acknowledged that a number of attendees are leaders in the field of offshore security. This presentation is aimed at assisting other industry participants who may not be as conversant of security issues or aware of the requirements. Not intended to cover all parts of the RA, rather amplify specific areas. Not intended to cover all parts of the RA, rather amplify specific areas.

4. PURPOSE OF SECURITY ASSESSMENTS To provide a sound risk based approach to the implementation of preventive security planning to prevent unlawful interference with offshore facilities. Ensures a systematic and analytical process is conducted with the aim of identifying outcomes focused security measures and / or procedures that reduce the vulnerabilities of assets, individuals and operations to acceptable levels.

5. Maritime Transport and Offshore Facilities Security Act 2003 Requires Offshore Security Plan to include:  A security assessment for the participants operations  Set out security measures for MARSEC 1, 2 & 3  Provisions for use of Declaration of Security;  Demonstrate implementation of Security Plan that contributes to maritime security outcomes  Complements Federal and State OH &S legislation

6. Maritime Transport and Offshore Facilities Security Regulations 2003 Security Assessment must include:  statement outlining risk context or threat situation  identification and evaluation of important assets, infrastructure and operations  identification of possible risks or threats and the likelihood and consequences of occurrence

7. Maritime Transport and Offshore Facilities Security Regulations 2003 (cont) identification of existing security measures identification of existing security measures identification of weaknesses identification of weaknesses identification, selection and prioritisation of possible risk treatments identification, selection and prioritisation of possible risk treatments

8. GENERAL GUIDANCE AS/NZS 4360 Risk Assessment HB 436:2004 Risk Management DOTARS Offshore Security Assessments Guidance Paper http://www.dotars.gov.au/transsec/oilandgas/docs/Offshore_Security_Risk_As sessment_Guidance_Paper.doc Use simple plain English Protected from unauthorised access

9. AS 4360 - 2004

10. REQUIREMENTS OF SECURITY ASSESSMENTS Date assessment completed Scope - people, assets, infrastructure, facility or facilities and operations Summary of how the assessment was conducted ID and evaluation of strategically important assets, infrastructure and operations

11. Requirements for Security Assessments (cont) ID and assessment of possible security ID and assessment of possible security risks and likelihood and consequences of risks and likelihood and consequences of their occurrence their occurrence ID of existing security measures, ID of existing security measures, procedures and operations procedures and operations ID, selection and prioritisation of possible ID, selection and prioritisation of possible risk treatments risk treatments

12. Template 8.1 Offshore Industry Participants Name and Contact Details-example Offshore Industry Participants’ Name (Legal & Trading Name, ABN) Krupp Oil and Gas ABN 3760-204717-23 Physical Address 35 Walker Street, North Sydney Postal Address PO Box 2078, North Sydney 2001 Contact Details: Offshore Industry Participants’ Manager Name Telephone Number: Fax:Mobile:Email: Mr John Smith 02 9565 2095 02 9565 2091 John.Smith@krupp.com Contact Details 24/7 Head Security Officer Name Telephone Number: Fax:Mobile:Email: Mr Bob Brown 02 9565 2345 02 9565 2091 Bob.Brown@krupp.com Alternate Out of Hours Contact Name: Telephone Number: Fax:Mobile:Email: Miss Jill Xandar 02 8971 4356 02 9565 2091 0419 391 895 Jill.xandar@krupp.com Location and type of Offshore Facility (If a Network or Joint assessment is being undertaken then provide details of all facilities covered by this assessment). 1. Latitude 35º 28’ 14’ S Longitude 145º 37’21” E Type of facility Offshore Gas Production Facility Type of facility Offshore Gas Production Facility 2. Latitude Longitude Type of facility Type of facility Person (s) who conducted the Security Assessment Name:Address: Telephone Number: Fax:Mobile:Email: Mr Nathan Pringle, Security Risk Practitioners 35 Blank Street, Cremorne, NSW 02 8765 3452 0412 347 890 npringle@srp.com.au Date of completion of Security Risk Assessment 3 June 2005

13. Template 8.5 Assets at Risk (Asset Appreciation and Criticality Analysis)-example ASSET CATEGORY ASSET DETAILS ABILITY TO CONTINUE (without asset) COST to Replace CRITICALITY Rating (1) Facility Offshore production facility control room- have manual controls but would be difficult to operate for extended periods without major increase in offshore staff numbers Very difficult $ 3-5 Million High Pumping equipment – have redundancy with a duplicate system Good $ 500 k-1 Million Medium 6 Monopods located within a 6 nm radius Dependant upon number affected and whether main facility was damaged. $ 1-2 Million per pod Medium -High Rotary wing aviation Helicopters to undertake staff changeovers and limited resupply of essential items- redundancy with company having multiple aircraft and pilots available Good $2-3 Million Low A useful and simple rating system is Low, Medium or High with relation to the criticality of the asset in the continued productive operation of the offshore facility.

14. TYPES OF ASSESSMENTS & PLANS Network - a security assessment covering more than one individual facility for which they are legally responsible. Covering – used for several facilities and/or offshore service providers within a single area.

15. The Current Security Environment Sources: DOTARS Offshore Oil and Gas Risk Context Statement - Apr 2005 http://www.dotars.gov.au/transsec/oilandgas/index.aspx. http://www.dotars.gov.au/transsec/oilandgas/index.aspx Other Threat of Risk Assessments for Critical Infrastructure Law enforcement and security agencies Professional and Industry bodies Company personnel and expert advisers

16. Establishing the Context- External Environmental and Geographical Environmental and Geographical Business and Operational Business and Operational Statutory and Regulatory Statutory and Regulatory Social and Cultural Social and Cultural Competitive Competitive Political Political Financial Financial Others you may deem appropriate Others you may deem appropriate

17. Template 8.2 External Business Context- examples Environmental and Geographical The facility is located 12 nm off the Victorian coast south east of the township of Seaspray. The main facility is surrounded by 6 monopods that are within a radius of 6 nm. The area is used by commercial and recreational fisherman during the non winter months as during winter there are strong winds and 4-5 metre swells and reduced visibility ….etc. Business and Operational Downstream Oil is one of several operators within Bass Strait and produces 17.5 % of the gas suppliers for consumers in Victoria. Although not the biggest commercial operator any adverse activities in our facilities would directly result in gas shortages for domestic and commercial applications in the Melbourne CBD. Regulatory Facilities controlled under Federal and Victorian Petroleum (Undersea) Act 1998, International Ship and Port Security Code, IMO International Safety Management Code, IMO MODU Code 2001, Victorian Work cover Act 2005, MTOFSA 2003, Victorian Critical Infrastructure Legislation. Social and Cultural The facilities are predominantly operated by staff who live within the local area and Downstream Oil is the 2nd largest employed within a 50 km area. All food and minor engineering is procured locally and most major engineering is undertaken within 100km. Competitive The facility is the third largest oil and gas producer in region. Political Due to the nature of local employment in a poor economic area with high unemployment Financial Annual income from field is $2.7 billion and over $57 million paid in taxes and $300 million spent within local community.

18. Establishing the Context - Internal The organisational culture The organisational culture Internal stakeholders Internal stakeholders Organisational structure Organisational structure Capabilities in terms of resources such as people, systems, processes and capital Capabilities in terms of resources such as people, systems, processes and capital Goals and objectives and the strategies that are in place to achieve them. Goals and objectives and the strategies that are in place to achieve them.

19. Establishing the Context – Internal (cont) Consideration of : Critical Assets and Resources Critical Assets and Resources Critical functions and business activities Critical functions and business activities Operational capabilities Operational capabilities Risk management capabilities Risk management capabilities Activities and Programs Activities and Programs Existing risk controls Existing risk controls Risk tolerance level Risk tolerance level Limitations on risk treatments Limitations on risk treatments

20. Template 8.3 Internal Business Context-example Business Goals and objectives To maintain and increase production by 15% over next 5 yrs and develop new Otway fields. Consequences if goals and objectives not realised Lost revenue and market share with potential for company takeover. Critical Assets and Resources Offshore platform, computer control equipment, pumping equipment, generators and air conditioning plant, offshore fuel stocks Critical functions and business activities Continuous production, aircraft for crew transfer, supply vessel, Operational capabilities Have complex EM and firefighting capacity but very limited security resources due to limited manning Risk management capabilities (or lack thereof). Only OH& S capabilities and no in house security expertise. Use contractors and liaison with Shell. Activities and Programs Gas production with some limited explorations within 25 nm of facility. Currently undergoing mid life facility upgrade and thus significant visits by contract maintenance personnel. Risk tolerance level or position. Low risk tolerance due to crew safety, public perception and political and social overview. Internal stakeholders CEO, OH&S, Unions/SA, offshore crew, Limitations on risk treatments including budget constraints. Limited budget available appx $1.2 million and $500 k annually.

21. The Risk Management Context The goals, objectives, strategies, scope and parameters of the activity, or part of the organisation to which the risk management process is being applied, should be established. Consideration of need to balance costs, benefits and opportunities, resources required and the records to be kept should also be specified.

22. Defining the risk management context: Determining resources and expertise needed Defining the risk reporting criteria Defining the Likelihood (Probability or Frequency) criteria Defining the Impact (Consequence) criteria Defining the Risk Rating criteria Outlining the local security risk context

23. Specific issues to consider: Roles and responsibilities of various parts of the organisation participating in the risk management process; and Relationships between the project or activity and other projects or parts of the organisation.

24. Template 8.4. Risk Management Context-examples Define the risk management task and establish its goals To undertake a risk assessment on potential security risks to the operation of Downstream Bass Strait offshore facility and to provide detailed recommendations on effective strategies that can be implemented to reduce the identified risks. Specify the decisions to be made. Consequence and Likelihood criteria relevant to Downstream operations. Identify relevant and cost effective strategies to reduce identified risks and allocate tasking to identified personnel. Complete an implementation schedule. Define the scope, extent and the depth and breadth of the task. This assessment covers all operational offshore activities at the facility and any operations required to support he operations of the facility including crew rotations, by air, supply of food and equipment by sea and the remote on shore management of production equipment and facilities. Determine the resources and expertise required. The assessment was undertaken by a selection of company personnel, representing all areas of operation on the offshore facility, company management and union representation as well as personnel from supporting OIP’s Define the risk reporting criteria. Risk will be defined by likelihood and consequence against criticality of the asset for continued operation of the facility Define the Impact (Consequence) criteria. Refer to guidance material provided. Set own criteria if desired. Define the Likelihood (probability or frequency) criteria. Refer to guidance material provided. Set own criteria if desired. Define the Risk Rating criteria. Refer to guidance material provided. Set own criteria if desired. Outline the local security risk context of your operations. The facility operates in a remote regional environment off Southern Australia with a very low history of criminal activity, and possessing a regular and long serving workforce. There have been no known terrorist incidents on similar facilities in the SE Asia region nor are there any known terrorist support groups within the country.

25. Consideration of risks resulting in: Unlawful interference with offshore oil and gas operations Death or injury Adverse social impact Adverse economic impact Adverse environmental impact Symbolic effect Business disruption and losses Damage to offshore oil and gas business / reputation Significantly reducing public confidence in offshore oil and gas production and supply.

26. Table 8. 11 Consequence Assessment Criteria - example CONSEQUENCEDEFINITION 1Insignificant Risk impact would be negligible or no risk impact can be identified to community or business. 2Minor Risk impact would result in few consequences, such as minor disruption to community and/or business, but of limited overall consequence. 3Moderate Risk impact would result in some consequences, such as short-term disruption to community and/or business. 4Major Risk impact would result in serious consequences, such as medium-term disruption to community and/or business. 5Catastrophic Risk impact would result in disastrous consequences, such as long-term disruption to community and/or business. The worst case outcome for the community and/or business.

27. Advanced version of consequence table p.33 Descriptor* Economic Impact Business Disruption and Continuity* * Death or injury Social Impact Environment al Impact Symbolic Effect Damage to Business Reputation/Public Image 5Catastrophic Greater than $10M Severe disruption to business activities for an extended period – greater than 1 month Numerous deaths Severe ongoing community impact (s) Potentially weeks Complete destruction of an ecosystem over a large area Significant damage to or destruction of nationally important symbol that is internationally recognised Extensive damage to business reputation (possibly irreparable and crippling to business) with potential to destroy business Serious impact on organisation’s public image Significant and sustained media, community and political scrutiny with possible international coverage Potential for intrusive police or other inquiry into security incident 4Major$5M-$10M Major disruption to business activities – more than 1 week to 1 Month Some loss of life Major Community impact (s) Potentially days Long term damage to part of an ecosystem over a wide area Damage to an important national symbol or significant damage to or destruction of a state symbol that is well recognised Major impact on business reputation Major set back to organisation’s public image Adverse media, community and political comment, national coverage Possible intrusive questions in Parliament, but no inquiry 3Moderate$1-$5M Some significant disruption to business activities – 1 day up to 1 week Serious Injury or stress requiring hospitalisat ion permanent injury, compensati on of injury Moderate community impact (s) and source of annoyance Potentially hours Medium term damage to a part of an ecosystem over a wide area Damage to a state symbol or significant damage to a locally important symbol Some impact on business reputation Public embarrassment for senior management and/or security personnel Some adverse local media publicity 2Minor $100,000 to $1M Minimal disruption to business activities – 1 hour to 1 day Injury requiring medical treatment Lost time due to injury Minimal /short term community impact (s) or annoyance Short term damage to an environment with localised impact on the ecosystem Damage to a locally important symbol Limited damage to business reputation Stakeholder and/or shareholder concerns Limited adverse local media publicity. 1Insignificant Less than $100 000 No or very limited disruption to business Activities – less than 1 hour First aid treatment required Minor community impacts or inconvenience Very limited or small scale damage to part of an ecosystem eg. a minor oil spill Very limited or no damage to a locally important symbol No significant damage to business reputation Resolved by day to day management No adverse media publicity.

28. Table 8.9 Likelihood Assessment Criteria -example LIKELIHOODDEFINITION A Almost Certain Is expected to occur in most circumstances. (100/year) BLikely Will probably occur in most circumstances. (10/year) CPossible Might occur at some time. (1/year) DUnlikely Could occur at some time. (1/10 years) ERare May occur only in exceptional circumstances. (1/100 years)

29. The Current Security Environment Sources: DOTARS Offshore Oil and Gas Risk Context Statement - Apr 2005 http://www.dotars.gov.au/transsec/oilandgas/index.aspx. http://www.dotars.gov.au/transsec/oilandgas/index.aspx Other Threat of Risk Assessments for Critical Infrastructure Law enforcement and security agencies Professional and Industry bodies Company personnel and expert advisers

30. IDENTIFYING SECURITY RISKS OIP’s should consider the following terrorist related risk areas: Bomb or explosive device, including suicide bombings Hijacking and hostage siege Deliberate infringement of exclusion zones Sabotage Arson Hoax calls and scare tactics Blockage of transport routes

31. IDENTIFYING SECURITY RISKS - cont… Tampering with supplies, essential equipment or systems Unauthorised access or use of various equipment, including cyber attack Unauthorised access to secure areas Use of industry transport to carry those intending to cause a security incident and their equipment Use of a mode of industry transport or industry facility infrastructure as a weapon or a means to cause damage or destruction Use of a ship, helicopter or aircraft to transport explosives, hazardous goods or weapons.

32. RISK CATEGORIES AND SOURCES OF HARM Vandalism – vandals Vandalism – vandals Misappropriation and sabotage - disgruntled insiders Misappropriation and sabotage - disgruntled insiders Interference - violence prone individuals or groups (politically motivated or otherwise) Interference - violence prone individuals or groups (politically motivated or otherwise) Crime - criminals Crime - criminals Terrorism – terrorists Terrorism – terrorists

33. RISK CATEGORY HAZARD (Source of Harm) POSSIBLE RISK EVENTS VandalismVandals Damage to operating vessel or equipment which results in loss of production. Misappropriation and Sabotage Disgruntled insiders (employees, contractors,etc) Sabotage to offshore control equipment which results in a system shut down and loss of production. Interference and damage Violence prone individuals (politically motivated or otherwise) Hoax calls and scare tactics which results in loss of production. Tampering with supplies, essential equipment or systems resulting in system failure or loss. Criminal activity Criminals Arson resulting in damage, injury or loss of life. Table 8.6 RISKS, HAZARDS AND ASSOCIATED RISK EVENTS- examples

34. Table 8.6 RISKS, HAZARDS AND ASSOCIATED RISK EVENTS- examples Cont.. RISK CATEGORY HAZARD (Source of Harm) POSSIBLE RISK EVENTS Terrorism (in its many forms) Terrorist Bomb or explosive device, including suicide bombings which result in injury, loss of life or damage to infrastructure and production. Hijacking and hostage siege resulting in lost production. Deliberate infringement of exclusion zones. Sabotage resulting in lost production or denial of services. Blockage of transport routes and denial of supplies or oil and gas supplies. Unauthorised access or use of equipment which results in interruption to production or denial of services, including cyber attacks. Unauthorised access to secure areas with the intent of destroying control equipment Use of industry transport to carry those intending to cause a security incident and their equipment; Use of a mode of industry transport or industry facility infrastructure as a weapon or a means to cause damage or destruction; and Use of a ship, helicopter or aircraft to transport explosives, hazardous goods or weapons.

35. RISK SCENARIOS - one method Used to determine how the various risks might be realised and unfoldUsed to determine how the various risks might be realised and unfold Use previous security incidents (security history)Use previous security incidents (security history) Security history must be viewed in the contextSecurity history must be viewed in the context Operators must consider own unique risk scenariosOperators must consider own unique risk scenarios Consider possible risk scenarios to determine how the risk may be initiated and realisedConsider possible risk scenarios to determine how the risk may be initiated and realised It is important that significant risk causes and scenarios are identified.It is important that significant risk causes and scenarios are identified.

36. Table 8.7 RISK SCENARIOS- example RISK CATEGORY RISK SCENARIOS- the manner in which risks may be realised Vandalism The damage to the resupply vessel as a result of a fire being lit above the engine compartment which renders the engine unusable for a time. Misappropriation and Sabotage Theft of computer components and peripherals from the offshore facility computer system which reduces the effective control of production and safety systems. Interference and damage Interfering with the main controls with the intent of causing a major oil spill and resultant environmental damage to the nearby ecosystem to support Greenpeace calls for the closure of the offshore production in the region. Criminal activity The smuggling of illegal firearms onto an offshore facility for the purpose of hijacking a resupply helicopter and medical drugs. Terrorism The hijacking of an offshore facility to seek Australian political influence to obtain the release a suspect terrorist and Muslim cleric from jail in Indonesia

37. Table 8.10 ESTIMATED LIKELIHOOD OF RISKS BEING REALISED- example RISK CATEGORY RareUnlikelyPossibleLikely Almost Certain Rationale for Assessment Vandalismx Several occurrences over past 2 years of vandalism against resupply vessel and equipment on offshore facility. Incidents have been minor with very limited loss of operational capability Misappropriation and Sabotage x In past 3 years 3 staff dismissed for theft of company equipment whilst offshore. To date no follow up incidents by dismissed personnel. Interference and damage x No recorded history of occurrence in facility. Happy and well paid workforce. Criminal activity x Several instances in past 4 years of crew and contractors attempting to smuggle contraband items onto offshore facilities. Resulted in instant dismissals and staff awareness campaigns. Terrorismx No known instances of attacks by terrorists on offshore facilities in Bass Strait. Remote location and inclement weather is likely to deter any attack in favour of more attractive targets in more accessible locations. Regular Navy patrols of area.

38. Table 8.18.RISK TREATMENTS FOR HEIGHTENED ALERT LEVELS- example RISKS Immediate Actions on advice of heightened level Additional security measures and procedures Strategic or long term measures and planning Person/s Responsible Supporting Remarks TerrorismMARITIME LEVEL 2 Advise all offshore personnel. Change Security Alert Status signage. Advise other OIP’s Increase security watches. Conduct an evacuation drill. Commence in water boat patrols in conjunction with available armed ADF personnel. Prepare for MARSEC 3 and conduct a rehearsal for upgrade OFSO, crew chief, helicopter crew Require 10 additional helicopter hours for evacuation rehearsal Terrorism MARITIME LEVEL 3 Advise all offshore personnel. Change Security Alert Status signage. Advise other OIPs. Review manning levels and reduce to skeleton crew. Increase security watches and extend radar range. Evacuate all non essential personnel. Cease all non essential deliveries of cargo and stores. Implement Company Contingency Plan “MAGYAR” OFSO, HSO

39. RISK SCENARIOS Used to determine how the various risks might be realised and unfoldUsed to determine how the various risks might be realised and unfold Use previous security incidents (security history)Use previous security incidents (security history) Security history must be viewed in the contextSecurity history must be viewed in the context Operators must consider own unique risk scenariosOperators must consider own unique risk scenarios Consider possible risk scenarios to determine how the risk may be initiated and realisedConsider possible risk scenarios to determine how the risk may be initiated and realised It is important that significant risk causes and scenarios are identified.It is important that significant risk causes and scenarios are identified.

40. Table 8.7 RISK SCENARIOS- example RISK CATEGORY RISK SCENARIOS- the manner in which risks may be realised Vandalism The damage to the resupply vessel as a result of a fire being lit above the engine compartment which renders the engine unusable until to extensive repairs (1-2 weeks) completed Misappropriation and Sabotage Theft of computer components and peripherals from the offshore facility computer system which reduces the effective control of production and safety systems. Interference and damage Interfering with the main controls with the intent of causing a major oil spill and resultant environmental damage to the nearby ecosystem to support Greenpeace calls for the closure of the offshore production in the region. Criminal activity The smuggling of illegal firearms onto an offshore facility for the purpose of hijacking a resupply helicopter and medical drugs. Terrorism The hijacking of an offshore facility to seek Australian political influence to obtain the release a suspect terrorist and Muslim cleric from jail in Indonesia

41. Table 8.8 EXISTING SECURITY CONTROLS – Summary for Assets - example RISK CATEGORY Offshore Facility Resupply Operations Cargo Handling Personnel Vandalism Radar, access controls, security watches, 24/7 CCTV coverage of major and critical areas No passengers. Maritime ID cards. Positive ID for visitors and contractors. Pre- embarkation screening on land. All cargo screened and manifested. All equipment locked down until required. Limited number of operators. Scheduled activities. Pre-employment checks for all offshore crew and regular maintenance staff. Maritime ID cards. Positive ID for visitors and contractors. Pre- embarkation screening on land. Misappropriation and Sabotage 24/7 operations and all critical areas manned. Long term crew with low staff change over. All offshore equipment cargo handling equipment disabled and locked when not in use. Interference and damage 24/7 operations and all critical areas manned All packages sealed with consignment notes. Pre-departure physical checks. Criminal activity Pre- employment screening and Industry ID Card Terrorism

42. Table 8.10 ESTIMATED LIKELIHOOD OF RISKS BEING REALISED- example RISK CATEGORY RareUnlikelyPossibleLikely Almost Certain Rationale for Assessment Vandalismx Several occurrences over past 2 years of vandalism against resupply vessel and equipment on offshore facility. Incidents have been minor with very limited loss of operational capability Misappropriati on and Sabotage x In past 3 years 3 staff dismissed for theft of company equipment whilst offshore. To date no follow up incidents by dismissed personnel. Interference and damage x No recorded history of occurrence in facility. Happy and well paid workforce. Criminal activity x Several instances in past 4 years of crew and contractors attempting to smuggle contraband items onto offshore facilities. Resulted in instant dismissals and staff awareness campaigns. Terrorismx No known instances of attacks by terrorists on offshore facilities in Bass Strait. Remote location and inclement weather is likely to deter any attack in favour of more attractive targets in more accessible locations. Regular Navy patrols of area.

43. Table 8.12 ESTIMATED CONSEQUENCE OF RISKS IF REALISED- example RISK CATEGORY InsignificantMinorModerateMajorCatastrophic Rationale for Assessment Vandalismx Good level of security on facility and no history of acts during previous 10 yrs. Very good emergency procedures and therefore any fire would be quickly contained. Misappropriation and Sabotage x As above Interference and damage x As above Criminal activity x Good level of CCTV coverage, monitoring and response to any identified activity. Good security response plans. Terrorismx Although assessed as Unlikely should such an incident occur then there could be massive ecological damage if oil was release into sea, or major shutdown and loss of production if facility inoperable for more than 7 days.

44. Table 8.14 RISK RATING TABLE -example RISK CATEGORY LowModerateHighExtreme Risk Treatment Options Vandalismx Increase CCTV coverage of sensitive areas. Improve security fencing of landside supply facility and after hours patrolling of supply vessel mooring area. Misappropria tion and Sabotage x Amend company workplace policy. Improve pre-employment checks Interference and damage x No deliberate treatment options Criminal activity x Improve pre-employment checking with Police checks and ASIO checks. Improve vigilance and screening of crew and visitors etc at aircraft departure point. Terrorismx MOU with Police and local ADF HQ re assistance during MARSEC 3 * Note – only general information is required for risk treatment options. However, details of proposed security measures/procedures and desired outcomes should be outlined in table 8.16 Risk Treatment Implementation Schedule.

45. Table 8. 16 RISK TREATMENT IMPLEMENTATION SCHEDULE - exampleRISKS Desired Outcomes Security measure or procedure to be implemented * Estimat ed Initial Cost $ Estimated ongoing Costs per year $ Person Respons ible Date security measure to be implemented by SupportingRemarks VandalismNoactivitiesIncreased CCTV coverage 50,00010,000OFSO Dec 05 Awaiting Board funding approval. Mis- appropriation and Sabotage Reduction In frequency and effect Interference and damage NoactivitiesIncreased Offshore security watches 15,00025,000OFSO Aug 05. Awaiting changes to work practise procedures. Criminal activity Noactivities Pre- employment security checks 23,5007,500HSO Sep 05. Awaiting MOU with WA Police and ASIO re cost and procedures. TerrorismNoactivities Implement security plans 34,00010,000HSO This Implementation Schedule must be included with assessment and plan

46. Table 8.16.RISK TREATMENTS FOR HEIGHTENED ALERT LEVELS- example RISKS Immediate Actions on advice of heightened level Additional security measures and procedures Strategic or long term measures and planning Person/s Responsible Supporting Remarks TerrorismMARITIME LEVEL 2 Advise all offshore personnel. Change Security Alert Status signage. Advise other OIP’s Increase security watches. Conduct an evacuation drill. Commence in water boat patrols in conjunction with available armed ADF personnel. Prepare for MARSEC 3 and conduct a rehearsal for upgrade OFSO, crew chief, helicopter crew Require 10 additional helicopter hours for evacuation rehearsal Terrorism MARITIME LEVEL 3 Advise all offshore personnel. Change Security Alert Status signage. Advise other OIPs. Review manning levels and reduce to skeleton crew. Increase security watches and extend radar range. Evacuate all non essential personnel. Cease all non essential deliveries of cargo and stores. Implement Company Contingency Plan “MAGYAR” OFSO, HSO

47. SUMMARY Please be aware of the DOTARS Offshore Security Assessments Guidance Paper. This is the minimum requirement. If your assessment process exceeds this requirement please ensure that there is a clear explanation of the methodology, acronyms and relevant data and sources used.

48. SUMMARY cont Ensure there is linkage with the outcomes of the Risk Assessment with the Security Plan. Complete your plan in accordance with the Guide on preparing an Offshore Security Plan for Offshore Facility Operators. Please liaise with the local DOTARS office or Veena Rampal on 02 6274 7648

49. QUESTIONS?