02 — Capability · BC-840.10
Security Risk & Standards
Decide how much protection each site and asset warrants, based on the threats it faces and what it holds, and set the standards that make that protection consistent.
- Security Risk Assessment
- Protection Standards
- Threat Assessment
In scope
- Threat and vulnerability assessment by site
- Site tiering and minimum protection standards
- Security design review for new and changed facilities
Out of scope
- Enterprise risk register ownership (see BC-130)
- Facility construction and fit-out (see BC-370)
Decomposes into · 3
- BC-840.10.10Threat & Vulnerability AssessmentIdentify who might target a site, how they would get in and what they would take or harm, and rate each site accordingly.
- BC-840.10.20Site Protection StandardsDefine the minimum physical controls each tier of site must have, from a locked door to layered perimeters, so protection matches risk.
- BC-840.10.30Security Design ReviewReview new facilities, renovations and layout changes for security before they are built, when a door can still be moved on paper.