Security Executive Council Faculty Advisor

Preparing for Crises Beforehand

Q. My company has gone through a couple of damaging incidents recently and we were not well prepared. What are some tips on making sure we’re prepared better next time?

A. As a business continuity professional for several large companies, I have witnessed countless incidents where we could have been better prepared. Before each crisis, the companies that I was with had a decent plan in place. After the incident recovery phase, we had a better plan. Regardless of the maturity of your security department, there are always key learning opportunities that come from managing an incident (for example, supply chain disruption, natural disasters, loss of proprietary information, workplace violence, product contamination).

These are some important questions to ask ahead of time. Is your organization ready to handle a specific crisis? Do you have different teams set up to manage all facets of response and recovery? I’ve always been a fan of the crawl, walk, run philosophy. Start small. Talk to colleagues and benchmark your program against theirs – What does their internal training look like? What are they outsourcing? Evaluate your top risks. Garner buy-in from your “C” suite by meeting with them and explaining the soft and hard benefits of having a robust, wholistic business continuity program. Educate stakeholders. Get your phone lists together. Establish a primary and secondary crisis meeting room. Run a table top exercise.

Don’t assume that someone on the crisis management team will handle the event well due to their title or experience. The leadership required to manage each crisis is unique and truly situational. Look for opportunities to partner with other companies that share best practices across industries and to elevate your current program and mitigate future risks. Collaborate with colleagues on proven solutions that they’ve utilized to prevent, respond to, and recover from an incident. Some of these may include notification systems, public/private partnerships, and/or physical security measures.

Answer provided by Dean Correia, Security Executive Council Tier 1 Emeritus Faculty Member.

Contingent Workforce – Screening & Clearance

Q.  My company takes painstaking efforts to ensure that all of our employees are properly background screened and vetted to help ensure the safety and security of company personnel and assets. However, I can’t say with confidence that the same is true for the rest of our modern day workforce of temporary help, contract workers, on-site suppliers and vendor personnel.  How do I ensure that the same level of diligence is put forth in vetting these “outside” workers who have similar access privileges to company facilities, personnel and information? 

A.  Good question!  Many companies do not insist that their selected vendors, suppliers and contractors screen their workforce with the same diligence that the company screens their own employees;  often times giving these “outside” workers the “keys to the store,” granting them open access to people, facilities, property and information.  Not only is it a good business practice to vet your suppliers, vendors and contract workers but you may be contractually and/or legally obligated to do so.  So what can you do to help ensure your contingent/outside workforce is vetted to your required level of clearance?  Consider the following suggestions:

• Develop a company policy that requires contingent worker background checks to be conducted; a policy that addresses who, what, when, where and how.

• Develop and implement contractual agreements with suppliers of contingent personnel to vet their representatives to a specified level, conducting the required background checks to help ensure a mandated level of clearance. Be sure that your contractual requirements do not run afoul of local law, industry regulations or company culture. 

• Determine what your company's contractual, regulatory or legal obligations are related to the background screening of your contingent workforce.

• Define your screening objectives by outlining both the overall and specific purposes and results.

• Determine what, if any, process differences are necessary to address different jobs, workers, suppliers, contractors or vendors.

• Determine what level of involvement you and/or your company needs to have in the actual background screening and clearance process.

• Determine who and how background checks and clearances will be communicated from the contingent workforce to your company.

• Develop and distribute subject related communications to all parties involved; outlining rules, roles, responsibilities and expectations.

• Determine who or how the costs associated with these background screenings will be addressed.

• Determine a conflict resolution process; identify how and who will address debatable screening results and issues.

Developing a process to accomplish your contingent workforce due diligence objectives should be specific to your industry, business structure and company culture; something that helps to ensure proper screening without impeding workflow, business operations or being detrimental to company culture. Be sure to include partners, e.g., Human Resources, Business Operations and Legal that are critical to implementing and maintaining an effective contingent workforce due diligence program.  Help your vendors, suppliers and contractors understand how important due diligence is to your company and what the benefits are to them of having a vetted workforce.

While nothing is fool proof and even with the best of due diligence programs someone or something can slip through the cracks, a properly designed and executed contingent workforce screening program is one more component of a safe and secure workplace.  It’s your business at risk, including your operations, brand, customers and employees.   It does not matter that the person responsible for a data breach is a vendor with false credentials. It does not matter that the person who suddenly becomes violent in your workplace is an on-site supplier with a history of violence. It does not matter that the person who fails to comply with check and balance procedures enables a million dollar fraud to occur is a contractor with a criminal record.  It is your reputation, your customers, your employees and your operations that are at risk.   Know who has the “keys to your store.”

Answer provided by Kenneth Kasten, Security Executive Council Emeritus Faculty.

 

Mitigating Security Related 10-K Risks

Q. My Board of Directors is asking what the security department is doing to mitigate security-related risks outlined in our 10-K report. How do I respond?

A. Even though you may not have an immediate answer, there’s good news in them asking the question.  Boards have become more educated on and in tune with enterprise risk management.  The 10-K form is an annual report required by the Securities and Exchange Commission for publically traded companies that provides a comprehensive summary of company performance well beyond the high gloss “tabletop” books that we associate with a company’s annual report.  Within the 10-K report is a section on risk factors.  It’s here that the company will lay out anything that could go wrong, likely external effects, possible future failures to meet obligations, and other risks disclosed to adequately warn investors and potential investors.  A number of these risks are directly related to the Chief Security Officer’s (CSO) charter and responsibility.  There’s nothing hidden here – your company’s 10-K report and risk factors can be found in the Investor’s Relations section on your corporate website.  CSO’s and their staffs need to understand their company’s 10-K risks and, ideally, the CSO will align his or her personal and program goals against these risk factors, creating what I call the “10-K Security Quotient.”  CSOs with lower 10-K quotients are typically more aligned with executive management’s view of risk and what is important.  Higher quotients indicate misalignment and may raise questions on whether the CSO is addressing the appropriate risks.  A CSO can establish an aligned approach and lower 10-K quotients through research and thoughtful planning.

Answer provided by Mark Lex, Security Executive Council Emeritus Faculty member and author of the upcoming book, “The 10-K Security Quotient.”

 

Environmental Health & Safety Risk Assessments

Q. As CSO, I recently had a meeting with the head of our Environmental Health & Safety group regarding a security risk assessment that we recently completed for them. They do not think that the validity and sophistication of our risk assessment is on par with what they are doing in EH&S. Where might I be missing the boat?

A. Although some older security risk assessment models are not on par with EH&S standards, many EH&S programs use the identical qualitative models as security.

The Nuclear Regulatory Commission (NRC) and Department of Energy (DOE) national laboratories advise against using formal quantitative risk assessment processes – widely termed probabilistic risk assessments (PRAs) – for security because it is virtually impossible to predict the frequency of malevolent initiating events, e.g., cyber attacks such as Stuxnet, terrorist attacks or insider disruptions. The best practice is to conduct a qualitative risk assessment that relies on expert judgment, with a "light touch" of quantitative analysis.  EH&S has the flexibility to use models that are more quantitative in nature because they have quantitative data on potential initiating events and their consequences; for example, the mean time between failures, pressure capacity, heat factors, feedstock dynamics, maintenance dynamics, etc.

The models in use now troughout the US and in many foreign countries for security and safeguards risk assessments (including cyber security risk assessments) are derived from expert agencies such as the American Petroleum Institute, American Chemistry Council, National Petroleum Refiners Association, Sandia National Laboratory, Argonne National Laboratory, National Petroleum Refiners Association, DOE laboratories and the NRC. The European Union has recently issued an energy sector security risk assessment model that is qualitative in approach.

From a historical perspective, in 1990, DOE tasked the National Institute of Standards and Technology (NIST) to analyze options other than quantitative risk assessment in the security arena because quantitative assessments were perceived as being too costly, too time consuming and the results deemed unnecessarily complex.  NIST concluded that qualitative risk assessment, if properly executed, yielded virtually the same result with significantly lower expenditure of resources.  A more recent example of this shift was the 2005 Department of Homeland Security (DHS) RAMCAP model.  This highly quantitative model – written by the American Society of Mechanical Engineers (ASME)—was discarded by DHS and the critical infrastructure community in favor of CCPS-equivalent qualitative methodologies for the same reasons.

I highly recommend that you visit the websites of the organizations identified above and do your research prior to conducting EH&S or security risk assessments. Then, take the time to communicate with the EH&S staff and management to get a thorough understanding of their risk management expectations and why they take exception to qualitative approaches.  You may find that they, in fact, use qualitative tools—such as HAZOPS, FMEA, scenario analysis, etc. You may also be able to format your security qualitative model to more closely align with other organizational qualitative models so that your process virtually mirrors theirs. This can be critical to achieving organizational buy-in.

Answer provided by John Piper, Security Executive Council Subject Matter Expert Faculty Member.

 

Reductions in Force (RIF)/Lay-Offs Guidelines

Q:  Reductions in force (RIF) /lay-offs seem to be a regular part of today’s business world.  I would like to develop a checklist/guideline to help consistently and appropriately address security items and concerns generally associated with these types of events.

A:  It does seem that there are more employment reductions in force than ever before, thus enhancing the opportunity for a potential security issue to surface during an involuntary separation of employment. I would encourage you to develop a checklist/guideline that addresses all employment separations -- both involuntary and voluntary.  While there are common recommendations for these situations, your specific guideline and process should be unique to your company. Local law, contractual agreements, industry regulations, and company posture will all impact what your security guidelines should contain.

First and foremost, whatever guideline that is developed must support your company's policies and procedures regarding this topic; it is very important to have the support of Business Operations, Human Resource and Legal departments.  Your objective is to support and facilitate a safe and secure transition for the company, the soon to be terminated employee(s) and the employees who remain.  

Consider implementing the following processes:
  
• Collect and cancel all company issued credit cards.
• Collect company owned equipment to include computers.
• Collect, cancel or change all access privileges.
• Collect all company owned/leased vehicles and related accessories.
• Upon notice of the voluntary separation of an employee, immediately assess whether the individual poses a business risk.
• Notify security or senior management if the employee being involuntarily separated poses a potential physical threat or business risk.
• Offer Employee Assistance Program benefits, if appropriate.
• Address any outstanding compensation or debts.
• Have a clear understanding of how a separated employee's personal belongings are to be handled.
• Develop a company position and standard policy regarding exiting employees from company facilities.
• Develop a standard announcement for changes in personnel after voluntary or involuntary separations.

A well thought out and company supported employee separation security guideline/checklist will benefit all involved; helping to provide the training and direction to whomever the duties of notification and separation fall upon.   While a checklist is not fool proof and may not prevent or address all potential security concerns associated with these types of events, it should certainly aid with consistency of process and program application.   However or whatever you do; remember the phrase “Discharge with dignity.”  It will serve you well.  

Answer provided by Ken Kasten, Security Executive Council Emeritus Faculty member.

Editor’s Note: Guidelines provided by Council Faculty should not be construed as a means to establish any legal standard of care or identify what reasonably prudent security precautions should be taken in any specific situation.  The actions to be taken for individual situations will vary depending on the corporate culture and individual circumstances at the time.

Please visit the Security Executive Council's website to see additional details on the processes mentioned above.

Are We Using the Wrong Metrics to Measure Workplace Violence?

Q. Reports show a decrease in fatalities related to workplace violence, yet we are not seeing a downward trend in threats, assaults, intimidation, and the like in our organization. What does this mean?

A. Workplace violence is typically measured by the number of fatalities. However, due to many factors, including improvements and advancements in medical technology, a more accurate measurement of the effects of workplace violence might be to monitor the instances and effects of nonfatal assaults.

The term “workplace violence” is used to describe a wide range of behaviors such as bullying, intimidation, threats, assault and homicide. Fatal work related injuries are routinely reported but nonfatal injuries may not be.

According to the Bureau of Labor Statistics (BLS), workplace homicides declined 1 percent in 2009, in contrast to an overall decline of 17 percent for all fatal work injuries. The preliminary workplace homicide count for 2009 (521 cases) represents a decline of about half from the high of 1,080 homicides reported in 1994.  Workplace suicides declined 10 percent from a series high of 263 cases in 2008 to 237 cases in 2009.  However, this 2009 preliminary count of workplace suicides is the second highest annual total reported by the fatality census.

Violence at work is underreported, particularly since most violent or threatening behavior—verbal threats and abusive language, hostility, harassment and other forms, such as stalking—may not be reported until it reaches the point of actual physical assault or other disruptive behavior.

The BLS data indicates that fatal occupational injuries due to assaults and violent acts were actually down 8% between 2007 and 2008 (864 in 2007 to 794 in 2008). But, during the same period, office suicides reached an all time high since the data has been captured by the BLS (251 in 2008 compared to 196 in 2007) – a 28% increase.

In 2002, Liberty Mutual, in its annual Workplace Safety Index, cites “assaults and violent acts” as the 10th leading cause of nonfatal occupational injury, representing about 1% of all workplace injuries and a cost of $400 million.

According to the BLS 2005 Census of Fatal Occupational Injuries, the number of deaths between 1992 and 2004 ranged from a high of 1,080 in 1994 to a low of 551 in 2004.
The rates of non-fatal work-related assault injury are much greater and have different characteristics than fatal injuries. These nonfatal injury patterns need to be considered when estimating the burden of assault injuries on businesses, and can help identify the most effective prevention strategies.

In our opinion, the stats quoted above give credence to the notion that we may not be using the correct metrics and perhaps should be using different measurements that demonstrate the effects of violence in the workplace, rather than focusing so much on the number of fatalities.

Answer provided by Bob Hayes, Security Executive Council Managing Director, and Rosalind Jackson, Security Executive Council Staff Member.

Protocol for Executive Protection Agents Overseas Attire

Q. What is your opinion/experience regarding the dress of executive protection agents working overseas? Do most companies normally expect the security driver and EP agent to dress in business attire or in regional dress in an attempt to not stand out? For example, would a protection detail in Saudi Arabia dress in traditional Arab dress or a business suit?

A. I don’t think there is any one absolute answer to your question. What would be considered appropriate dress for a protection agent would depend upon the person, assignment or duties (driver/specialist/guard) as well as the particulars (setting, purpose, destination, client, profile, visibility) of the specific protection detail. What may be appropriate dress for one assignment, person or detail may not be for another. For instance, a protection agent on assignment at a beach resort providing protection services to a teenaged client would most likely dress differently than one providing protection services to a business professional attending a formal event, or a day at the market with a small group of people.  Some situations may call for highly visible protection services (uniform) while others dictate a low profile (casual regional) dress.
 
Like most security situations the “best” solution will be situation specific, choosing the options that best support situational objectives and settings. When arranging for protection services, be sure to clearly state assignment objectives, provide a complete itinerary, describe client preferences and indicate assignment expectations; all of which will help determine the most appropriate agent dress throughout the assignment.

Answer provided by Kenneth Kasten, Security Executive Council Emeritus Faculty.

Business Continuity Through Internal and External Partnerships

Q.  I am looking for specific ways that I can strengthen our business continuity program both internally and externally.  In today’s challenging economy, I want to make sure that we are doing everything that we should.  Are there any best practices on this?

A.  In planning to enhance an existing business continuity program, we ask, “What do I hope to achieve?” and then identify the specific objectives.  Regular evaluation of programs and activities provides needed metrics and probably is one of the motivating factors to enhance the program.   Here are some best practices that can help, which can be modified to fit your needs.

Inviting major suppliers, as well as local police and other first responders, to participate in tabletop exercises can be very useful in helping to strengthen response capability and enhance relationships.  For example, you might develop an exercise that gets the major supplier involved in an activity that demonstrates how an effective business continuity program can significantly impact them.

Equally, hosting a company/supplier/first responder tabletop exercise can build critical connections as well as develop external partnerships.  More importantly, understanding how police and fire would respond in a crisis situation could identify critical emergency response resources that you were not aware of. The value is that the company enhances their level of crisis management through tabletop exercising by integrating major suppliers and/or first responders into the process.

During a recent tabletop exercise, the value of developing external partnerships became apparent.  An investigator with the Federal Railroad Administration was participating who shared with everyone that in the past they had shut down a rail line for over a week in order to investigate a train accident due to suspected sabotage.  Clearly, losing your main rail line for seven days or more could seriously impact business operations. This external partnership provided insight into how a company can build resilience and sustainability into shipping and receiving operations through collaborating with external entities.

Risk, threat, or vulnerability assessments should be conducted on all business departments within the company and, again, be sure to include first responders. Engage nontraditional business units in assessing risks, as there could easily be unknown critical impacts.  Additionally, this process can further relationships with internal stakeholders. 

Require major and critical suppliers to allow you to participate in their assessment processes.  For example, some businesses have extended the assessment process to involving the public sector, such as a large upscale shopping mall inviting the local police and fire liaison to review the process, resulting in the mall modifying their strategy as a result of learning new information.

There is great value in identifying and managing risks through engaging non-traditional partners that will enhance program impacts.

Emergency response is a critical component of a business continuity program.  Are the right stakeholders involved in response activities?  For example:

- If it appears that the company’s response capabilities are spread thin, then look deeper into the company for other nontraditional units that could assist in some capacity. 
- Part of the business continuity program should have established relationships with police, fire, health, and emergency management officials.  
- Contact adjacent businesses to your facility to discuss how area businesses could form joint response capabilities. 

The value is an enhanced company response program that incorporates joint responsibility through collaboration.

In auditing the business continuity program start first with completing a needs evaluation, then plan the objectives based upon what those needs are.  After that, start identifying internal and external stakeholders.  Always review your plan with the leadership to ensure support.  Finally, be persistent, positive, and start building the business continuity program through relationships and task performance. 

Answer provided by Brit Weber, Security Executive Council Subject Matter Expert Faculty.

Holding Contractors Accountable

Q. Our supply chain relies on many third party contracted suppliers to provide their transportation services for our products and goods.  How can we hold the suppliers accountable for meeting our security expectations?

A. Whenever a cargo or package transportation company is relying on contractors, third parties, or suppliers to have access to the trusted goods they are handling, specific security steps need to be taken.  Because a company is relying on another supplier to support its transportation services, it needs to ensure no less than its own security standards are being followed.  The transportation company needs to design and implement a draft that outlines the security requirements it expects of any business partner who is being given access to their goods and services.  After drafting a list of requirements, it should given legal scrutiny.  This draft should ultimately become a security addendum that can be associated with the contract agreement between the transportation company and it’s respective suppliers.

• Include in your contract requirements that any employee of the supplier who has access to the cargo or packages must have successfully passed a criminal background check.  I suggest you stay consistent and use the same standards that you on employees. 

• Include any security requirements that your customers have in contracts with you.  If they expect it from you, the same will hold true for your contractors and suppliers. 

• If you have specific security requirements that you would follow in your operations and these services are being contracted in your behalf, by a supplier, state those requirements in the addendum.  Ones that come to mind are using truck or container seals, not leaving vehicles unattended, securing facilities where your cargo is transiting, etc. 

• Get your legal department involved early in the process to include language stating that the supplier will be liable for negligence or failure to adhere to your security requirements when acting on your behalf. Your addendum needs to express that the supplier will be liable for full coverage for any claim resulting from their failure to follow your security requirements.

• Establish ongoing auditing processes to provide you with feedback relative to the supplier’s security performance.  In your contract security addendum, include a requirement that security audits will be implemented.  You may need to have your operations management be involved with the supplier audit activities, which will re-enforce their ownership of your security program.  It also lets the supplier know that this is an organization security program not just a corporate security one.

• Make certain that your suppliers are insured at a level that will cover losses or damages to any of your products or goods.  This is particularly important when using supply chains that are moving high risk or high value products.  

• Strong language in your supplier contracts holds them accountable to compliance.   They cannot afford pay for major mistakes or failures.  

By developing a supplier security addendum that is consistent with your internal security standards, you have taken the first step toward accountability.  The next step should be to have an assessment process, one that checks to confirm the business partner is living up to the requirements in your addendum.

The last steps of this process should be to support and ensure the suppliers have training and awareness processes that influence assurance to the addendum standards.   The effective security manager will find a way to manage their business partners to ensure that security levels are consistently followed.  Make sure you have your suppliers included in your security assessment and audit processes.  The policies in your program need to have feedback that compliance is being maintained.  Develop a relationship with the business partner that includes an ongoing assessment for compliance.  Be proactive with knowing how the supplier is performing against your security expectations. 

Answer provided by Peter Cheviot, Security Executive Council Faculty Emeritus.

Travel Destination Security Intelligence

Q.  I have responsibility for travel security in my company and I’m concerned about potentially dangerous places people might be traveling to. Where can I obtain travel destination security intelligence?

A.  Travel security destination intelligence is available through a number of sources, all of which have their own individual strengths.  Publicly (no fee) available information can be found through a number of government sources. The US Department of State and the US Overseas Advisory Council (qualified membership required for complete access) provide a wide variety of information to included specific country travel alerts, travel warnings and general information regarding such items as: entry and exit requirements, local customs, climate, transportation and medical advisories.  In addition, they provide an abundance of general travel security tips. The US Embassies are valuable sources of information providing up-to-date intelligence concerning current affairs, upcoming events and local emergency information.

For a boarder perspective consider other country (non US) government sources of information offering different perspectives and experiences. These sources present similar types of intelligence to their citizens and on occasion issue different risk ratings and general conclusions. Examples include: Australia – Department of Foreign Affairs and Trade, Canada – Foreign Affairs and International Trade Canada and the UK – Foreign & Commonwealth Office.

Don’t forget public news services as a vehicle to information about local happenings (weather, civil unrest, holidays) and the political climate. 

Peer information can be a reliable source of “on the ground” intelligence. Business associates, industry peers, professional associations can all provide additional insight.

Fee based services can be another source of destination intelligence with some offering “one stop” travel security shopping. Through strategic alliances these fee based services are often provided by your company’s business travel service provider at discounted rates or as part of the contracted travel agreement.  Additionally, a simple Internet search (travel intelligence, travel security) will point you in the direction of numerous fee based services; many of which can be customized to meet your individual or company needs, offering varying levels of services at a variety of prices.

Destination Intelligence is only one part of a travel security and safety program.  Policies, training, expert services, due diligence, communications, traveler profiles and emergency plans are a few of the more important components of a successful travel security/safety program.

Answer provided by Kenneth Kasten, Security Executive Council Emeritus Faculty.