The role of security in disaster preparedness and response

Disasters — natural or man-made, accidental or deliberate — disrupt the infrastructure and services an organization depends on: power, water, communication, transport and healthcare. Organizations that have planned ahead recover faster; those that have not find themselves making decisions under pressure with no plan.

Security is a core part of both halves of that work: preparedness (the actions taken before a disaster to reduce its impact) and response (the actions taken during and immediately after to save lives, protect property and restore services). There is a third phase that gets less attention and decides how long the disruption lasts: recovery, when the site is vulnerable precisely because it is not yet working normally.

Preparedness — reducing the impact before it happens

Preparedness is not a document. It is a set of decisions made in advance so that nobody has to invent them during an incident.

• Risk assessment — security helps identify the hazards and vulnerabilities that matter for your site, so plans are built on the real exposure rather than a generic template. The security risk assessment method produces the ranked list this phase depends on.
• Contingency planning — who does what, where the assembly points and control room are, how access is controlled during the emergency, and how the site is protected once normal operations stop. Assign the roles by name and by deputy: an incident that takes out the site manager should not also take out the plan.
• Implementing measures — hardening access, safeguarding critical equipment, and defining how security assets (guards, patrols, control rooms) behave in an emergency. This includes the unglamorous details: which doors must fail open for evacuation and which must fail locked, and how you achieve both. Much of this duty is also statutory for the employer — the Occupational Safety, Health and Working Conditions Code, 2020 is where workplace safety and health obligations, including emergency arrangements, largely sit.
• Testing and updating — plans that are never exercised fail under pressure. Regular drills test both the plan and the people, and update the plan when the drill exposes what it got wrong.
• Pre-agreed escalation — the names and numbers of the people who are woken up, in what order, for which class of event. Deciding this at 3am is how hours are lost.

Response — keeping order when normal order is gone

The first hours of a disruption are chaotic because the systems that normally coordinate people have stopped. Security is the function already organised to operate in that condition: staffed around the clock, in communication with each other, and used to working from procedure.

• Situational awareness — the security team is often the first to see what is happening across the site, and can feed one coherent picture to incident command instead of a dozen partial accounts.
• Safety and order — security controls access, keeps people moving out rather than milling about, accounts for who is on site, and keeps onlookers, troublemakers and opportunist looters away from the site.
• Protection of the facility — after the immediate incident, an evacuated site is vulnerable to theft and vandalism, and its equipment is exactly what a recovery needs. Guards protect it while operations are down.
• Supporting the emergency services — a site that can tell firefighters where the gas line is, or tell police who was on site, saves time that matters.
• Communication with families and staff — security can hold the perimeter and the information desk, so operations leadership can concentrate on the response.

Recovery — protecting the site while it is not working normally

Recovery is the longest phase and the least planned. The building is standing, but systems are down, records may be inaccessible, staff are working unusual hours, and contractors arrive who nobody has vetted.

Security’s job here is to keep the site safe enough to rebuild:

• Control re-entry — decide who may come back, when, and under what supervision, rather than letting the site fill up as people return.
• Vet and escort contractors — recovery brings unfamiliar trades onto the site, often working outside normal hours and near damaged structure. They need induction and escorting like any other new presence.
• Protect salvage and stock — goods, equipment and records are at their most exposed while being moved, stored in temporary locations, or left in the open.
• Preserve the incident scene — where an investigation will follow, securing and preserving the scene is a security responsibility, and it has to be decided early or evidence is lost.
• Stay on duty past the point of interest — the temptation is to stand security down as soon as attention moves on. The risk window stays open until the site is genuinely operational again.

Building security into continuity planning

The practical test of whether security has been folded in properly is whether it appears in the plan by name. Look for:

Question	Why it matters
Is there a named security lead for the incident, and a deputy?	Unassigned roles are unfilled roles.
Does the plan state how the site is secured if it is evacuated?	The most predictable post-incident loss is theft from an empty site.
Are guard force and patrol arrangements in the continuity plan, not just the security policy?	A plan that assumes business as usual for security fails in the first hour.
Has the plan been exercised with the security team present?	A drill that skips security tests an untested assumption.
Does it say who authorises re-entry, and to whom they report?	Re-entry decisions are made under pressure by whoever is present.

Organizations that treat security as a line item in the continuity plan rather than a spectator to it recover faster, because the function that holds order is already standing when order is what the site has lost.

Frequently asked questions

Is security really part of disaster preparedness, or is that the continuity team’s job?

Both, and the split matters. Continuity planning owns the business decisions — which functions must keep running and in what order. Security owns the physical conditions that make those decisions possible: access control during the incident, accounting for people on site, protecting the site once it is evacuated, and controlling re-entry. A continuity plan with no security provisions assumes the site stays orderly without anyone holding it.

What is the single most common gap?

Security being written out of the plan. Sites routinely plan for data recovery, alternative premises and staff communication, then find that nobody has decided who guards an empty building overnight, or who authorises re-entry. Those are predictable losses, and they cost little to prevent if they are decided in advance.

How often should the plan be exercised?

At least annually, and whenever the site or the operation changes materially. Involve the security team in the drill rather than notifying them afterwards, and log what the exercise exposed. A drill whose findings are not written down becomes a rehearsal for the same mistakes.

Who should lead security during an incident?

Someone with the authority to make access decisions under pressure, plus a named deputy. The person on duty may not be the person with that authority, so the escalation path has to be written down along with the thresholds that trigger it.

Does this apply to a single site, or only to large operations?

It scales down rather than away. A single-site business still needs to answer who secures the premises if it is evacuated, who decides when staff return, and how unfamiliar contractors are controlled during recovery. Fewer people doing more of the jobs makes the questions sharper, not optional.

What should the plan cover beyond fire and flood?

The events this site can actually face: utility loss, loss of connectivity, a security incident or intrusion, the sudden absence of a key person, and supply disruption. Generic lists are easier to write and less likely to be read.

The bottom line

Disasters are disruptive partly because they remove the normal order. Security is the function that holds the site together before, during and after: it identifies the vulnerabilities beforehand, keeps order and situational awareness during the event, and protects the facility while it recovers. Organizations that fold security into their disaster planning are not just more protected — they recover faster.

If you are reviewing your continuity plans and want the security layer built in properly, send us your sites and the risks you are planning for, and we will confirm how the security operating model fits.