Facility Intrusion | Scope of Risk

A facility breach may be due to unintentional intrusion by ignorant trespassers—for example, as a result of the facility being on traditional trade or migration routes by nomads—or it may be done by opportunistic and unrefined criminal elements seeking to pilfer materials; by organized crime seeking to steal high‐value assets; or by insurgents, terrorists, or special‐interest group activists seeking to kidnap employees, damage critical infrastructures, or make a public statement to support their cause. Intrusion may be slowed by physical security structures and manpower provided to protect a facility, and alerts may come from human or technological measures. Typically the security plan for a facility or critical infrastructure will outline the measures used to deter, detect, delay, prevent, and respond to an intrusion. Where mature security plans and policies are not in place or a non‐security‐trained manager is in charge of the first stages of a response, the IMP will play a crucial role in providing guidance to assist in managing the situation until law enforcement or other response agencies can deploy and resolve the situation.

In the event of a physical security breach of a facility, it is important that both immediate and interim‐term risks are identified, understood, and mitigated. The nature of the intrusion will largely determine the actions taken (i.e., if intruders are armed or unarmed; if they intend to harm individuals, steal property, or damage infrastructures). The following common threats are posed by facility intrusion:

§  Physical or psychological threats to personnel, including assault, intimidation, and kidnapping.

§  Threats to critical infrastructures: explosive hazards, vandalism, and contamination.

§  Theft or damage to assets and other materials.

§  Espionage and data theft.

§  Corporate reputation and image risks.

§  Disruption to operational and business productivity.

§  Sit‐ins or unlawful occupancy of areas or work spaces.

§  Liability and legal risks.

In addition, the nature of security policies and resources in place to protect a facility will also guide the response measures (e.g., mature or inadequate policies and plans, and a robust and armed security force or an insubstantial and unarmed response force). Long‐term risks will be the responsibility of the crisis response group, who should address shortfalls and gaps within any security plan and associated policies and resource levels. Local site or incident managers should determine the following facts as the basis of their response decision paths:

§  Where has the breach occurred?

§  When did it occur?

§  Are intruders armed and violent?

§  How many intruders are there? Is their location known? What do they look like?

§  What is their intent, and what other threats might be posed by the intruders?

§  Can organic security resources counter those of the intruders?

§  What level of support is available from government or other agencies?

§  What personnel are at risk, and can they be secured?

§  What resources of infrastructures are at risk, and can they be secured?

The IMP should complement a mature and well‐constructed security plan where possible. The IMP should be tied to standard operating practices and preprepared security response protocols to ensure that security personnel, or other employees, carry out immediate actions upon notification of a security breach. Where security plans and resources are not in place, the IMP should be focused on ensuring the safety of personnel and the protection of vulnerable or high‐value resources or assets, while guiding law enforcement or other resources to the point of threat.