安全规划工作簿

SEPTEMBER 2023 SECURITY PLANNING WORKBOOK OVERVIEW The workbook can be used by individuals involved with yourorganization’s security planning efforts; security expertise is notrequired to complete this workbook. This document can be usedby anyone affiliated with your organization, including individualsor groups with varying degrees of security expertise, chargedwith the safety and security of your facilities and people. Thepurpose of this security planning workbook is to compile keyinformation that can be used to assist you with building acomprehensive security plan. The process of creating a securityplan should not be rushed. The information entered in theworkbook can be saved; users should work at their own pace. CISA’sMISSION The Cybersecurity andInfrastructure Security Agency(CISA) leads the national effortto understand, manage, andreduce risk to our cyber andphysical infrastructure. While some sections and fields within this workbook may not apply to your unique site, everyorganization should develop and implement a comprehensive security approach to protect its people,property, visitors, and customers. The workbook is flexible and scalable to suit any type of businessor organization. The workbook also provides descriptions of critical elements of security planninginformation, resources, and fillable fields to guide your efforts. As information in this workbook isfilled out, your document should be securely saved and stored; follow your organizations informationhandling requirements. ORGANIZATION/BUSINESS INFORMATION TABLE OF CONTENTS 1.Forming a Planning Team Security Coordinator Information,Security Planning Team Information4Safety Team Information6Other Key Contact Information7 2.Risk Assessment Process 10 Calculating Risk A.Conduct “As-Is Review”11B. EvaluateThreats and Hazards21C. Assess YourVulnerability(ies)23D.Assess Risk and Prioritize Mitigation24Notional Risk Table26 3.Mitigation Considerations27 4.Additional Elements of Your Security Plan29 Training and Exercises29Communications30Recovery32 33 6.Supplemental Planning Options35 Natural Disaster Contingency Planning36Emergency Preparedness37Emergency Action Plan (EAP)38Business Continuity Planning (BCP)39Community Resilience39 8.Resources41 1. FORMING A PLANNING TEAM The Security Coordinator, Security Planning Team, and Safety Team Establish clears roles, responsibilities, and expectations for those involved with your security planningteam. Your team could be composed of a designated Security Coordinator along with SecurityPlanning Team members who will develop plans and implement the identified security practices.Smaller organizations with limited personnel and resources may have a single person responsible fordeveloping the organization’s security plan(s). The process and considerations offered in this workbookcan be used by organizations of all sizes. Security Coordinator Information The Security Coordinator will be the leader of the security planning team responsible for security-relatedquestions. Ideally, the Security Coordinator is a full-or part-time staff member or engaged volunteer.Larger organizations may have a Chief Security Officer (CSO) responsible for these functions. TheSecurity Coordinator is typically responsible for: •Directing all security operations for all aspects of the organization’s safety and security•Developing and implementing security policies and practices, and evaluating their effectiveness•Coordinate security decisions with senior leadership•Reviewing current safety training to recommend updates and improvements Security Planning Team Information TheSecurity Planning Team supports the Security Coordinator by conducting research, evaluatingneeds, providing recommendations, and assisting with plan development. This should be a diversegroup of delegates from within the organization representing all functional, accessibility, and businessoperational needs. Individuals with knowledge and expertise in security, law enforcement, facilityoperations and maintenance, mental health, emergency preparedness, incident management, publicrelations, special needs, childcare, and functional access can bolster your efforts and help build formalpartnerships. Other valuable skill sets include policy development, strategic planning, finance andaccounting, and training. The Security Planning Team can serve a variety of purposes and should helpcarry the burden of planning and implementation. Larger organizations with staff aligned to a CSO – orsimilar function – should coordinate across the organization to understand the unique security risks andplanning needs of each group. Smaller organizations with limited personnel and resources, for example,may have a single person responsible for developing the organization’s security plan(s). In this case,it becomes even more critical for smaller organizations to reach out to local law enforcement andemergency managers to solicit planning input and coordination Alt