Threat, Risk, and Vulnerability Assessments

Overview

The SAFE tool is used by our team of architects and security assessors during the assessment of an existing facility to identify critical deficiencies and calculate a SAFE score for each location. It includes over 200 security-related factors and accompanying performance measures, which can be tailored to assess a specific type of building (or portfolio of buildings) in any location. 

Once tailored to meet an organization’s security assessment goals, this interactive tool provides a consistent and objective set of factors that will be evaluated within each facility. This allows our team to gather the data in a standardized manner efficiently. During a facility assessment, our architects utilize a secure tablet computer to rate individual performance measures, take notes, and document observations. This functionality allows us to record all ratings as the assessment is conducted in real-time. 

The SAFE tool produces an immediate comparable overall score for each facility. It establishes a database that is sortable in various ways to allow an owner to quickly identify critical security needs in one facility or across an entire portfolio. This information can then support prioritizing recommended security improvements at each location. 

Categories and Results

The security factors included in the SAFE score fall into four major categories:

• Exterior Physical Security – security features of the grounds, property, and exterior of the facility
• Interior Physical Security - security features of the layout and design of interior spaces
• Electronic Security – electronic security, including CCTV, duress alarms, etc.
• Policies and Procedures – existing security policies, procedures, crisis management plans, etc.

The SAFE tool automatically produces an overall assessment score (the SAFE score) on a scale of 0 to 100, with a score of 100 representing ideal facility security within the context of the evaluation criteria. To calculate the score, the SAFE tool incorporates the Analytic Hierarchy Process (AHP), a well-defined mathematical structure for organizing and analyzing complex decisions.  

The figure below depicts a sample output of the SAFE tool results dashboard.  In addition to the overall SAFE score, the results summary includes individual SAFE scores for each of the four key areas noted above. In general, a grade of 90-100 represents a facility that offers optimal security, a grade of 80-89 represents a facility that meets most security standards, a grade of 60-79 represents a facility that is lacking in significant areas of security, and a grade of 60 or lower represents a facility that is in serious need of critical security updates. 

Our security assessment process provides organizations with the following comprehensive set of decision-making tools:

• SAFE Tool Database with Dashboard: When a security assessment is completed, a database stores the assessment results in a system that displays summary graphics, generates reports, and enables updates. The data can be filtered and managed in a variety of ways. The data are typically displayed in a dashboard form and can be easily used by owners, managers, and planners as a decision-making tool to identify and compare security deficiencies within a single building or across their entire real property portfolio. 
• Facility Assessment Report with Recommendations. Following the interviews, reviews of policies, and facility assessments, a detailed report that documents the assessment results is produced. Utilizing the objective results generated by the SAFE tool, the report describes each facility’s specific security deficiencies and provides recommendations for facility or policy improvements that mitigate or reduce the risk. Each deficiency and associated improvement strategy is identified by one of three levels based on its urgency of need:
  
  
  • Critical - security strategies that should be implemented immediately to address an urgent deficiency 
  • Standard - security strategies that should be implemented in the near future to meet basic security standards
  • Optimal - security strategies that would surpass basic standards
    
    

• Gap Analysis. One of the key benefits of the SAFE tool is that it can be used to score an improvement strategy, so a comparison can be made to determine how well the strategy closes the gap between the existing SAFE score and an ideal security score of 100. Typically, an ideal score is not possible in all facilities given the physical limitations and constraints of buildings; therefore, the goal is to optimize the recommendations so that the score for each location can be increased to its greatest value.  

This analysis, called a “gap analysis,” is illustrated in the figure below, which shows how an improvement strategy can “fill the gap” and increase a facility security score.

• Cost Estimates. Cost estimates for the improvement strategies are also provided. Depending upon the strategy, these can include the cost of modifying a space, the cost of material and installation of security equipment, and/or the operational costs of the device (i.e. additional manpower, recurring cost, etc.) The costs are typically based on a rough order of magnitude that is reasonable and comparable among similar facilities.
• Cost-Effectiveness Analysis. If both a gap analysis and cost estimate are completed for an improvement strategy, a cost-effectiveness analysis is also conducted. By dividing the costs into the numerical increase the improvement strategy has on the SAFE score, a cost-effectiveness ratio is created. This quantifiable result allows decision-makers to determine which projects yield the greatest benefit gain (i.e., an increase in the SAFE score) for the most reasonable costs.
• Prioritization Plan. With budgetary guidance from the building owners, a prioritized project implementation plan will be produced that considers the gap analysis, estimated costs, and cost-effectiveness analysis for all improvement strategies. We work with the building owners to identify improvement strategies that can be combined if cost savings can be realized. The prioritization plan is typically developed as a multi-year strategy based on an estimated yearly budget that will systematically improve security across the portfolio.