Security planning

Security planning is the process of identifying the threats to your assets and people, and developing a plan to reduce the risks they create. A good plan gives a clear roadmap for managing security across people, buildings, information and other key assets — and it needs buy-in from senior management to work.

Risk assessment

Before planning, talk to stakeholders to:

• Identify potential threats and vulnerabilities, with emphasis on insider threats.
• Analyse the likelihood and impact of each risk.
• Understand the business impact of a potential breach.

Once risks are identified, develop a metric for the impact a breach would have — harm inflicted, business and asset loss, compromises, and threat to people. This gives a Business Impact Level (BIL) score that reflects how a security risk affects your business. Classify and protect against each risk with that impact in mind.

Security measures

Once risks are identified, choose measures to mitigate them. A plan should include:

• Physical security controls — access control, surveillance, perimeter protection.
• Information security policies and procedures to protect sensitive data.
• Clear roles and responsibilities for security management.
• Continuous security awareness training for employees and contractors.

Measures need to provide enough delay for planned responses to act. Cover security governance, security personnel, information protection, physical asset protection, and the safety of employees and contractors.

Business continuity

When a breach happens, your business still has to deliver at pre-defined levels. A business continuity plan keeps critical functions running during and after a disruption, and sets incident response procedures. Document the response to natural events, resource loss and security threats. Keep the plan simple, straightforward and usable — simple templates and checklists make it accessible to everyone.

Continuous improvement

A plan is only as good as its context at the time it was written. Without a process to improve it, even a robust plan becomes ineffective as conditions change. Always:

• Review and update security plans and procedures as threats emerge.
• Run security audits and exercises that test the effectiveness of your measures.
• Train personnel through mock drills that test, assess, practise and improve the plan.

Security exercises validate the assumptions made during planning and surface gaps and capability issues in the response team.

What this does not cover

This guide covers how to build a plan. It does not cover the legal authority to deploy guards (a PSARA licence, granted state by state) or the supervision and reporting model that makes a vendor accountable — those are separate decisions covered in the vendor-selection and due-diligence resources.