Facility Physical Security Breach Incident Management

Incident Management Guidelines

A physical security breach of a facility, whether in a remote, hostile, or permissive environment, may pose a range of risks to the company. Managers should consider the nature and intent of the breach, as well as the possible goals and motives of the intruders.

In the event of a physical security breach occurring, the following points should be addressed:

Action Points

1. Stand up the Incident Management and Crisis Response Teams using the SAD CHALETS system.
2. Establish the nature of the breach (criminals, youths, activists, terrorists) and associated risk levels and types.
3. Elevate alert status and post guards around the area; start roving patrols.
4. Notify local government, military, and law enforcement organizations.
5. Determine where the breach occurred and secure the point of entry.
6. Confirm an Incident Management Control Point to receive external security agencies; notify them as to safe routes in.
7. Perform a role call of all personnel; identify any missing staff.
8. Close down and secure all facilities; if necessary, move personnel to safe havens.
9. Perform an inventory of all weapons, equipment, and documents, if appropriate.
10. Determine the consequences of the breach and begin mitigation to prevent future security breaches.
11. Employ bomb‐sniffing dogs if appropriate, and clear muster points for possible hazards.
12. Provide status reports to organic and external security groups.
13. Conduct a sweep of the area for unauthorized intruders and devices.
14. Confirm whether intruders are still present; if so, track and monitor their movements if possible.
15. Maintain a flow of information to organic and external security groups.
16. Write a complete, detailed report of the breach.
17. Forward all information through the correct communication channels, and update where necessary.
18. Provide an IMP Risk Assessment Report as soon as possible.