Security Planning: 
From risk assessment to security plan

You will find previous modules (Security Strategies, Threat Assessment) essential to understanding this module. You can draw upon those modules to develop a security plan. 

MODULE
Goal
The goal of this module is to provide you with the concepts, principles, techniques and tools to develop a security plan.
Learning Objectives
Upon completion of this module, the participants will be able to:
•	describe the mission and security concept for their respective agency;
•	identify the threats and risks their respective security plans address;
•	enumerate and describe the standard operating procedures enshrined in their respective security plans;
•	list the contingencies included in their respective security plans and the relevant responses to each.
Key Learning Points
1.  A well-developed security plan is an essential management tool.
2.  Security planning is a team process that raises awareness, defines responsibilities and guides decision-making.
3.  In order to be effective a security plan must be well understood by all staff members, procedures practiced and content regularly revised.
SECURITY PLANNING
A security plan is a single document containing agency security-related plans and procedures, and other information required to implement them.  The objective of a security plan is to enable staff to act effectively to prevent and mitigate the effects of security problems in a manner that is appropriate for your agency.  A security plan contains an agency’s plans and procedures related to security, and includes other information required for staff members to implement them. A security plan has several components.
•	Introduction. The plan should have a concise statement of purpose, identify the intended users of the plan, designate where the master copy is kept, identify to whom the plan has been distributed, and clear instructions on the use of the security plan.
•	Background. Agency mandate/mission, a summary of the threat/risk assessment situation, agency security strategy
•	Procedures. Procedures for movement, communication, site management, reacting to security incidents, and reporting/analyzing incidents.
•	Plans. Contingency plans (complex, multi-staff member agency responses to high-risk foreseeable events, such as MEDIVAC and evacuation plans)
•	Supporting information. All the information required to implement the procedures and plans, including emergency phone numbers and addressees and a list of personnel information for each staff member to be kept on file in the NGO office.
A word about formatting the security plan.  A comprehensive table of contents and list of appendices will make the plan accessible to the user during a crisis situation.  Footers can be used to indicate the plan’s most current review date.  Pagination allows for accuracy if the plan is being discussed with staff in various locations, or portions need to be referenced or faxed.  Page numbers should correspond with table of contents.
Reasons to develop a security plan
There are several good reasons to develop a security plan.
•	A plan can provide staff with effective means of preventing and mitigating the effects of foreseen type of security incidents by relating what approaches have been effective in that environment (and others) in the past. This is especially important for new staff members.
•	When staff are confronted with an incident or situation that was unforeseen (and cannot get guidance from the country director), a plan can ensure that staff react in a manner that is appropriate for that agency (e.g., not provide transport for members of a local military) by providing the staff with the agency’s security strategy and policies on similar issues. 
•	For incident responses that require coordinated actions by many agency staff (such as evacuations), a plan with a clear, concise and useful set of staff activities and responsibilities to helps ensure a rapid and effective response. 
These are the traditional, narrow views of a plan as pre-designed response.
It is also useful, however, to view planning from larger planning as process perspective, which includes both the pre-designed response (the plan) and the process of developing the plan. This latter view is important because it elucidates why even though a crisis situation may differ from what was envisioned when a plan was written (and a plan therefore is inapplicable), time spent planning was not wasted.
Even if a plan is not implemented exactly as envisioned, contingency planning (the plan and the process of developing it) helps a staff respond more rapidly and effectively than if no planning had taken place. 
This is because going through the planning process—with the whole staff, before a security threat is imminent— helps to:
•	Promote staff understanding of the issues involved in responding to a particular type of contingency, such as the emergency medical evacuation of a staff member from a remote area.
•	Ensure development of potentially complex responses, such as phasing a complete staff evacuation.
•	Compel examination (and discussion with headquarters) of difficult and controversial issues, such as who has authority to call for an evacuation, or whether ransom will be paid to kidnappers and hostage takers.
•	Identify information that must be gathered to respond to an emergency, such as names and up-to-date telephone/radio contact information of all staff members, local police stations, and embassies.
•	Identify preparations that must be made for an emergency response, such as obtaining communications equipment, consolidating personnel and sensitive records, or keeping funds on-hand for an evacuation.
•	Promote a sense of ownership and buy-in to the plan among staff members who participate in the planning.
•	Ensure a clear divisions of tasks and responsibilities among the staff, helping to avoid important things being left undone and the (unnecessary) duplication of effort.
•	Produce a plan that, though perhaps not completely applicable to every situation, can serve as a baseline or starting-point for a modified plan when an emergency arises.
•	Identify training and resource needs for staff members commiserate with their assigned responsibilities.
When to develop plans
Prior to establishing operations in any country, an NGO ought to have conducted preliminary situation assessment on the ground.  Upon arrival and start-up in country (after key staff positions have been filled), the NGO should conduct a threat and risk assessment, establish communications with local authorities, international agencies, and other NGOs, as a prelude to developing a security plan.
Staff members should be oriented to the plan and trained in the skills necessary to enable them to fulfill their assigned responsibilities.  Plan components (communications, logistics, contingencies, etc.) should be practiced periodically to identify strengths and weaknesses of the plan, and build the capacity of the NGO team.
Plans should be briefly reviewed and updated at least every few months, or when personnel, local environmental conditions, or your assessment reveals changes in threat levels or risk. 
Who should develop and review plans?
Your international headquarters can provide plan formats and checklists. But field staff in each country should develop the plans because they will require different types of plans and face different situations, and will ultimately require the insight and familiarity of the plan and the environment to implement the plan effectively.
Within the NGO field headquarters, it is important to ensure as many staff members as possible participate in the planning process to: 
•	Profit from the knowledge of all staff members.
•	Promote a sense of ownership and buy-in among the staff.
•	Ensure that all staff members understand the plans.
New staff members should be asked to review and update plans for the same three reasons, as well as to keep the information in the plans current—especially emergency contact information.  Orientation and training of new staff members should be built into the plan.
STEPS TO DEVELOP A PLAN
You can develop a security plan in four steps.
1.	Develop a security strategy based upon your agency’s (1) mission/mandate/polices and (2) threat/risk assessment for that situation.
2.	Second, develop procedures based upon the strategy.
3.	Develop plans based upon the strategy.
4.	Include information that is necessary to help implement the procedures and plans.
All too often, agencies skip to the second step, resulting in a plan that is inappropriate.
Developing a security strategy
There are three basic security strategies (see Security Strategies module)
•	Acceptance
•	Protection
•	Deterrence
In most instances, agencies adopt security strategies that draw on more than one of these three.
Decisions on strategies are largely based upon
•	Risk assessment. For strategy development, the most important aspect of risk assessment to consider is the causes of threats
•	Agency’s mandate/policies, especially with regard to the use of armed protection.
INPUT FROM KOENRAAD’S MODULE HERE
There is no single methodology for developing a strategy, but experiences suggest that for some situations, different strategies are likely to be more successful than others. Your threat assessment should reveal the threat levels and factors your plan needs to address. How the threat assessment might be used to guide security strategy is demonstrated as follows:
Threat: Crime/banditry
•	If in area where local population not affected, pursuing acceptance may work
•	If in area where local population is also victim (city with mobile criminals, refugee camp w/o village societal structures), acceptance by population may not help--pursue protection
Threat: belligerents target you
•	Pursue acceptance by balancing if you can gain by changing staff behavior and programs in a manner that does not compromise humanitarian values 
•	May need to balance security and other values—balancing aid by giving to less needy--aid to less needy
•	If belligerent will not accept you but requires abandoning humanitarian values (providing aid directly to a military), pursue protection.
•	If protection does not work and agency allows, pursue deterrence
Threat: Caught in cross fire
•	Establish relationships and information exchange mechanisms
•	Acceptance may help you get advance warning and protection
•	Protection helps mitigate effects
Other threats?
Once you have reviewed and analyzed the threat assessment data, specifically document your agency’s mission/mandate/politics, and overall strategy
Developing procedures
The development of plans/procedures should be based upon two factors
•	Strategy. This gives you the framework to think about whether you want procedures that support acceptance, protection or deterrence; and
•	Risk assessment. For plans/procedures development, the most important aspect of threat assessment to consider is the specific types of threats (incident types) most likely to be encountered.
There are three steps/tools to help develop procedures
1. Identify most “important” types of threats (incident types) to address with plans/procedures
•	Tool: Plot threats on impact/likelihood matrix (see Threat Assessment Model)
•	Impact is based upon effects on persons (death, injury, stress), loss of property, effects on program
•	Likelihood based upon threat assessment (see Risk Assessment Model)
•	Threats furthest from point “0” are most serious—highest impact and likelihood
•	Can’t quantify, merely helps conceptualize and prioritize by raising (often previously unknown) disagreements among staff on threats
•	Result: identify and focus NGO staff on most serious threats

2. Based on most important threats, consider trying to both prevent and mitigate the threats
•	Tool: start with most important threats on impact/likelihood matrix
•	Move toward likelihood axis to show effects of prevention
•	Move toward impact axis to show effect of mitigation
•	Show how doing either reduces seriousness of threats by moving toward point “0”
•	Can’t quantify, merely helps conceptualize and prioritize by raising (often previously unknown) disagreements among staff on threats
•	Result: develop plans/procedures to prevent/mitigate, put in security plan

3. Consider whether to adopt certain costly procedures
•	Tool: cost/benefit analysis (matrix)
•	Benefit of plan/procedure is based upon improved security (prevention/mitigation)
•	Cost are financial, staff time, distance from beneficiaries (if protective procedures), perceived as taking sides (possibly if pursuing deterrence)
•	Can’t quantify, merely helps conceptualize and prioritize by raising (often previously unknown) disagreements among staff on threats 
•	Result: decisions on whether to adopt procedures
Developing plans
Formal contingency plans are a set of pre-established procedures for various members of a staff to undertake in order to coordinate a multi-staff member response to an incident. (SOPs tend to be for individual responses to routine incidents). Prerequisites for timely and effective incident response are:
•	contingency planning
•	availability of resources (financial, human, and material)
•	a mechanism for rapid decision-making
•	willingness to act
What emergencies to plan for?
The types of plans to develop should be based primarily on the threats faced by the NGO staff in each situation. But given a potentially broad range of threats, priority should be placed on developing contingency plans that: 
•	Address events that are most likely and have the greatest potential impact
•	Take considerable time and thought to develop
•	Require significant information and preparations 
•	Must be carried out in a rapid and coordinated manner.
The most important plans that fit these criteria are for staff evacuations—both immediate and phased. Others may include emergency medical evacuations, and responses to staff kidnappings and bomb threats.
What to include in a contingency plan?
Although each plan will differ by country and type of emergency, most plans contain the following:
•	Nature of specific incident.
•	General concept of how to react to the incident, including the sequence of staff activities.
•	Division of responsibilities and authorities among the staff, including who can initiate the plan.
•	Who is covered by the plan (e.g., who is to be evacuated).
•	Information on how to contact all personnel: (1) who play a role in the plan, usually including all PVO staff, and (2) with whom coordination may be required, such as local police or embassies.
•	Resources that need to be applied to the management of the incident
•	Guidance on the emergency use of funds, disposition of project property and personal effects.
•	List of annexes (including maps, forms, location of personnel, telephone numbers, radio frequencies, extraordinary procedures, etc.)
How to develop a contingency plan?
To develop a plan that is most likely to be useful in an emergency and make the most out of the planning process, it is important to:
•	Be specific and complete. To help focus planning efforts and ensure that a plan is thorough, be specific about the (1) objectives of the plan, such as “to rapidly evacuate expatriate staff safely;”  (2) underlying assumptions of the plan, such as the availability of phone service to communicate with staff; and (3) responsibilities and authorities of each staff member.
•	Consider alternatives. To increase the chances a plan will be useful and applicable, conduct a “what if” exercise of the plan after it is complete. Such an exercise (which may be done around a table, and need not require any actual activities) focuses on consideration of how the plan would be used in different situations. If there are ways in which the plan is inapplicable, it is useful to add alternative, back-up plans. For example, if an evacuation is required and the main airport is closed, it is useful to also plan an evacuation by driving overland.
•	Conduct follow-up. To ensure that the preparations required to use the plan are taken, such as developing a telephone contact sheet, identify specific preparations that each staff member must undertake, as well as deadlines for doing so.
Many NGOs view writing contingency plans as an unnecessary paperwork burden because they believe:
•	They can handle problems as they arise
•	Plans are useless because they can’t cover every situation. 
These misperceptions have lead many NGOs to eschew planning completely, or quickly write pro-forma plans that are filed and forgotten. But like developing procedures, the process of developing plans is almost as important as the result.
Additional information
A security plan should also contain additional information to assist staff in implementing the procedures and plans.
This information includes:
•	Personnel roster, addresses, telephone numbers, passport numbers
•	List of cooperating agencies, contact people, telephone numbers and radio frequencies
•	List of important contact people (government officials, security personnel, airport and transportation authorities, utility companies, hospitals and clinics, etc.) telephone numbers and radio frequencies
•	Maps (regional, national, sub-regional, local) indicating assembly points, overland routes, air fields, border crossings, etc.
•	Emergency supply inventory (including food, medical, documents, clothing, etc.)
•	Incident Report Forms