{"version":"0.19.0","built_at":"2026-10-17T14:21:37.518Z","license":"CC BY 4.0 © Mike Reams","canonical":"https://catalog.mikereams.com","value_stream":{"id":"VS-360","name":"Threat-to-Resolution","industries":["cross-industry"],"description":"Carry a physical threat or incident at a site, from an alarm, report or warning through response, protection of people, communication and investigation to improved controls. Where Incident-to-Resolution (VS-10) restores an IT service, this handles intrusion, theft, violence and threats against people and sites; cyber incidents are handled under BC-760.30.","outcome":"People are safe, the incident is contained, employees and the public hear accurate information, the facts are established, and the controls that failed are fixed.","trigger":"An alarm, camera, guard, employee or outside agency reports an intrusion, theft, threat or violent incident at a site.","aliases":["Physical Security Incident Response","Physical Incident-to-Closure","Site Threat Response"],"stages":[{"id":"VS-360.10","order":1,"name":"Detect & Verify","description":"Detect the event through alarms, cameras or reports and verify it, or assess a reported threat, before committing a response.","capability_ids":["BC-840.30","BC-840.40"]},{"id":"VS-360.20","order":2,"name":"Respond & Protect","description":"Send guards, call emergency services where needed, lock down or evacuate, and protect people first.","capability_ids":["BC-840.40","BC-840.20","BC-830.30"]},{"id":"VS-360.30","order":3,"name":"Communicate","description":"Tell employees what to do, answer the media and the community where the incident is public, and brief leadership.","capability_ids":["BC-480.20","BC-480.30","BC-830.40"]},{"id":"VS-360.40","order":4,"name":"Investigate","description":"Preserve evidence, establish the facts, cooperate with police, and decide on discipline, recovery or legal action.","capability_ids":["BC-840.50","BC-360.30","BC-150.40"]},{"id":"VS-360.50","order":5,"name":"Recover & Report","description":"Restore the site to normal operation, record the incident, and report it to insurers and regulators where required.","capability_ids":["BC-840.40","BC-370.30","BC-130.50","BC-810.20"]},{"id":"VS-360.60","order":6,"name":"Improve Controls","description":"Reassess the site's threats and standards and change access, surveillance or guarding where the incident showed a gap.","capability_ids":["BC-840.10","BC-840.20","BC-830.50"]}]}}