Security Vulnerability Assessment

• Document No.

• Audit Title

• Client / Site

• Conducted on

  Date

• Prepared by

• Location
  Address

• Personnel

Facility Information

• Facility Name

• Facility Address
  Address

• Facility Point of Contact

• Point of Contact Phone Number and Email Address

Onsite Chemicals

• Are there DHS Chemicals of Interest and/or DEA Watch List chemicals on site? If yes, provide a list of all with quantities, CAS, and how they are stored (storage medium).

  Yes

  No

  N/A

• Are there any other Toxic Industrial Chemicals or Toxic Industrial Materials that pose public health/environmental hazard concerns? If yes, provide a list of all with quantities, CAS, and how they are stored (storage medium).

  Yes

  No

  N/A

Critical Assets

• If there are any YES answers in this category, describe the characteristics of the critical asset the consequence of the asset loss, and the location of the asset.

• List and describe any emergency equipment/systems, e.g., fire stations, firetrucks, cleanup equipment, etc. that may be critical to the facility.

• Does the facility have key buildings or process areas?

  Yes

  No

  N/A

• Does the facility have critical communications equipment, e.g., radio relay stations, antenna, intercom systems, hand-held radios, etc.?

  Yes

  No

  N/A

• Does the facility have critical computer hardware, e.g., servers, mainframes, racks, network switches, etc.?

  Yes

  No

  N/A

• Are there critical/key personnel at the facility?

  Yes

  No

  N/A

• Are there other critical assets?

  Yes

  No

  N/A

• Remarks regarding Critical Assets

Operational Information

• Describe the facility and its operations, i.e., what is the facility's function?

• What are the operating hours at the facility?

• What are the key products and services at the facility?

• Who are the key customers supported by the facility?

• How many personnel are at the facility including employees, vendors, contractors, etc.

• Is the facility on a navigable waterway?

  Yes

  No

  N/A

• How much has the facility spent on implementing security countermeasures in the past year?

• Has the facility had any security incidents within the last two years?

  Yes

  No

  N/A

Impact Assessment

• What is the estimated cost of a 24-hour loss of operations at the facility?

  Select $100,00+ $50,000-$99,999 $25,000-$49,999 $10,000-$24,999 Less than $10,000

  • $100,00+
  • $50,000-$99,999
  • $25,000-$49,999
  • $10,000-$24,999
  • Less than $10,000

• What is the estimated cost to completely replace the facility?

  Select $2,000,000+ $1,000,000-$2,000,000 $500,000-$999,999 $100,000-$499,000 Less than $100,000

  • $2,000,000+
  • $1,000,000-$2,000,000
  • $500,000-$999,999
  • $100,000-$499,000
  • Less than $100,000

• What is the expected loss impact to Champion as an enterprise if the facility is lost?

  Select Catastrophic Major Significant Minor

  • Catastrophic
  • Major
  • Significant
  • Minor

• What are the expected Health, Environmental, and Safety impacts of a significant COI release incident at the facility?

  Select Extend offsite with population impacts greater than 100,000 Extend offsite with population impacts of 50,000 to 99,999 Extend offsite with population impacts of 10,000 to 49,999 Extend offsite with population impacts of less than 10,000 Extend offsite with no population impacts Limited to on-site

  • Extend offsite with population impacts greater than 100,000
  • Extend offsite with population impacts of 50,000 to 99,999
  • Extend offsite with population impacts of 10,000 to 49,999
  • Extend offsite with population impacts of less than 10,000
  • Extend offsite with no population impacts
  • Limited to on-site

Site Security Plan

• Has the facility identified a Site Security Coordinator in writing?

  Yes

  No

  N/A

• Does the facility have a written security plan?

  Yes

  No

  N/A

• Does the facility retain records of security risk management assessments, in paper or electronic format, for at least three years?

  Yes

  No

  N/A

• Does the facility retain records of security incidents, in paper or electronic format, for at least three years?

  Yes

  No

  N/A

• Does the facility have a defined security organizational structure in writing that identifies specific duties and responsibilities?

  Yes

  No

  N/A

• Does the facility have written procedures, including responsibilities, tasks, and frequencies, to regularly inspect, test, calibrate, repair, and maintain security systems and related equipment such as communications and emergency notification equipment according to manufacturer's standards?

  Yes

  No

  N/A

• Does the facility have written procedures and qualified personnel for conducting thorough investigations of significant security incidents, and thoroughly investigate security breaches and incidents?

  Yes

  No

  N/A

• Does the facility implement appropriate temporary security measures in response to security incidents, nonroutine outages, equipment failures and malfunctions, and are such incidents documented and promptly reported to the Site Security Manager?

  Yes

  No

  N/A

• Does the facility have a written plan to record and repair deficiencies in security related equipment?

  Yes

  No

  N/A

• Does the facility retain records of maintenance, calibration, and testing of security equipment, in paper or electronic format, or at least three years?

  Yes

  No

  N/A

• Does the facility have a written process and procedures for implementing security measures and increasing their security posture during periods of elevated threat levels?

  Yes

  No

  N/A

• Does the facility maintained a standardized security system procurement and construction requirements document?

  Yes

  No

  N/A

• Are security system manuals available?

  Yes

  No

  N/A

• Does the facility have an active outreach program to the community and local law enforcement and emergency responders?

  Yes

  No

  N/A

• Does the facility have as-built drawings for the security system?

  Yes

  No

  N/A

Personnel Security

• Are background checks completed on all employees and contractors who have unescorted access to critical or restricted areas?

  Yes

  No

  N/A

Visitors/Contractors

• Does the facility have strict visitor identification, escort, and access control procedures?

  Yes

  No

  N/A

• Does the facility have one or more separate access points for contractor personnel?

  Yes

  No

  N/A

• Are all visitors and non-badged contractors documented, issued a temporary badge, and escorted while in restricted areas, and escorted or continuously monitored elsewhere?

  Yes

  No

  N/A

• Are visitors restricted from access to locations where critical assets are located?

  Yes

  No

  N/A

Chemical Security

• Does the facility have an active, documented "know your customer" program?

  Yes

  No

  N/A

• Does the facility use tamper evident devices to secure transportation containers?

  Yes

  No

  N/A

• Does the facility receive unannounced shipments of hazardous materials?

  Yes

  No

  N/A

• Does the facility have an inventory control system for dangerous chemicals?

  Yes

  No

  N/A

• Do facility personnel actively monitor critical process equipment containing dangerous chemicals?

  Yes

  No

  N/A

• Have all employees and contractors involved with dangerous chemicals undergone background surety investigations?

  Yes

  No

  N/A

• Have all employees and contractors involved with dangerous chemicals been trained to identify and report suspicious behaviors/activity?

  Yes

  No

  N/A

• Does the facility adequately secure all transportation containers of hazardous materials on site?

  Yes

  No

  N/A

• Does the facility perform identification checks and verification prior to customer pick up of packaged chemicals on site?

  Yes

  No

  N/A

• Does the facility have a review procedure with appropriate redundancies in place for all shipping, receiving, and delivery of hazardous materials?

  Yes

  No

  N/A

• Does the facility use a locked rack or other physical means of securing man portable containers of dangerous chemicals?

  Yes

  No

  N/A

• Does the facility use tamper evident seals for vehicle valves and other appurtenances that can indicate if a shipment has been tampered with?

  Yes

  No

  N/A

Guard Force

• Does the facility have a guard force in place? If yes, describe, e.g., cite when guards are on-site, number of guards, etc.

  Yes

  No

  N/A

Security Control Room

• Does the facility have a dedicated control room and console in place to monitor security, fire alarms, and other facility systems?

  Yes

  No

  N/A

Communications

• Does the facility have a communications and emergency notification system?

  Yes

  No

  N/A

• Are intercom call boxes or a facility intercom system installed throughout the facility?

  Yes

  No

  N/A

Perimeter

• Is there a natural or man-made barrier (or combination thereof) that encloses the facility perimeter?

  Yes

  No

  N/A

• Is there a 5-foot minimum clear-zone on either side of the fence that allows persons to be detected at the boundary?

  Yes

  No

  N/A

• Are utility paths or a water runoff channels providing access to the facility secured?

  Yes

  No

  N/A

• Are there appropriate vehicular and pedestrian access controls at the facility perimeter?

  Yes

  No

  N/A

• Are there at least two vehicular perimeter access points to the facility?

  Yes

  No

  N/A

• Is lighting adequate from a security perspective in roadway access and parking areas?

  Yes

  No

  N/A

Access Control

• Are access control points configured to avoid significant queuing?

  Yes

  No

  N/A

• Does the facility differentiate for different levels of access?

  Yes

  No

  N/A

• Does the facility have a functional security access control system in place?

  Yes

  No

  N/A

• Do appropriate access control devices cover every entrance/exit from the facility?

  Yes

  No

  N/A

• Does the facility access control system require authorization for access by a photo identification card, proximity card, or biometrics?

  Yes

  No

  N/A

• Are access points manned by security personnel when open for use and either manned or continuously monitored at all other times?

  Yes

  No

  N/A

• Are appropriate types of locking hardware used throughout the facility?

  Yes

  No

  N/A

Vehicles

• Does the facility inspect all vehicles and all of the items carried by individuals entering the facility?

  Yes

  No

  N/A

• Do unknown vehicles remained outside the facility perimeter or in a secured area while they and their occupants are being vetted?

  Yes

  No

  N/A

• Is on site parking minimized and vehicular access to restricted areas restricted?

  Yes

  No

  N/A

• Does vehicular inspection occur at the curb lane or outside the facility's protected perimeter?

  Yes

  No

  N/A

• Are vehicular entrances offset from the direction of vehicular approach, i.e., are there traffic calming measures?

  Yes

  No

  N/A

• Is there a minimum setback distance between the facility and parked vehicles? If yes, describe the distance and how it is enforced, e.g., barriers, etc.

  Yes

  No

  N/A

• Is vehicular and pedestrian access to the facility separated?

  Yes

  No

  N/A

• Do facility vehicular circulation patterns prevent high-speed approach to critical assets by vehicles?

  Yes

  No

  N/A

• Are there passive or active anti-ram devices at vehicular access points?

  Yes

  No

  N/A

• Do standalone, above ground parking garages provide adequate visibility across, as well as into and out of, the parking garage?

  Yes

  No

  N/A

• Are garage or service area entrances for employee-permitted vehicles protected by suitable anti-ram devices?

  Yes

  No

  N/A

Intrusion Detection System

• Does the facility have an intrusion detection system that is monitored remotely 24 hours a day?

  Yes

  No

  N/A

• Does the facility use a functional exterior intrusion detection system?

  Yes

  No

  N/A

• Is the intrusion detection system wiring located separately from electrical and other service systems?

  Yes

  No

  N/A

• Does the facility use a functional interior intrusion detection system?

  Yes

  No

  N/A

Video Surveillance Systems/Closed Circuit Television

• Does the facility have a CCTV perimeter monitoring system?

  Yes

  No

  N/A

• Does the facility have a CCTV system covering critical assets and chemicals?

  Yes

  No

  N/A

• Are appropriate CCTV cameras used at primary interior entrances and exits?

  Yes

  No

  N/A

Exterior Physical Security

• Does the facility have perimeter barriers, i.e., fencing or walls?

  Yes

  No

  N/A

• Does the facility's architectural design employ Crime Prevention through Environmental Design (CPTED)?

  Yes

  No

  N/A

• Is facility lighting adequate from a security perspective?

  Yes

  No

  N/A

• Are trash receptacles and mailboxes in close proximity to buildings modified to prevent the hiding of explosive devices?

  Yes

  No

  N/A

• Have the number of trash receptacles or mailboxes in close proximity to buildings been reduced or eliminated?

  Yes

  No

  N/A

• Do building windows contain security glazing?

  Yes

  No

  N/A

• Do windows and openings cover less than 40% of structural bays?

  Yes

  No

  N/A

• Do non-window openings such as mechanical vents and exposed plenums provide the same level of protection required for the exterior wall?

  Yes

  No

  N/A

• Is roof access limited to authorized personnel by means of appropriate locking mechanisms?

  Yes

  No

  N/A

Critical Assets

• Are high-value or critical assets located as far into the interior of the facility as possible and separated from the public areas of the building?

  Yes

  No

  N/A

• Are critical assets located in locations that are occupied 24 hours per day?

  Yes

  No

  N/A

• Are critical assets located in locations where they are visible to more than one person?

  Yes

  No

  N/A

• Are critical assets located away from entrances, vehicle circulation, parking, maintenance areas, or loading docks?

  Yes

  No

  N/A

Theft/Diversion

• Are high-theft risk or targeted items secured in separate secured storage areas?

  Yes

  No

  N/A

• Does the secure storage area have access controls and restricted access?

  Yes

  No

  N/A

• Does the secured storage area have a secondary (redundant) security system?

  Yes

  No

  N/A

• Is the secured storage area covered by CCTV and/or electronic controls?

  Yes

  No

  N/A

• Are inventory controls maintained for all high-risk containers?

  Yes

  No

  N/A

• Are inventory controls reviewed by management and discrepancies addressed or immediately reported as an incident?

  Yes

  No

  N/A

Mail, Shipping, and Receiving

• Are loading docks and shipping/receiving areas located away from critical equipment/functions?

  Yes

  No

  N/A

• Is the mail room located away from main entrances, areas containing critical services, utilities, distribution systems, and other important assets?

  Yes

  No

  N/A

Fire Detection and Suppression

• Is there a code-compliant facility fire alarm system, either centralized or localized?

  Yes

  No

  N/A

• Does the facility have reliable supplies of water for the fire suppression system?

  Yes

  No

  N/A

• Are fire hydrants accessible by emergency responders?

  Yes

  No

  N/A

• Is stairway and exit sign lighting operational and is there a written testing process?

  Yes

  No

  N/A

• Are there smoke evacuation systems with purge capability in the facility?

  Yes

  No

  N/A

Infrastructure

• Does the facility have a policy or procedure for periodic recommissioning of major mechanical/electrical/plumbing systems?

  Yes

  No

  N/A

• Is access to building information restricted?

  Yes

  No

  N/A

• Are utility lifelines underground or direct buried?

  Yes

  No

  N/A

• Is mechanical room access limited to authorized personnel only?

  Yes

  No

  N/A

• Are facility automation control centers located in secure areas?

  Yes

  No

  N/A

Electrical System

• Are there multiple service entry points for the facility?

  Yes

  No

  N/A

• Does emergency backup power exist for all critical areas within the facility?

  Yes

  No

  N/A

• Are transformers and switchgears located outside the facility, or accessible from the facility exterior, secured?

  Yes

  No

  N/A

• Is the incoming electric service to the facility in a secure location?

  Yes

  No

  N/A

• Are facility Alexco rooms secured with appropriate locks as part of the access control system?

  Yes

  No

  N/A

• Is the facility primary electrical system wiring not collocated with other major utilities?

  Yes

  No

  N/A

Water

• Are sewer systems protected from unauthorized access?

  Yes

  No

  N/A

• Is the facility's supply of domestic water protected from unauthorized persons?

  Yes

  No

  N/A

• Are there multiple entry points for the water supply?

  Yes

  No

  N/A

• Is there more than one method of water distribution?

  Yes

  No

  N/A

HVAC

• Are there redundancies for the facility's air handling system?

  Yes

  No

  N/A

• Is a air pressurization monitored regularly?

  Yes

  No

  N/A

• Are air intakes and exhausts closed when not operational?

  Yes

  No

  N/A

• Is the air supply to critical areas compartmentalized?

  Yes

  No

  N/A

• Is return air NOT ducted?

  Yes

  No

  N/A

• Is there a means to control facility temperature and humidity levels?

  Yes

  No

  N/A

• Is there protection for chemical, biological, and radiological contamination designed into the HVAC!

  Yes

  No

  N/A

• Are there multiple air intake locations?

  Yes

  No

  N/A

• Are critical areas for supply, return, and exhaust air systems secure?

  Yes

  No

  N/A

• Are appropriate filters used on critical air handling units?

  Yes

  No

  N/A

• Are intakes and exhaust louvers located on the roof or as high as possible?

  Yes

  No

  N/A

• Is access to HVAC units limited to authorized personnel only?

  Yes

  No

  N/A

Fuel

• Is there more than one method of gas distribution at the facility?

  Yes

  No

  N/A

• Is fuel for the facility's critical operations secured from a reliable supplier?

  Yes

  No

  N/A

• Is there a reserve of critical fields?

  Yes

  No

  N/A

• Are gas storage tanks located away from other high-value target areas?

  Yes

  No

  N/A

• Is fuel for the facility's critical operations protected by physical security measures? If yes, describe the measures.

  Yes

  No

  N/A

Response Plan

• Does the facility have a comprehensive Incident Management Plan?

  Yes

  No

  N/A

• Does control of air handling systems support plans for sheltering in place or other protective approaches?

  Yes

  No

  N/A

• Have areas of refuge been identified with special consideration to egress?

  Yes

  No

  N/A

• Have systems that receive emergency power been capacity tested?

  Yes

  No

  N/A

• Does the facility have a 72-hour storage capacity for domestic water?

  Yes

  No

  N/A

• Does the facility have a 72-hour supply of fuel for critical operations?

  Yes

  No

  N/A

• Does the facility have an emergency lighting system for incidents?

  Yes

  No

  N/A

Security Awareness and Training

• Does the facility have a documented security awareness and training program for employees and resident contractors without direct security responsibilities?

  Yes

  No

  N/A

• Does the facility have a documented security awareness and training program for security personnel and a corresponding set of minimum skills and. competencies for security personnel?

  Yes

  No

  N/A

• Does the facility retain training records, in paper or electronic format, for at least three years?

  Yes

  No

  N/A

• Are applicable employees trained on the measures implemented to address the specific threats, vulnerabilities, or risks in accordance with the facility security awareness and training program?

  Yes

  No

  N/A

• Are lessons learned from security incidents disseminated to appropriate facility personnel in a timely manner in meetings, by email, or as part of an ongoing security awareness program depending upon the nature of the incident?

  Yes

  No

  N/A