Approach
How the work is done, and how it is evidenced.
Every assessment states how the conclusion was reached, what evidence it rests on, and what would change it. Sources are graded, likelihood is stated against a defined yardstick, and assumptions are labelled as assumptions.
How the work is done
The process changes with the service. The discipline does not.
Different problems need different methods. The common thread is evidence, clear judgement, ownership and a usable decision.
Context
What are you trying to achieve and what must remain possible?
Evidence
What is verified, reported, assumed or missing?
Judgement
What is credible, exposed and vulnerable? Do the controls work?
Decision
What should be accepted, changed, strengthened or stopped?
Action
What happens next, who owns it and when is it reviewed?
An unknown does not become a fact because it would make the report tidier. Material gaps are identified, assumptions labelled and reassessment triggers stated.
Principles
Four principles, applied to every engagement.
These apply whatever the scope of the engagement. They govern how a judgement is reached, and whether it holds up once it leaves the page.
Proportionate
The response should match the risk. I recommend what is necessary, explain why, and don't add measures that serve no real purpose.
Clear judgement
Every piece of work reaches a conclusion. What I recommend, why I recommend it, and what needs to happen next.
Evidence-led
Recommendations are based on the available evidence, properly assessed. Facts, assumptions and gaps are kept separate so you can see what the judgement is based on.
Practical
It has to work in practice, not just read well in a report. Recommendations take account of the people, the environment and how the organisation actually operates.
How a site is read
A survey is run from the attacker's side of the fence.
Anyone studying a location works through four questions. A survey that does not answer them has not tested anything.
- 01
What attracts me to the target?
What is held here, who is here, and what is gained by getting at it.
- 02
How vulnerable does the target appear?
What is visible from the approach: the perimeter, the routine, the gaps.
- 03
How confident do I feel about attacking it?
Whether the measures on show would actually stop or delay anyone.
- 04
Will I get away?
Detection, response time and the routes out.
The findings are then written the same way round: what was looked at, what was found, why it matters, and what to do about it.
The method, by service
The assessment process varies with the service being delivered.
Assessing a destination, identifying and treating a risk, and building a training programme are not the same job and are not built the same way.
See the three methods in fullPOSTT · Identify and treat · Train and assess
POSTT
Worked example — Executive visit, high-threat market- PPolitical3/5
Moderate
Government functioning, policing thin away from the centre
- OOperational4/5
High
Power, medical cover and vehicle recovery all have to be brought in
- SSecurity3/5
Moderate
No major incident this period, criminality against visitors persistent
- TTravel4/5
High
The airport road and any movement after dark carry the exposure
- TTerrorism2/5
Guarded
Capability exists in country, no recent targeting in this city
Every destination is read against the same five headings, and every score carries the reason it was given, so two assessments can be compared rather than just read.
Identify & treat
ISO 31000Identification prompts
- What?The asset at risk, and the act that would harm it
- Where?The location, and the ground the act would happen on
- When?The timing, and the window in which exposure is real
- Why?The motive, and what a hostile party gains from it
- How?The method they would realistically use, and with what capability
Treatment options
- AvoidDo not run the activity in the form proposed
- ReduceLower the likelihood, the impact, or both
- ShareMove part of the exposure by contract, partner or insurance, knowing the duty of care stays with you
- AcceptCarry it knowingly, with the decision recorded and owned
- PursueTake the risk deliberately because the opportunity justifies it
Every risk carries one of the five treatments, a named owner and a stated residual risk. A risk with no treatment against it is not a finding, it is a note.
Training cycle
Identifying needs and planning
The needs of the organisation, the trainer and the learners, and the plan built around them
Designing
Programme, materials and resources designed to cover what the subject requires
Facilitating
Delivering the learning, using a variety of approaches and resources
Assessing
Checking the skills, knowledge and understanding have actually been gained
Evaluating
Feedback obtained and the process evaluated, so the next delivery is better
The client receives a training record showing who attended, what was covered and the standard reached.
Worked against combined specialist knowledge acquired through experience, training and real-life exposure.
Next step
Talk it through first.
Describe the situation and I will tell you what I would do about it, or whether you need me at all. Fifteen minutes.