UTAS Security Vulnerability Assessment

• Document No.

• Audit Title (eg: SVA Gardener Precinct)

• Building Names

• Conducted on

  Date

• Audit / Review prepared by

  Robert Leaver

  Barry Russell

• Audit / Review attended by

• Location
  Address

SITE / BUILDING RISK OUTLINE

General Profile

• Site is Urban, Suburban or Rural ?

  Urban

  Rural

  Regional Township

  Suburban

• Type of Facility

  Select Administration Teaching Research Chemical Storage

  • Administration
  • Teaching
  • Research
  • Chemical Storage

• Environment

  Residential

  Industrial

  Commercial

  Agricultural

• People load on building ?

  less than 10 peo

  10 - 50 peo.

  51 - 100 peo.

  101 - 300 peo.

  more than 300 peo.

• Approx Number of staff

• Approx Number of students

• Comments on this section:

Commercial Activity

• Are commercial activities carried out at this complex ?

  Most Activities

  Some activities

  No activities

• What type of commercial activity?

• Estimated value of commercial activity?

  less than $1M

  $1M - $5M

  $5M - $10M

  More than $10M

• Is there critical infrastructure assets supporting the commercial activity ?

  Yes - High Risk

  No - Low Risk

  N/A

• Estimated value of assets?

  less than $1M

  $1M - $5M

  $5M - $10M

  More than $10M

• Describe the assets?

• Are there BCPs or other strategies to support the critical commercial activities ?

  No

  Partially

  Yes

  N/A

• Would the loss of activities (or delays) affect the provision of service to clients, customers or contracts ?

  Yes

  No

• What percentage of the service would be impacted ? %

• How long would it take to replicate the service or reseach ? Years

• Comments on this section:

Administrative Activity (Major Professional Services sections)

• Are administrative activities carried out at this complex ?

  Most Activities

  Some activities

  No activities

• What type of administrative activity?

• Is there critical infrastructure assets supporting the administrative activity ?

  Yes - High Risk

  No - Low Risk

  N/A

• Estimated value of assets?

  less than $1M

  $1M - $5M

  $5M - $10M

  More than $10M

• Describe the assets?

• Are there BCPs or other strategies to support the critical administrative activities ?

  No

  Partially

  Yes

  N/A

• Would the loss of activities (or delays) affect the provision of service to clients, customers or contracts ?

  Yes

  No

• What percentage of the service would be impacted ? %

• How long would it take to replicate the service or reseach ? Years

• Comments on this section:

Research Activity

• Is research carried out at this complex ?

  Most Activities

  Some activities

  No activities

• What type of research ?

• Estimated value of research ?

  less than $1M

  $1M - $5M

  $5M - $10M

  More than $10M

• Is there critical infrastructure assets supporting the research ?

  Yes - High Risk

  No - Low Risk

  N/A

• Estimated value of assets?

  less than $1M

  $1M - $5M

  $5M - $10M

  More than $10M

• Describe the assets?

• Are there BCPs or other strategies to support the critical research activities ?

  No

  Partially

  Yes

  N/A

• Would the loss of research activities (or delays) affect the provision of service to clients, customers or contracts ?

  Yes

  No

• What percentage of the service would be impacted ? %

• How long would it take to replicate the service or reseach ? Years

• Comments on this section:

Teaching Activity

• Is teaching carried out at this complex ?

  Most Activities

  Some activities

  No activities

• What type of teaching ?

• How much of the complex is allocated to teaching ? %

• Is there critical infrastructure assets supporting the teaching ?

  Yes - High Risk

  No - Low Risk

  N/A

• Estimated value of assets?

  less than $1M

  $1M - $5M

  $5M - $10M

  More than $10M

• Describe the assets?

• Are there BCPs or other strategies to support the critical teaching activities ?

  No

  Partially

  Yes

  N/A

• Would the loss of teaching activities (or delays) affect the provision of service to clients, customers or contracts ?

  Yes

  No

• What percentage of the service would be impacted ? %

• How long would it take to replicate the service or teaching facilitity ? Months

• Comments on this section:

Cash on site Risk

• Is money held on the promises other than Petty Cash ?

  Yes

  No

• What is the approximate value of cash held on site ?

  Less than $500

  $500 - $1,000

  $1,000 - $3,000

  $3,000 - $5,000

  More than $5,000

• How is cash secured ?

  Tin in filing cabinet

  Locked drawer

  Secure safe

• List employees or numbers of staff who have access to cash:

• Comments on this section:

Site Accessabilty and Local Operational Management

• Is the site location isolated and / or normally unmanned ?

  Yes - High Risk

  No - Low Risk

  N/A

• Do workers operate in isolation ? (ie. Lone Worker)

  Yes - High Risk

  No - Low Risk

  N/A

• Do lone workers sign in with UTAS security on arrival ?

  No

  Partially

  Yes

  N/A

• At remote sites, does normal access trigger notification to UTAS security ?

  No

  Partially

  Yes

  N/A

• Are there areas within the complex that operate out of normal University business hours ?

  Yes

  No

• Are the out of hours operations 24/7 ?

  Yes

  No

• Are out of hours operations supervised by qualified staff ?

  No

  Partially

  Yes

  N/A

• What are the assumed expectations of central security services for these unsupervised activities ?

• Do the managers of the complex have documented guidelines for who has access to the complex for after hours activities ?

  No

  Partially

  Yes

  N/A

• Where are these guidelines filed ?

• Are the guidelines adequate to provide clear instructions to both occupants and central security ?

  No

  Partially

  Yes

  N/A

• Comments on this section:

Occupant Attitude Towards Security Matters and incidents

• Have there been security problems in the past ?

  Yes

  No

• Describe the major issues here:

• How many security related incidents have been recorded in the past 2 years ? (data from IRIS)

  less than 2

  2 - 8

  8 - 15

  more than 15

• Were the incidents of a high risk nature ?

  Yes - High Risk

  No - Low Risk

  N/A

• Do staff have a proactive and friendly attitude towards security ?

  Yes

  No

  N/A

• Do students have a proactive and friendly attitude towards security ?

  Yes

  No

  N/A

• Do staff and students proactively lock equipment away when tasks are completed ?

  No

  Partially

  Yes

  N/A

• What assets are vulnerable and need to be protected ?

• For the occupants prespective, what is the most important aspect of security ?

• Comments on this section:

BUILT INFRASTRUCTURE SECURITY

Perimeter Fence

• Does the site have a perimeter fence, wall or other physical barrier around facility?

  No

  Partially

  Yes

  N/A

• Is the fence line in good repair ? (no holes, areas where ground was washed away, or broken barb wire strands/arms)

  No

  Partially

  Yes

  N/A

• Is a "clear zone" maintained around fence line ? (no debris or other vegetation that could block view or allow undetected intrusion)

  No

  Partially

  Yes

  N/A

• Are "No Trespassing" signs posted along the perimeter at 100' intervals or a minimum of 3 signs per side?

  No

  Partially

  Yes

  N/A

Gates / Vehicle Barriers

• Does the site have gates / barriers that prevent vehicle access to restricted areas or zones ?

  No

  Partially

  Yes

  N/A

• Are gates in good repair and function properly?

  No

  Partially

  Yes

  N/A

• Are gates electronically alarmed ?

  No

  Partially

  Yes

  N/A

Exterior Lighting

• Are external lights vandal resistant ?

  No

  Partially

  Yes

  N/A

• Are external sensitive areas provided with adequate lighting ?

  Yes

  No

  N/A

• Are perimeter doors and pathways supported by lighting ?

  No

  Partially

  Yes

  N/A

• Is external lighting appropriate and sufficient ?

  No

  Partially

  Yes

  N/A

Roof access

• Is there critical equipment / plant on the roof ?

  Yes

  No

• Is there easy / unlocked access to the roof or plant rooms ?

  Yes

  No

• Is access to the roof through dedicated hatches or panels?

  Yes - High Risk

  No - Low Risk

  N/A

• Are roof access doors / hatches locked at all times ?

  No

  Partially

  Yes

  N/A

Windows

• Are there any windows at ground level that pose an entry risk ?

  Yes

  No

• Are ground level windows covered by mesh or bars ?

  No

  Partially

  Yes

  N/A

• Is the locking of ground level windows undertaken and checked by staff or security ?

  None

  Security

  Staff

• Are ground level windows electronically alarmed ?

  No

  Partially

  Yes

  N/A

• Are there any natural or man-made features that allow easy entry through a window ?

  Yes

  No

• What are these risk features ?

External Doors

• Are all external doors fabricated from a solid /secure material ?

  Safe

  At Risk

  N/A

• How many door entry points are there from the outside ?

  less than 2

  2 - 8

  8 - 15

  more than 15

• What type of locking mechanism is used ?

  No lock controls

  Key locked

  Card Access

• Are perimeter doors on access control ?

  No

  Partially

  Yes

  N/A

• Are perimeter doors locked (armed) during normal business hours ?

  No

  Partially

  Yes

  N/A

• Are perimeter doors alarmed ?

  No

  Partially

  Yes

  N/A

• Are these alarms monitored centrally by security ?

  No

  Partially

  Yes

  N/A

• Are perimeter doors covered by CCTV cameras ?

  No

  Partially

  Yes

  N/A

• Are there any service tunnel connections to this building / site ?

  Yes

  No

• Are all chemical stores securely locked at all times ?

  No

  Partially

  Yes

  N/A

• Is landscape / shrubbery near access doors and pedestrian ways well maintained and free from hiding points ?

  No

  Partially

  Yes

  N/A

Security and Safety Signage

• Does site have "No Trespassing" signage posted at entry points?

  No

  Partially

  Yes

  N/A

Employee/Visitor Parking

• Are designated Employee Parking Areas & Visitor Parking areas established ?

  No

  Partially

  Yes

  N/A

• Is there adequate lighting in the parking areas & building exterior?

  No

  Partially

  Yes

  N/A

• Is the Visitor Parking Area clearly signposted giving directional advice ?

  No

  Partially

  Yes

  N/A

Security Profile of Local Area and Surrounds

• Area Crime Rate

  High Risk

  Med Risk

  Low Risk

• Criminal activity history at the site and surrounds ?

  Select Murder Sexual Assault Assault Robbery Burglary Theft Harrassment Vandalism Nothing

  • Murder
  • Sexual Assault
  • Assault
  • Robbery
  • Burglary
  • Theft
  • Harrassment
  • Vandalism
  • Nothing

• Local Police Contact (Dept, Phone, & Address)

• Police Distance From Site

• Are there any infrastructure or facilities close-by that proves a security risk ? (explosives, fuel tanks, chemicals, or public facilities, general environment etc)

  Yes

  No

• Are vehicles restricted from gaining close proximity to buildings ?

  No

  Partially

  Yes

  N/A

• Is the area patrolled by police ?

  No

  Partially

  Yes

  N/A

• Is the area patrolled by security ?

  No

  Partially

  Yes

  N/A

• Comments on this section:

RISK CONTROL and EMERGENCY MANAGEMENT

Key / Access Card Management

• Do the occupants maintain a "Key Issue Log" or have access to "Access Control Card" reports at the site/building ?

  No

  Partially

  Yes

  N/A

• Do occupant staff / managers regularly update security with current user requirements for access card privileges ?

  No

  Partially

  Yes

  N/A

• Does security run regular reports on access card privileges and engage with the occupants ?

  No

  Partially

  Yes

  N/A

• Are high risk interior office & shop/storage room doors kept closed and locked when not occupied?

  No

  Partially

  Yes

  N/A

Visitor Controls

• Does the site/building have a dedicated visitor entrance ?

  No

  Partially

  Yes

  N/A

• Type of security control at visitor entrance ?

  Select Open/Unlocked Key Control Turn Stiles Card Access Biometric

  • Open/Unlocked
  • Key Control
  • Turn Stiles
  • Card Access
  • Biometric

• Is a visitor Sign-In log in use ?

  No

  Partially

  Yes

  N/A

• Are visitors required to wear a Visitor Badge whilst on site ?

  No

  Partially

  Yes

  N/A

• Do visitors attend, or are given advise on, safety orientation detailing emergency evacuation, evacuation staging areas, Hazmat, PPE etc (the rules) ?

  No

  Partially

  Yes

  N/A

Reception and Lobby Controls

• Does the site have a reception on the main entry level ?

  No

  Partially

  Yes

  N/A

• Does the entry level foyer have zoned electronic security ?

  No

  Partially

  Yes

  N/A

• Do staff around the main entrance zone they have a "programmed duress- CODE BLACK KEY" phone system in place ?

  Normal Phone

  Duress button

  CODE BLACK phone

Facility Lockdown

• Does the Building / Site have electronic lock down functionality ?

  No

  Partially

  Yes

  N/A

Emergency Preparedness

• Do occupants (staff/students) attend annual emergency evacuation drill procedures ?

  No

  Partially

  Yes

  N/A

• What percentage of all staff are involved ?

  zero

  25%

  50%

  75%

  100%

• What percentage of student (full quota) are involved ?

  zero

  25%

  50%

  75%

  100%

• Do occupants (staff/students) attend emergency familiarization training other than the annual evacuation drills ?

  No

  Partially

  Yes

  N/A

• What percentage of all staff are involved ?

  zero

  25%

  50%

  75%

  100%

• What type of training and how many staff ?

• What percentage of student (full quota) are involved ?

  zero

  25%

  50%

  75%

  100%

• What type of training and how many students ?

Risk Planning

• Do the occupants have adequate Business Continuity Plans (BCPs) in place ?

  No

  Partially

  Yes

  N/A

• Were the BCPs sighted as part of the audit ?

  No

  Partially

  Yes

  N/A

• Does the complex have a history of natural disasters ? (Flooding; Fire etc)

  Yes - High Risk

  No - Low Risk

  N/A

• Describe these events and the frequencies:

• Are there any dangerous chemicals stored at this complex ?

  Yes - High Risk

  No - Low Risk

  N/A

• Describe these chemicals and their storage locations:

• Are these chemicals recorded in the UTAS Chemwatch Database ?

  No

  Partially

  Yes

  N/A

• Are there any drugs held on the premises ?

  Yes - High Risk

  No - Low Risk

  N/A

• Are the drugs held in a secure / safe area ?

  No

  Partially

  Yes

  N/A

• Are the drugs listed on a managed manifest ?

  No

  Partially

  Yes

  N/A

• Who controls and updates the drug manifest ? (Include contact number)

• Are there any biological hazards occurring or stored at this complex ?

  Yes - High Risk

  No - Low Risk

  N/A

• Describe what these might be and where they are stored.

• Who controls / manages these biological hazards ? (include contact number)

SECURITY SYSTEMS

Intrusion Detection System (IDS)

• Does the site have a working intruder alarm system ?

  No

  Partially

  Yes

  N/A

• Enter type of system & monitoring company name if not central security:

• Does the system undergo a full system test regularly ?

  No

  Partially

  Yes

  N/A

• Does the system provide full coverage of site building(s)?

  No

  Partially

  Yes

  N/A

• Who tests the system ?

  None

  Security

  Staff

• Do alarms have a battery backup in case of power failure?

  No

  Partially

  Yes

  N/A

• Do alarms have cellular or other RF backup in case of phone line loss?

  Yes

  No

  N/A

• Attach picture(s) of alarm keypad & main panel if installed

  Media

• Are there any intruder alarms on the roof or other external element of the facility ?

  No

  Partially

  Yes

  N/A

CCTV

• Does the site have a functioning CCTV system?

  No

  Partially

  Yes

  N/A

• Type of system

  VCR

  DVR

  Networked DVR

  NVR

• Number of cameras

• Is the CCTV system adequate ?

  No

  Partially

  Yes

  N/A

• Does the system need to be reviewed in terms of location / coverage of high risk zones ?

  Yes

  No

Help Points

• Does the building / site contain adequate help points

  No

  Partially

  Yes

  N/A

• Are the help points tested on a regular schedule ?

  No

  Partially

  Yes

  N/A

• Who tests the help points ?

  None

  Security

Duress Alarms

• Does the building / site contain duress alarm points

  No

  Partially

  Yes

  N/A

• Are the duress alarms tested on a regular schedule ?

  No

  Partially

  Yes

  N/A

• Who tests the duress alarms ?

  None

  Security

  Staff

• Do staff in receptions throughout the building have a duress alarm, or a "programmed duress- CODE BLACK KEY" phone system in place ?

  Normal Phone

  Duress button

  CODE BLACK phone

Door Access Control

• Does the site have a functioning Access Control system?

  No

  Partially

  Yes

  N/A

• Type of system

  Open/Unlocked

  Key Control

  Turn Stiles

  Card Access

  Biometric

• Percentage of external doors that have electronic control ?

  zero

  25%

  50%

  75%

  100%

• Is the Access Control system adequate ?

  No

  Partially

  Yes

  N/A

• Does the building / complex have ZONED access controlled spaces ?

  No

  Partially

  Yes

  N/A

• Does the system need to be reviewed in terms of location / coverage of high risk zones ?

  Yes

  No

• Is there a regular lockup routine ?

  No

  Partially

  Yes

  N/A

• Is the lockup undertaken by staff or security ?

  None

  Security

  Staff

• Is the lockup routine effective / efficient / sufficient ?

  No

  Partially

  Yes

  N/A

GUARDING AND PATROL SERVICES

Guards in Residence

• Are there any guards stationed in the building ?

  Yes

  No Guard

• Given the site risk profile and systems mitigation's in place does this site/building require an on site guard ?

  Yes - High Risk

  No - Low Risk

  N/A

Guards in Residence Effectiveness

• What are the roles of guards stationed in the building ?

  Concierge

  Concierge + Patrols

  Random Patrols

  No Guard

• What percentage of true and actual security tasks does the guard actually undertake ? (In this context security tasks include randomised patrols through the complex, incident report writing, investigations, escort roles)

  zero

  25%

  50%

  75%

  100%

• Is this guard available for responding to emergencies at other sites if required ?

  No

  Partially

  Yes

  N/A

Dedicated Reception

• Does the building have a dedicated, staffed, reception at the building entry?

  No

  Partially

  Yes

  N/A

Central Guard Patrols

• Do central guards patrol the site / building after hours?

  No

  Partially

  Yes

  N/A

• How often in "out of hours" are the random patrols ?

  None

  Once

  Twice

  Three times

  Four times

• How often in "during office hours" are the random patrols ?

  None

  Once

  Twice

  Three times

  Four times

• Who locks up the building ?

  None

  Security

  Staff

Security Response to Emergencies

• What is the response time from central security to attend an emergency ?

  less than 5 min

  5 min - 10 min

  10 min - 20min

  more than 20 min

  None

• Can backup security immediately be provided with the current resource availability ?

  No

  Partially

  Yes

  N/A

• If required, what is the chances of obtaining additional security?

  zero

  25%

  50%

  75%

  100%

• Who would supply the addition security services ?

  Other Providers

  UTAS Contracted

Final Comments

• Comments:

Audit Signoff

• Acknowledgement of person attending the audit / review

  Sign

• Select person signing this audit / review

  Robert Leaver

  Barry Russell

• Add signature

  Sign