Security scenarios – do your people know what to do?

Chances are when you think about building security you think about access control, CCTV and possibly people in uniforms. But for a building to be safe and resilient, the thinking for security planning needs to begin with considering what the occupants may need to do.

This scenario planning is a very important part of developing a security approach, because regardless of the hardware installed on-site, the actions of human beings are at the root of effective responses to threats or actual incidents. Also, not every kind of security risk involves malicious actors – sometimes risks or hazards are the result of factors in the external environment.

There are three types of scenarios that need to be planned for:

EVACUATION: when every occupant needs to leave a building quickly and safely due to a hazard such as fire, flooding, bomb threat, earthquake or failure of building systems such as electrical or hydraulic systems.

INVACUATION: when a building becomes a safe haven for both its usual occupants and potentially members of the general public due to an event such as severe weather, hazardous incident outside the building, a spike in pollution or during a heatwave or severe cold.

LOCKDOWN: when occupants and any on-site visitors need to be kept safe from a threat inside or at an entry to a building that makes leaving more hazardous than staying, for example an active shooter, aggravated visitor or hazardous substance release.

For EVACUATION it is important to plan for collection points where everybody can congregate and check-in so the Security Operation Centre (SOC) can get an understanding who made it to safety outside and who is still not accounted for; this includes all people in the building, i.e. all employees, visitors, third party service providers etc. This is another reason access control systems should digitally register and log every person who enters or exits a building.

For INVACUATION the right location needs to be pre-determined - in many cases this will be in the basement. The principle is to have as many walls between you and the outside as possible, and this is especially important for weather incidents like tornados or cyclones, but also for hazmat release and active shooter scenarios.

Planning also needs to include location(s) and the safest and most efficient routes to get there. These shelter-in-place locations also need to be equipped with an independent HVAC system with filters to protect against hazardous substances, toilets, potentially showers, electricity, internet, telephone, water, food etc.

Additionally, inside the "shelter-in-place" those in positions of responsibility need to have the ability to check-in everybody that made it into the shelter - just like in the EVACUATION scenario, at the collection point, everybody needs to be accounted for. They should also have a direct link to the SOC so it can be determined when it is safe to leave the shelter-in-place and a direct link to police in case the SOC was compromised.

Planning for LOCKDOWN

Similar to INVACUATION, planning for LOCKDOWN involves considering what needs to be put in place so people will be safe.

So all the principles and strategies for INVACUATION apply, and in addition, important building design considerations include planning for blast and/or impact proof walls, windows, doors. Operational protocols need to focus on ensuring there are adequate supplies of food, water, first aid equipment, fresh air and a backup power and communications solution. This will determine how long a lockdown can safely be maintained for.

Beyond these scenarios, planning must be matched with delivery – and there is no end point for this. Maintaining security is always reliant on people having awareness of what they may be required to do, and a thorough understanding of how to do it. Responsibilities need to be clearly defined, and the plans tested on a regular basis.

Onboarding and regular refresher training are essential to ensure everyone understands the plans and protocols, and that they have the confidence to implement those measures.