The main office houses a data center maintained and operated by another alliance company that provides data processing services to a number of financial institutions. This firm also decided to contract with the insurance company’s security department for services including card access controls, CCTV, live monitoring of premises and response protocols based on business-defined security events. The insurance company recognized a need for a number of additional security functions, such as 24x7 guard services, monitoring and response to building premises-related security issues, access controls, CCTV monitoring, burglar alarms and alarm responses, and provision of requested security services to the other alliance companies. The main office already had many of the necessary components, but none of these services were being provided in the remote and field offices. In addition, the company needed safety programs, an emergency operations center, workplace violence prevention and response programs, and investigations as needed. The information security controls also had to be considered.
While the scope of the security program was being substantially expanded, there was little funding available to accomplish it. The center needed to find a cost-efficient means to accomplish all of this.
Shifting the Safety Focus
The CSO reviewed the existing safety program for adequacy under the revised risk assessment results. The existing program was developed to comply with safety regulatory requirements within Washington State. They already had a safety committee structure, an established safety manual, and all of the necessary documentation to comply with regulatory needs.
However, the risk assessment made clear they would need more personnel trained in first aid and emergency response to meet increased threats due to the events of 9/11. So a number of the existing safety staff trained to achieve instructor certificate levels for first aid, CPR, and automatic external defibrillator (AED) use. With their own certified instructors, they could offer more training classes to staff members, doubling the number of qualified staff.
They contracted with ZEE Medical for first aid supplies, focusing on establishing more robust first aid kits than typical for office buildings. The security department provided each floor with a custom-built emergency search and rescue kit. The safety staff was trained in SAR approaches and bomb searches to be able to respond to building-wide emergencies.
The new safety plans included protocols for responding to weapons of mass destruction events. To prepare for that response, the company needed equipment such as emergency wash-down stations and training in decontamination, building HVAC emergency shut down procedures and use of radiological dosimeters. The security department updated building evacuation plans and conducted drills.
The alliance companies determined that all their contingency plans were adequate under the new assessment, but they were updated to include WMD and terror impacts.
Physical Security Programs
Providing CCTV and security officers to all the field and remote offices presented a significant challenge. These offices were spread over a wide geographic area, and there was no single provider of security guard services that could handle coverage for all of them. In addition, none of these offices had CCTV systems. Most had commercially available monitored burglar alarm systems in place, but again, they were from multiple vendors.
If the companies expanded the main office solutions out to the field offices using the existing set of vendors and systems, it would cost them more than $2 million. That money wasn’t available, so the CSO had to get creative.
Breaking Proprietary Bonds
The CSO analyzed the available options and consulted with a number of potential vendors. Instead of throwing lots of human resources at the problem, he purposed to use technology to meet the challenges. The existing systems at the home office were proprietary, and the CSO needed to find a way to integrate them to better manage the costs. He wanted to use commodity security equipment, but he’d have to have a robust management tool as well.
The CSO decided to use the wide area network, over which all of the offices were connected, to provide security connectivity. Then the management of physical security systems could be brought together in a centralized monitoring station. By centralizing the monitoring of these sites, the CSO could reduce the management costs for on-site staff. When this project began, there were few vendors with products that could easily be “plugged in” and managed remotely by a non-proprietary system. A new solution needed to be found.