Facility Security Assessment: From the Outer Perimeter to Access Control

What is a facility security assessment, and why start with risk?

A facility security assessment is a structured examination that answers one question: what are we protecting, from what, and where are the gaps? The common mistake is to start with an equipment list, more cameras and newer gates, before understanding the risks they are meant to address.

ASIS PAP-2021 treats physical asset protection as a management system: designing, implementing, monitoring, evaluating and maintaining a protection programme for people, property and information. ^[1] The assessment is therefore not a one-off event but part of a continuing cycle.

The FEMA 426 method gives a practical formula for setting priorities: risk = asset value × threat rating × vulnerability rating, with each factor scored from 1 to 10 and people treated as the most important asset in any building. ^[4]

Do not score the threat on impression alone. FEMA 426 rates threats on five factors: whether a hostile party exists, its capability, the history of similar incidents, its intention, and whether it is actually targeting the facility. ^[4] A jewellery shop in a mall and an archive warehouse in an industrial area may hold assets of similar value, but their threat factors are entirely different, and so is the right response.

What is the regulatory reference in the GCC?

Security requirements for facilities are set by each country, and sometimes each emirate; there is no single GCC rule. In Dubai, for example, Law No. (12) of 2016 regulates the security industry and gives the Security Industry Regulatory Agency (SIRA) the power to set and update standards and specifications, follow up compliance and license security service providers. ^[6]

The law defines “vital sectors”, naming banks, money exchange establishments, gold and jewellery shops, hotels, shopping malls and hospitals among them, and leaves the security requirements and technical specifications for these sectors and for major compounds, and the security requirements for public events, to the Implementing Bylaw. ^[6] Fines range from AED 10,000 to AED 500,000 and double for a repeat violation within a year, up to a maximum of AED 1 million. ^[6]

Outside Dubai, and in the other GCC states, check with the competent security authority and your sector’s requirements before relying on the assessment’s conclusions.

The three layers of defence

FEMA 430 divides a facility into three layers of defence: the first outside the site boundary or defended perimeter, the second between that boundary and the building or other protected assets, and the third the building envelope, structure and interior assets. ^[3] The idea is defence in depth: cumulative barriers that an attacker must penetrate one after another. ^[3]

Each layer has a job. You can read them through FEMA 426’s four aims: deter, by making the target hard to reach or defeat; detect, using monitoring and security response to identify the threat; deny, by minimising or delaying damage; and devalue, by making the target of little value to an attacker. ^[4] If the assessment finds nothing that serves detection in the second layer, for instance, that is a gap even if the building itself is hardened.

The perimeter and the site: what to check

In the first and second layers, focus on four questions:

• Standoff: how close can an uninspected vehicle get to the building? Each additional increment of standoff gives progressively more protection. ^[4]
• Where inspection happens: vehicle and pedestrian access control and inspection should take place as far from the facility as possible, not at its door. ^[4]
• Number of entrances: the aim is at least two access points, one for passenger vehicles and one for delivery trucks. ^[4]
• Barriers: passive barriers such as walls, bollards, planters and berms, and active ones such as retractable bollards and rising wedges, reduce the chance of vehicle penetration; the site inside the barrier becomes a controlled access zone in which the design of entry control points is critical. ^[3]

CPTED: design that prevents crime

Crime prevention through environmental design (CPTED) uses site and building design to reduce crime and the fear of crime. ISO has published international guidelines for it in ISO 22341:2021, developed by technical committee ISO/TC 292, which apply to new and existing built environments and to organisations of any type or size. ^[2]

The City of Las Vegas CPTED Handbook sets out five principles that translate directly into assessment questions: ^[5]

A practical rule from the same handbook is the “2ft/6ft rule”: trim shrubs to 2 feet (about 60 cm) or less and raise tree canopies to 6 feet (about 1.8 m) or more, reducing hiding places and improving visibility. ^[5] Lighting should be uniform, avoiding pockets of shadow and glare. ^[5]

The third layer: controlling access to the building

Inside the building, the question shifts from “who is approaching?” to “who can reach what?”. In the assessment, check:

1. Zoning: public (reception), staff and restricted areas (server rooms, safes, control rooms), with access rights for each zone based on business need.
2. Entry points: are there as few as possible, and are entrances fitted with electronic entry control and CCTV coverage appropriate to the facility’s protection level? ^[4]
3. Visitors and suppliers: pre-registration, visible identification, escorts in restricted areas and a separate delivery route.
4. Keys and cards: a register for every key and card, immediate cancellation when someone leaves, and periodic review of access rights.
5. Response: who sees the alarm, and how many minutes until someone arrives? Detection without response stops nothing.

Hypothetical example: a government service building

With illustrative scores: a service building open to the public, with the public car park directly against its glazed frontage.

• Asset value (staff and visitors) = 8, threat rating from a vehicle in the car park = 5, vulnerability rating = 7 because there is no barrier.
• Risk = 8 × 5 × 7 = 280.
• Proposed measure: planters and fixed bollards along the kerb, and visitor parking moved to the far end, reducing vulnerability to 4, so risk = 8 × 5 × 4 = 160.

The difference between the two figures is what justifies the cost to management; the organisation sets its own acceptance thresholds for each level.

How to write the assessment report

Make the report actionable rather than descriptive. For each layer, record what works well and should be kept, the vulnerabilities ranked by risk score, and for each vulnerability one or more mitigation options with a rough cost, an owner and a deadline. Attach photographs and the site plan with the location of each finding, because a finding without a location does not get fixed.

Reassess when threats or building use change and after any incident, within the cycle of design, implementation, monitoring, evaluation and maintenance on which the ASIS standard is built. ^[1]

Conclusion

A good facility security assessment starts with assets and threats, works through the three layers from outside the site to the rooms inside, and applies CPTED before buying any equipment. Score the risk before and after mitigation, and write a report that gives every vulnerability an owner and a deadline.