1. Developing a Security Master Plan
Timothy D. Giles, CPP
President
Risk/Security Management & Consulting
ASIS International Seminar & Conference
Las Vegas, Nevada.
September 24-27, 2007

2. Security Master Plan Process
Objectives of this session:
This presentation will instruct you in the proper process for constructing a Security Master Plan and its components which will document the Security strategies of your business or institution both for now and more importantly for the future. The end product of this will enable you to gain the support of your Executive Management Team and when effectively presented it will become your preamble to gaining the necessary budget funds to implement your security philosophy.
Definition:
A Security Master Plan is a document that delineates the Organizations Security Philosophy, Strategies and Processes for today and the future. It is used to guide the organization’s development and direction in this area, in a way that is consistent with the organizations overall business plan.

3. Security Master Plan Process
Course Agenda
Preliminary Activities – Information Gathering
Constructing the Security Master Plan Document
Typical Contents of a Security Master Plan
Finalizing the Security Master Plan Process

4. Security Master Plan Process
Introduction:
This process varies depending on the size of the Business or Institution. A Multi-location / Multi-Facet Business (i.e. Manufacturing, Research, Office Complexes, Distribution, Warehouses, etc.) will require more work than a Single site business or Institution such as a Hospital
Even a Single complex business or Institution will have a variety of environments that will need to be addressed (i.e. Emergency Room, Infant Care, Psychological Center, etc.)
It is not the intent of this course to teach you how to Evaluate Business Risks, Conduct a Site Security Assessment, Build a Crisis Management Plan, etc. This is an Advanced course so it is assumed you know this
It is my intent to show you how to Construct a Security Master Plan which will aid you in gaining “buy in” from your Executive Management Team on the direction of your program and the necessary budget to support it

5. Security Master Plan Process
Preliminary Activities – Information Gathering
Evaluate the Business’s Risks
Conduct a Site Security Assessment (s)
Conduct an Assessment of the Security Organization
Determine what Prevention, Crisis Management & Recovery Programs exist
Interview Executive Management to understand their concerns/issues and what the projected growth is for the next 5 and 10 years
Interview Security Management to understand their concerns/issues and their plans for the future
Review and Evaluate all Security related contracts

6. Security Master Plan Process
Preliminary Activities – Information Gathering
Evaluate the Business’s Risks
Fraud
Lack of accurate & timely intelligence
Corruption
Economic Espionage
Theft
Patent & Trademark Infringement
Foreign Travel
Gray Market & Counterfeit Products
Organized Crime
Political Instability
Business Disputes and Litigation
Terrorism & Sabotage
Kidnapping
Extortion
Unsecured Data & Communications
Workplace Violence
Sexual Harassment, & Discrimination Claims
Acts of Nature

7. Security Master Plan Process
Preliminary Activities – Information Gathering
Conduct a Site Security Assessment
Security Administration
Organization and policies
Procedures/post orders
Personnel Selection
Education and Awareness
Staffing / Background Checks
Physical Security
Vehicle access control/parking
Security processing operations, i.e. Visitor & Contractor controls, etc.
Lighting, Barriers, Doors & Building Perimeters
Mechanical Locking Systems
Security Officer Patrols
CPTED (Crime Prevention Through Environmental Design)
Staffing
Monitoring and Administering (PPS) Physical Protection Systems
Stationary & High Visibility Posts
Emergency Response Capabilities
Training
Electronic Systems
Centralized Monitoring and Dispatch
CCTV System integration and recording
Access control System/Badging
Alarm Sensors/Reporting
Communications - Radio, Intercom, Telephones, Pagers, etc.
Technology Status – Current & Future

8. Security Master Plan Process
Preliminary Activities – Information Gathering
Conduct an Assessment of the Security Organization
Reporting Structure:
Where does the Security Director report? Legal, Facilities, Administration, etc.
How is the Security Group Organized? Levels of Management, Shift Supervisors, etc.
Skills:
Does the Security Director have the right Skills/Contacts? Knowledgeable of prevention programs and Security Technology, Involved with other Security Directors, Contacts with police-local, state, Federal
Does the Security Organization have the right Skills Matrix? People & Business Management capabilities, Technical/Systems Knowledge, Investigative Skills, Educational Skills
Staffing:
Are the Security Officers Proprietary, Contract or Both? Are there enough officers or too many, Are the uniformed officers disciplined, Do they project the proper image, Do the uniforms match the environment, Are Supervisors experienced
Has Management made a decision about Armed vs. Unarmed Security Personnel

9. Security Master Plan Process
Preliminary Activities – Information Gathering
Determine what Prevention, Crisis Management & Recovery Programs exist
Prevention & Recovery
Business Intelligence
Crisis Management Planning
Corporate reputation crisis planning
Corporate Investigations - Fraud, Financial, Criminal, Computer/Network
Due Diligence Processes
Emergency Response Planning
Executive Protection Program
Fraud & Integrity Programs
Internal Audit / Business Controls
Monitoring Programs
Pre-employment screening / Drug Testing
Risk Assessment Process - Annually
Security Systems & Procedures
Terrorism / Bio-Terrorism
Workplace Violence Prevention Program

10. Security Master Plan Process
Preliminary Activities – Information Gathering
Interview Executive Management to understand their concerns/issues and what the projected growth is for the next 5 and 10 years
This is a critical part of the process to ensure Executive Management Involvement and Buy-in” to the process
It is vital that you interview Management at the highest level of the organization, however you must interview Middle Management as well. If you don’t have Middle Management support, the effectiveness of the program will break down, probably during the budget process
If conducted properly, this interview process can be of educational value for management as well. By asking management their concerns with various issues such as Terrorism, Workplace Violence, Theft, Sabotage, Computer/Network penetration, protecting the Reputation of the business, etc. – you can effectively raise their awareness level on issues facing the organization

11. Security Master Plan Process
Preliminary Activities – Information Gathering
Interview Security Management to understand their concerns/issues
Security Management should be interviewed covering a wide range of topics
This should be an ongoing process conducted before, during and after the various reviews
The areas of focus should include, but not be limited to:
Security Management interactions with the management team, Proprietary and / or Contract Security Staffing, Security Equipment/Technology, Investigation Practices, Physical Security Standards, Visitor & Contractor Control Processes, High Security Areas, Key and Lock Controls, Unique Security Requirements, Security Education / Awareness Programs, New Employee Education, etc.
Other Security related Programs, i.e. Workplace Violence Prevention, Crisis Management Program, Emergency Planning & Response Program, etc.

12. Security Master Plan Process
Preliminary Activities – Information Gathering
Review and Evaluate all Security related contracts
The primary concern is to evaluate if the contracts are of good quality
Additionally, you need to determine if good procurement processes have been followed to ensure a competitive bidding process or a valid Sole Source
You also need to determine if the contracts are being managed effectively, i.e. are the requirements being audited by the security team periodically to ensure they are met and if not met, what was done about it?
The typical Security Contracts are:
Contract Security Personnel
System Maintenance / Spare Parts
Destruction of Confidential Information
Lock Smith / Key & Lock Maintenance

13. Security Master Plan Process
Constructing the Security Master Plan Document
Compile the results of the Information Gathering process: The Business’s Risks, The Site Security Assessment, The Security Organization Assessment, etc.
Develop your recommendations relative to this data
Review your data and recommendations with the Security Management Team to ensure they understand and agree with them
Work with the Security Team to develop or refine their long range goals in the areas of Security Philosophy, Staffing, Technology, Processes, Contracts, etc.
Document all of this information in the Security Master Plan working with Security Management
Develop a Recommendations Presentation that highlights the changes that are necessary for the organization, to present to Middle and Executive Management. Cost estimates will be needed for those areas that need to be addressed immediately

14. Security Master Plan Process
Typical Contents of a Security Master Plan
Purpose
Executive Summary
Introduction
Security Organization Reporting Structure
Director of Security Skills/Contacts
Security Organization Skills Matrix
Security Organization Staffing & Supplemental Staffing
Investigation Philosophy & Strategies
Armed vs. Unarmed Security Personnel
Security Technology Plan
Physical Security Standards – Exterior, Perimeter, Internal, High Security Areas / Special Needs
Property Signage
Lighting
Landscaping (CPTED)

15. Security Master Plan Process
Typical Contents of a Security Master Plan (cont)
Key and Lock Control Program
Security Awareness Programs
New Employee Orientation
Visitor / Contractor Control Process
Risk Assessment Program
Terrorism / Bio-Terrorism
Workplace Violence Prevention Program
Criminal Arrests
Pre-employment screening
Termination Interview Room
Executive Protection Program
Unique Security Requirements

16. Security Master Plan Process
Finalizing the Security Master Plan Process
Present the Recommendations Presentation, that highlights the changes that are necessary for the organization, to Middle and Executive Management. It is important that you start at the Middle Management level and get their “Buy in”
Cost estimates will need to be addressed for those areas of change that need to be implemented immediately and you should have estimates of cost impacts of future changes
Submit the finalized Security Master Plan Document
The Security Master Plan should be formally reviewed every year to ensure it is being followed and to assess if any changes are needed. (I recommend that this review take place as a preliminary activity to the Budget review process.) Changes to the Plan should be presented to Management
NOTE: This process works best when conducted by an Independent Security Consultant, however it can be done internally if necessary

17. Risk / Security Management & Consulting EMAIL - TDGILES@ATTGLOBAL.NET
Timothy D. Giles, CPP
165 Masters Drive
Newnan, GA Ph -