One of the most difficult challenges that an organization’s mid- and high-level security leaders often face is articulating the value of people and technology security investments in a way that’s meaningful to financial and other approval stakeholders.

Q:    I’ve been asked to include the “outcomes” from each item in my security budget. I’ve already explained the risk mitigation. What am I being asked for?

A: They’re asking what the organization will be better able to accomplish because of the investment. These outcomes help decision-makers determine the business value and relative priority of competing investments.

Risk mitigation explains what the investment is intended to prevent. Outcomes explain the organizational capabilities it establishes or strengthens, and the business results those capabilities enable. Thinking this way requires a mindset shift from implementing physical security solutions to establishing an organization's security capabilities.

Organizational Capabilities and Business Value

Organizational capabilities exist to enable an organization to perform its critical work consistently and effectively. In manufacturing, that work is organized into the organization's value streams—the end-to-end activities that create value for customers. Security capabilities therefore contribute business value by helping protect those value streams from disruption, impairment, or compromise. Protecting a company's value streams safeguards the company's backbone.

Organizations that use Lean Six Sigma often document their value streams in detail. Although developed to support operational improvement rather than physical security, these value stream maps provide an excellent reference during facility physical security risk assessments. More broadly, security assessments should leverage any existing business process documentation because it reflects significant organizational knowledge and investment. Using that documentation not only improves assessment completeness but also extends its business value by helping identify where physical security risks could impair the organization's ability to create value.

Revealing the Hidden Business Value of Physical Security

Site physical security assessments provide far more than a prioritized list of security improvements. They provide a structured opportunity to understand how the organization operates, how it creates value, and where physical security capabilities can best protect that value. By connecting business operations with physical security expertise, security practitioners can identify risks and opportunities that stakeholders often recognize operationally but do not naturally view through a physical security lens.

The purpose of assessment stakeholder interviews is not to have stakeholders identify physical security risks. It is to help the assessor understand the organization's operations well enough to identify where physical security risks could impair business performance.

Stakeholders are experts in their operations. Security practitioners are experts in identifying how physical security risks may affect those operations. This means that in site security assessments, instead of asking security questions, you ask operational questions.

For example:

• Walk me through your process.
• What must go right every day?
• What events would significantly disrupt your work?
• Which activities depend on specific people, places, or equipment?
• What concerns you most about maintaining operations?

Those questions are much easier for stakeholders to answer because they're speaking their own language.

One reason consultants and security practitioners often do not ask these questions is that they already understand how physical security measures, such as an additional layer of access control or biometric authentication, can reduce many potential security risks. However, without understanding the operational context, they cannot fully appreciate the business consequences of those risks or clearly articulate the business value of their recommendations. As a result, the true value of effective physical security often remains hidden from both the security practitioner and the stakeholders.

The objective of stakeholder interviews is not to collect security information—it is to develop sufficient operational understanding for the security practitioner to apply professional physical security judgment.

Where Business Value Is Discovered

Operational knowledge resides with the stakeholder. Physical security expertise resides with the assessor. Business value emerges when those two perspectives are combined.