Lean Security and Lean Security Operations
Lean Security has the following scope:
• applying lean principles to the security function;
• use of information from other applications of lean (such as Lean Manufacturing or Lean Office) in support of the security function; and
• use of security resources to support lean elsewhere in the organization.
Through the second element above, security can gain insight about critical assets and business processes. For example, such information is valuable input for business continuity planning. Information about the critical assets and processes also provides insight into organizational risks.
Lean Manufacturing, for example, impacts the risk equation by reducing inventory levels. This is important from a business resiliency perspective, as the ability to draw from inventory to offset a delay of component parts due to a disruption in the supply chain is greatly reduced. Thus, Lean Security is actually an important compliment to Lean Manufacturing. Security must always take the changing business picture into account when assessing the company’s risk profile, including changes resulting from lean improvements to the organization.
Lean Security has applicability throughout the enterprise security function, from top to bottom.
Lean Security Operations focuses on applying lean to specific aspects of security operations, such as security operations at the site level, or within supply chain operations. This can be done independently of the rest of the security function.
For example, in an R&D lab environment, a critical process in developing a new product often involves months of tests and monitoring. Many times, key components may involve maintaining temperature or humidity within certain parameters over a long period of time. If the temperature gets too hot or too cold, or the humidity is too high or too low, the test may be invalidated — resulting in significant costs to redo the test and major delays in bringing the new product to market. In a situation like this, deploying temperature and humidity sensors connected to the main security command center, along with detailed response protocols can provide invaluable risk reduction for the new product development cycle and assist the company in bringing new products to market without interruption.
Lean Security Operations at Baxter Cherry Hill
At Baxter Healthcare Corp.’s pharmaceutical manufacturing facility in Cherry Hill, N.J. — where the Security Department is part of Human Resources — managers of key business functions have partnered with Security (headed by one of this article’s authors, security manager Derrick Wright) to implement Lean Security Operations. “Lean Security Operations is being implemented as part of an ongoing effort by our Security Department to align security with our business,” explains Herman Ford, director of Human Resources. “Security has been examining the best practices implemented in other business units, and applying them to improve the Security function. For example, our Engineering Department has an excellent project management system. Engineering provided guidance to Security on implementing a project management system of its own, helping to make the Security function more efficient and effective.”
“Sharing knowledge and fostering initiative is part of the overall business culture at Baxter,” adds Mike Viggiano, director of Manufacturing. “Lean Security is an example of that sustainable culture at work in its continual improvement of our enterprise.”
Baxter Cherry Hill is currently piloting the use of network video cameras to support operations pertaining to quality, manufacturing, and environmental health and safety — with particular attention to how the technology can support lean improvements. For example, in clean-room manufacturing areas, the ability to use security cameras to supervise processes saves considerable time, increasing the supervision capability while drastically reducing the time involved. A quarter-mile walk through the facility to a production line, donning a clean room suit, performing a 5-minute observation, and then returning to the office area can take an hour. In contrast, a 5-minute camera observation by computer would take six minutes, when you include the time to log in and out of the video application. Additionally, a pan-tilt-zoom camera can provide a close-up inspection of machine operations (and facilitate review in slow motion) that would not be possible with an in-person inspection.
“Being able to share the security video technology to enhance our Quality activities is an exciting prospect,” says William Godfrey, director of Quality.
Adds H. Brandt Widdoes, manager of Baxter Cherry Hill’s Environmental, Health and Safety Department: “The ability to use network camera technology to directly support safety initiatives saves countless hours in investigative time and helps us keep an accurate picture of activities to determine the root cause of incidents.”
Security Workflow Automation
A key strategy of the Baxter Cherry Hill Security Master Plan is to deploy an enterprise security system that:
• centralizes physical identity management for employees, contractors and visitors;
• allows role-based security access management to closely align security access privileges with job functions;
• links with the HR system to automatically assign and remove security access privileges as employees and contractors come on-board or leave; and
• provides self-service for selected security services, such as access privilege changes and the area work permit process.
The Baxter Cherry Hill Security Department implemented a business process management system for security operations, which provides the functionality above. Automating the manual ASCO (Access Status Change Order) process will eliminate up to a mile of walking back and forth for employees each time a change is required, which is approximately 40 times per month.
As part of the transition to the electronic process, area owners are being involved in reviewing the security access privilege assignments. These are being “right-sized” so that each job role receives only the access privileges required for the particular job. Each time an electronic Access Status Change Order request is made, the area owner will also review and approve the job role assignment. This provides a checkpoint to ensure that access privileges are being assigned as the area owner intends. If the job role has changed and access privileges should be revised, this can be addressed so that the security access privileges are always kept in alignment with the job function.
Automating the manual area work permit process will eliminate the administrator’s walking back and forth between departments. Even more importantly, it will incorporate additional checks and balances to better mitigate some of the operational risks inherent in authorizing work to be done throughout our facility, ensuring the continuity of business when work outside of normal business operations is to be performed.
Lean thinking in Baxter Cherry Hill’s Security Department is helping to expand the ROI from its investments in security technology.