How to Layer a Comprehensive Security Plan

Jan. 1, 2004

How to Layer a Comprehensive Security Plan

By Richard D. Maurer

June 2002

With the public's increased awareness of physical security, many security directors and facility managers are being called upon to increase the security and safety of their workplaces. Usually this request comes with the provision that there is no extra money available.
When developing a comprehensive security plan you must remember the three basic elements of physical security:
Mechanical (electronic systems)-Covering the use of security hardware including access control, CCTV, door locks, monitoring systems and intrusion alarms.
Operational (security staff and procedures as well as organizational security)-Covering the involvement in the security programs by management, security staff and employees.
Natural (architectural elements)-Covering basic security philosophies involving property definition, natural surveillance and access control.

Sadly, many security programs focus too heavily on just one of the above basic security philosophies. Some facilities rely too much on security guards who may be fooled into allowing unsafe individuals access. Other facilities focus on mechanical security, leaving their security staff and tenants untrained and uninvolved in the security process. Still other facilities forgo the use of mechanical and organizational security, depending on the goodwill of others or the psychological effect of signage.
Establishing a security program that utilizes a balance of all of the above philosophies will keep the program flexible and ready to handle potential risks that may appear.

Examine Risk
You start your security plan by evaluating the level of risk to your facility. First, what is your neighborhood like? Do you have neighbors that might attract unsafe individuals to your neighborhood? Does your facility contain individuals or activity that also might bring unsafe activity to your doorstep? Do you have a building filled with dentists or a building filled with federal law enforcement agencies or a major media outlet? Each of these buildings has different levels of risk, and the security plan would be different in each case. How well known is your facility on a local, national or international basis? Is it near railroad tracks or major freeways? More American office buildings have been evacuated due to toxic fumes from derailed trains and overturned trucks than terrorist activities. Are you near a university or college? Do any of the tenants in your building have negative media exposure? Are there certain organizations that are not thrilled with the existence of one of the tenants in your building?

Examine Your Perimeter
Now that you have determined if you have a high-, medium- or low-risk facility, you need to start your plan from the outside. First off, who are you allowing in your building? If your organization is the lone user of the building, what type of background investigations are you conducting on new employees or contractors? Do you know if the new individual coming through the door is a legal resident of the United States? Does this new employee have a history of violence, drug use or theft? If he or she is handling money, have you conducted a credit check? Are you allowing undocumented members of your cleaning crew to have free access to every office in your facility at night? The costs for a background investigation for each new employee are dwarfed beside the losses you might suffer if you allowed a violent individual into your work areas. In the case of contract firms that supply personnel to your facility, does your contract ever require them to conduct background investigations of their staff, and do you ever audit this activity?
Do your new tenants or employees get some form of security and safety orientation? Do they know who to call in an emergency? Do they know who should have access to their work area? Do they know the emergency evacuation routes, and do they know where they should meet after they evacuate the building so a headcount can be conducted?
Are you in regular contact with the local law enforcement authorities to learn what criminal activity is happening in your immediate neighborhood? Do you have a method of passing on this information to your tenants or employees?
Now look at your facility as a stranger might from the outside. Are your property boundaries clearly defined? Would a stranger know if he or she were walking or driving from public to private property? Is this defined by signage or architectural design? Is your property given the appearance of being well maintained? Is graffiti quickly removed or covered? Are bushes trimmed low? Is the lawn maintained? If not, you will give the stranger the impression that you don't care about your facility's appearance and probably also do not care about security.
At night, is the area around your property dark and foreboding or well illuminated? Do your employees or tenants feel apprehension when they walk from your building to the parking lot or parking deck at night? Could they see danger at a distance or are there shadowy hiding areas where unsafe individuals could be lurking?
If you have a large parking lot or a parking deck, do you provide your employees, visitors or tenants emergency call boxes? Are these boxes well illuminated and marked? Are they easily seen from all areas of the parking facility? Are the call boxes regularly checked to make sure they are working? Is there someone always ready to answer an emergency call from the call box? If the call comes in, will the person answering know where the call is coming from if the person making the call cannot speak?
Now we have only made it to the outer walls of your facility, but we have already discussed four layers of physical security involving lighting, background investigations, employee orientation and property definition.

Access Points
How many entrances are there to your building? Are these entrances monitored? When we say monitored we could mean a lobby receptionist, a CCTV camera or an employee that can observe the entrance from his or her desk. Could an office creeper or stalker enter your facility without ever being seen or recorded by anyone or any system? Don't forget about the back doors and the loading dock. Limit the number of access points to your building and use some form of natural or mechanical surveillance so that those approaching and entering the facility have the feeling they are being monitored.
When using mechanical security systems, such as CCTV, look for systems that will give you the best bang for your buck. Which would be more helpful, a CCTV system that records individuals walking down a hallway at three in the morning or a system that records and alerts your monitoring station that someone is walking down that hallway and advising them what action may need to be taken? Make sure you are using all the features available in your security systems.
One other access point is your air intake vents. I am not talking about a disgruntled ex-employee entering the facility through the vent, but introducing some toxic substances to your building to disrupt your operations. Are your air vents on the roof or at ground level? I have found many of these vents, in buildings built in the 1960's, in the loading dock area where a badly positioned vehicle could introduce exhaust into the HVAC system. Are your ground-level air intakes monitored? How quickly can you turn off your HVAC system in the event a foreign substance is introduced to your system?

Lobby Security
The front lobbies of many buildings can be an amazing layer of security. Have you ever walked into the lobby of a commercial building to observe the lobby attendant with his head down, behind a counter, reading a book or watching TV? What was your first impression of the security of that facility? If you were an unsafe individual, would you feel comfortable trying to continue on into the building? What if you walked into the same building and the lobby attendant stood up, greeted you, made eye contact and asked if he could be of assistance? What would your initial feeling of the facility security be under this scenario?
Make sure all members of your lobby staff team follow the same procedures when it comes to access control. If your procedures call for an authorized photo ID to be examined before an employee, visitor or tenant is allowed into the facility, make sure all members of your lobby team are following this rule. All it takes is one lobby staff member who thinks he or she knows everyone who works in the building without checking the ID as required. An employee who has been terminated and had their corporate ID removed could gain access not as an employee but as a disgruntled ex-employee. When the know-it-all lobby staff member goes on vacation and is replaced by a staff member who does not claim to know everyone, then you will start getting phone calls from tenants or employees wondering why, if their ID hadn't been checked in the previous two years, was it checked today?
Depending on the level of risk at your facility, you may want to introduce an inspection layer in your lobby. You may want to install signage that indicates you plan to randomly inspect packages carried in by visitors. You may have visitors walk through a magnetometer. Again, this will be defined by the potential threats to your facility.
Here is where the use of physical or optic turnstiles can make your physical security plan more effective. If you have hundreds of employees or tenants, there is no way a lobby attendant is going to remember who is authorized access and who is not, especially if you have a 24-hour-a-day operation. Using a turnstile system, the employees or tenants will display their access card and be allowed access. In lobbies, the low turnstiles will require an attendant to be available to deal with visitors or persons who jump over the hardware. But at backdoors or little-used entrances, a full-size turnstile system could keep unsafe individuals from entering the facility. There are systems available that even weigh the individual gaining legal access to make sure he or she is not trying to squeeze someone else through at the same time. These turnstile systems even allow persons legally leaving the building to not accidentally let unsafe individuals into the building.

Security Command Center
Many large buildings I have reviewed will have a security command center located in an area separate from the lobby or loading dock. This is the area where a facility evacuation or other emergency will be monitored or controlled. Does your command center have a separate HVAC system? Does the command center have back-up power? Are there simple, easy-to-read emergency action plans in the command center for the staff to use, or do you expect the staff to remember what steps to take in an emergency? The emergency action plan should include, at a minimum, plans for handling:
o Fire
o Elevator entrapment
o Flooding
o Local natural problems (earthquakes, tornados, etc.)
o Hazardous material spills
o Medical emergencies
o Loss of electrical power
o Armed intruders
o Hostage situations
o Bomb or terrorist threats
o Suspicious packages
o Workplace violence
o Civil disturbance

The odds are in your favor that you may never have to handle one of these emergencies, but wouldn't it be easier to sit down and develop a simple plan of action beforehand than to try and figure out a plan as the emergency goes down?

High-risk Areas
Now we have gotten into the building, where are the strategic areas of the facility that require greater security coverage? Does your company or any some of your tenants rely heavily on technology? You may have carefully secured the server rooms, but how secure is the phone room where all phone lines and Internet access come into the building? I have reviewed far too many buildings where the computer/server rooms are beautifully secured with even biometric systems and the phone room was found unlocked right off the main lobby in a semi-public area. A person wanting to disrupt your business or have access to your secrets just needs access to that phone room. Make sure the phone rooms are secure and monitored.
What other strategic areas are in your building? It could be a filing room, a safe, a money counting room, etc. What work area is the most important to your business or function? Be sure to place an additional layer of security around these strategic areas. This layer can take the form of physical or electronic access control, CCTV monitoring, intrusion alarms or security staff. Post signs at each of these strategic areas indicating "Authorized Persons Only."
Depending on the level of risk in your building, another security concern comes with mail and other deliveries. If you have a high-risk building, does your mail get delivered and handled in a separate messenger center? Does this message center have a separate HVAC system? Does the staff in the message center have adequate training and access to safety equipment such as gloves, masks and plastic bags? Does the staff have training in how to handle suspicious packages and who to contact in the event a suspicious package is found?

Levels of Response
Now that you have layered the security of your facility you have one additional concern. What will your security levels of response be? What we have described so far are the layers of security planned for your building on the average workday. What if your facility comes under some form of alert? A neighborhood protestor or a disgruntled ex-employee may direct a threat towards your building, company, tenant or area.
You need to develop a plan for additional layers of security in the event of such threats. Will you add security staff? Will you shut down some access points? Will you increase access control? Will you increase package inspections? By having an increased security plan already in place with your staff trained in their new duties, when a threat comes around, you are ready and don't have to start planning on the fly.
As you can see, planning the security of your facility comes in layers of organizational, mechanical and natural security. By using all these areas of physical security, you can develop a security program that is both effective and cost effective.

About the Author: Richard D. (Rich) Maurer is a senior associate in the Security Services Group of Kroll Inc, the risk consulting company. He has more than 30 years of experience as a law enforcement and security manager. He also is the vice-chairman of the ASIS Physical Security Council. Rich manages risk analysis as well as security reviews of government, corporate, hospital, retail and educational facilities nationwide. If you have questions, Rich can be reached at [email protected] or at 678-232-8768.