Security costs money. Fences, gates, cameras, card readers, training, security guards – all are important parts of a security management system, but all cost money. Getting your organization’s board of directors or executives to add appropriate numbers to the budget is often a challenge. Boards and executives like numbers – give them data and they will be more likely to spend the necessary money.
Data comes from a risk assessment; by having your current security systems assessed, your organization can have real data about what you currently have and your site-specific threats. This kind of data can help your organization create a roadmap to where you ideally want to be in term of security. Data plus a roadmap are important tools when approaching your board or executive level management about the budget.
If it were up to us and money were not an issue, we would have everyone install the latest and greatest equipment. But we live in the real world where money is not unlimited and where line items need to be justified. This is why having a risk assessment performed and creating a roadmap based on the results are the best things you can do before going in front of your board. Data can help you justify security-related budget items.
Most of the schools that we assess here at Invictus Consulting have a solid and detailed plan for emergencies and crises. With that said, many emergency plans do not account for reunification of parents and students if there is a need to evacuate the campus. We regularly find that schools specify a reunification location but no reunification procedure. A reunification plan is a plan that contains details on the specific orchestration for administrators, teachers, staff, and students as they arrive at the reunification area.
One critical aspect of any Crisis Action Plan is accountable reunification of students with their parents or guardians in the event of a school crisis or emergency. A pre-determined, practiced reunification method ensures that the reunification process will not further complicate what is probably an already chaotic, anxiety-filled scene.
Remember that a reunification plan is a plan not a place. A proper reunification plan can be executed at any location. In brief, the reunification process should include:
Establishing a Student Staging Area
Establishing a Parent Check-In Area
Delivering students to the staging area, beyond the field of vision of parents/guardians
Directing parents and guardians to the Parent Check-In Area and helping them understand the process
Having parents and guardians sign Reunification Cards
Having runners recover students from the Student Staging Area
Establishing controlled lines of sight allow to communication and other issues to be handled more easily
Anticipating medical or investigative contingencies
Integration with first responder personnel
A reunification plan should be created by security professionals or your school’s security management team and be reviewed and practiced on a regular annual basis. Online training by the Federal Emergency Management Agency (FEMA) for an Introduction to Incident Management for Schools will help school personnel understand the basics of an Incident Command System, which is a standardized, on-scene, all-hazards incident management approach. This course is three hours and can be taken at the following website: https://emilms.fema.gov/IS100SCA/index.htm.
You may have seen signs or posters in New York City, where the MTA (Metropolitan Transportation Authority) has partnered with DHS on this initiative. The premise of this program is that informed and alert citizens play a critical role in keeping their communities safe. In other words, ordinary people (i.e., people that are not trained in law enforcement, surveillance, or security) can aid law enforcement and security efforts by alerting the authorities when a person is acting erratic or when an object is unusual for the location. By knowing what is “normal” for your everyday environment – your home, commute, work, gym, grocery store – you will be better prepared to notice (AND REPORT) when something is out of place, whether that is a suspicious person, a suspicious object, or a suspicious vehicle.
This type of campaign can be an important part of keeping your workplace safe. Workplaces should have a clear chain of command for reporting suspicious persons, activities, vehicles, or objects. Training your employees how to notice suspicious activity – like a person asking to be let in to a secure area without the proper credentials or a person who seems to be conducting surveillance on the building’s entrances – is the first step in awareness. Training your employees what to report is also important. When reporting suspicious persons, activities, or objects, people should note who or what they saw, where they saw it, when they saw it, and why it is suspicious. It’s also important that your employees know who to report to; this doesn’t have to be an elaborate chain of command – employees simply need to know which person to report to, and managers need to know where to pass the information to, whether it is local law enforcement, company executives, etc.
The Department of Homeland Security has resources for Hometown Security, where communities and businesses can access free tools and resources to help keep local communities and the public safe and secure. The Hometown Security division encourages businesses to proactively play a role in keeping their communities safe by employing the steps of Connect, Plan, Train, and Report. In terms of reporting, the Hometown Security division points businesses to the DHS “If You See Something, Say Something” campaign.
Here at Invictus Consulting, we encourage businesses, schools, and organizations to train their people on detecting and reporting suspicious activity and persons. Start by browsing around the DHS and Hometown Security web pages; then work with your executives, managers, or board to create a plan that works for your company, school, or organization; then train your people so that they know what to do if they encounter suspicious persons or activities.
But it’s important to understand that there should be multiple layers of security before a shooter even gets to the building.
If your facility has these five layers of security, the possibility of an active shooter making it through the doors decreases, since these layers of security would stop of slow him down before he got inside.
Layer 1 – fences that are in good repair combined with gates that are locked will slow down a perpetrator
Layer 2 – cameras that allow security personnel to view the perimeter of the property as well as view exterior doors would allow them to see a perpetrator before they’re inside
Layer 3 – door access control (either locks or electronic access control) would also slow down a perpetrator, since they would not have unhindered access via an open and unlocked door
Layer 4 – intruder or burglar alarm systems would alert security personnel that an unauthorized individual is attempting to gain access
Layer 5 – employees that are well trained on visitor management policies and procedures can go a long way in keeping unauthorized individuals out of the building
Of course no security measure is perfect. Simply installing fences, cameras, card readers, and burglar alarms in no way guarantees a perfectly secure work environment. A culture of security is of the greatest importance in security; technology is not your crutch.
Today we’d like to talk about fire safety and egress points, specifically doors with magnetic locks. Mag lock doors are (usually) exterior doors that have magnetic locking hardware, whereby an electromagnetic current is passed between the device on the door and that on the door frame, thus creating a locking action.
Mag locks don’t interact with the levers or knobs on a door, which means that if the magnetic lock is active, pushing a door strike or turning a door knob will not open the door. This is why Life Safety Code requires that any door with a mag lock also needs distinct additional ways to break the power (and thus open the door) in the event of an emergency. These include:
a passive infrared motion sensor (drops power to the magnetic lock whenever motion is observed)
an egress button (a button that can be pushed to immediately break power to the magnetic lock in an emergency)
a fire alarm relay ( if a fire alarm is triggered the relay will drop power to the magnetic lock)
The National Fire Protection Association instructs facility managers or those people in charge of security that the authority having jurisdiction (AHJ) is the final authority on whether your fire, life, and electrical safety programs are up to code. The AHJ differs by state, area, type of facility, etc. and may be your local fire chief, labor department, state department, or other organization, office, or individual responsible for enforcing the requirements of a code or standard, or for approving equipment, materials, an installation, or a procedure.
Mag locks are great security measures; with that said, it’s important that if you have them in your facility, that you have redundant measures that allow for free egress in an emergency.
Today we thought we’d have a little educational session about critical infrastructure and the NIPP. What on earth is the NIPP, you ask? It’s the National Infrastructure Protection Plan, of course!
Critical infrastructure is defined by the Department of Homeland Security (DHS) as those assets, systems, and networks that underpin American society. Because our nation’s safety rests on the foundation of these critical infrastructures, the DHS created a plan (the NIPP) to manage the risks from significant threats and hazards to them. The DHS has identified the following as critical infrastructure:
defense industrial base
food and agriculture
healthcare and public health
nuclear reactors, materials, and waste
water and wastewater systems
There is a great deal of dependencies between the various critical infrastructures, so the safety of one sector helps with the safety of the others. The image below comes from the Water Sector-Specific Plan: An Annex to the National Infrastructure Protection Plan and shows some of the interconnectedness the water and wastewater sector has with other sectors. For example, the water sector uses electricity from the electric power sector for maintenance, repair, the functioning of their SCADA systems, and the functioning of their treatment, lift, and pump stations. In turn, the electric power sector uses water from the water sector for things like cooling.
In fact, the water sector shares dependencies with most of the other critical infrastructure sectors, principally chemical, energy, food and agriculture, public health, transportation, dams, information technology, and emergency services. What this means is that a breach in the water sector could have negative consequences for any or all of these other critical sectors and vice versa. If a successful attack were carried out on the energy sector, the water sector would be unable to receive energy and thus lose their ability to carry out their operations and water treatment. A breach in the water sector would cause problems in the food and agriculture sector (which uses water for their own operations and functioning), and ultimately the consumer who depends on the food and agriculture sector for their food.
The NIPP is a detailed plan with numerous sector-specific plans; we get it that this may not be the mot interesting information you’ve come across on the Invictus Consulting blog. That’s okay! If you’ve made it this far in this post, consider yourself a bit more informed about our nation’s security.