Blog
December 5, 2024
Case Study: Physical Security Threat Risk Assessment
Client Sector or Industry: Financial Institution
Challenge:
A company, an approved vendor for a large financial institution, faced a challenge in fulfilling one of the institution’s critical vendor compliance requirements. As part of the financial institution’s vendor and partner program, the company was required to undergo a Physical Security Threat Risk Assessment (STRA) at their head office. This assessment was mandated to be completed by a third-party consultant, with a Physical Security Professional (PSP), Certified Protection Professional (CPP), or someone with at least five years of physical security experience.
However, the company did not have an in-house security team, so the task of finding an appropriate provider for this specialized service fell to their office manager and in-house IT support team. Unsure of the exact requirements for a Threat Risk Assessment but aware they needed to meet the financial institution’s compliance, they quickly Googled “Threat Risk Assessment” and found Kirsch Group.
Approach:
Once the company contacted Kirsch Group, our team of experienced consultants stepped in to deliver a thorough and professional STRA, designed to meet the specific needs of the financial institution’s vendor compliance requirements. Having conducted dozens of STRAs for a variety of organizations, including printing houses, collections agencies, and IT service providers, Kirsch Group was well-equipped to handle this task and ensure the company’s security posture met industry standards.
The assessment included a full review of the company’s physical security infrastructure, policies, and procedures. Our consultants began by analyzing the company’s existing physical security systems, including access control measures, surveillance systems, and site layout. We worked closely with the office manager and IT team to ensure that we understood both the current security setup and the operational needs of the company.
Findings:
During the assessment, Kirsch Group identified a few critical vulnerabilities that could expose the organization to future risks. Some of the key findings included:
Video Surveillance Policy Gaps: The company had invested in physical security systems, but their video surveillance policies had not kept up with the evolving technology. The existing policies were outdated and did not align with the current level of surveillance technology, creating a gap in both security and liability coverage.
Access Control and Physical Security Alignment: While the company had some access control measures in place, the alignment between these systems and their overall physical security strategy could be improved. Specifically, there were opportunities to enhance security by adjusting internal procedures and access controls to better monitor sensitive areas.
Recommendations:
To address these findings, Kirsch Group provided a range of cost-effective solutions to enhance the security posture of the company:
1 – Updating Video Surveillance Policies: We recommended revising their video surveillance policies to reflect the current security infrastructure. This included guidance on how to store and access footage, establish retention periods, and ensure compliance with both company standards and industry regulations.
2 – Process and Policy Adjustments: We suggested revising internal processes to improve alignment between access control systems and physical security policies. Specifically, streamlining visitor management and restricting access to sensitive areas with a more robust auditing and reporting mechanism.
3 – Ongoing Risk Monitoring and Reviews: As part of our recommendations, we emphasized the importance of regularly updating security policies and conducting ongoing risk assessments to stay ahead of emerging threats and potential vulnerabilities. This would not only maintain compliance but also reduce the organization’s future liability and enhance overall security.
Results:
By implementing these recommendations, the company successfully met the financial institution’s compliance requirements and also enhanced their overall security infrastructure. The STRA provided the necessary documentation for vendor compliance, but more importantly, it identified key vulnerabilities and enabled the company to proactively address them.
With the updated video surveillance policies, improved physical security processes, and ongoing risk monitoring, the company is now better equipped to protect its assets, reduce liability, and maintain compliance. They also demonstrated to their client that they are committed to maintaining a secure environment, not only for themselves but for their stakeholders as well.
Conclusion:
This case study highlights the importance of conducting regular physical security threat risk assessments for organizations, especially those that are required to meet compliance standards or have vendor requirements. At Kirsch Group, we are proud to support organizations in identifying vulnerabilities and implementing cost-effective solutions that protect assets, ensure compliance, and strengthen the security posture of the organization. Whether you’re facing compliance requirements or just want to strengthen your overall security, a comprehensive STRA is a critical step in building and maintaining a secure environment.