When developing a security plan, there are multiple vulnerabilities and specific threats to consider.

• How attractive is the organization as a target?

• What would be the direct and indirect impacts of a given incident?

• What is the probability of a security incident occurrence?

Once the risks are identified, your organization can and should be bench-marked against peer organizations. Bench-marking can be a powerful tool to validate that risks are real, evident and should be mitigated.

The second and often most important component for plan development is the set of controls or measures used to prevent a security incident. Physical security controls/measures are grouped into three broad elements:

• Operations

• Architecture

• Technology

Operational security represents the weakest link and needs to be reviewed often.

Organizations need to have broad-based security awareness programs that reach all employees which, done right, requires a significant attention.

Once the security measures have been identified using the outside-in approach, the next step is to create a security master plan, which shows accurate controls and measures being proposed.

The planning should adopt a holistic, all-security-risks approach.

This is a living document that needs to be updated regularly and will form the basis for any presentation to management.

Embracing the need for a well thought-out security plan can make the difference in obtaining resources once a security event occurs.